Firmware, opened.
Every binary inside, read.

Any firmware image unpacked, every binary inside read, an SBOM and CVE list per release. No device, no source, nothing executed.

Drop a firmware imageSee a real image

Private from Pro · On-prem or air-gapped · Never redistributed

THE IMAGE · ACC-2000(6302_HW-2)_2011-06-16.bin

The image is the product.
Read it, not the manifest.

A hardware release is a nested image: a proprietary RTOS, compressed filesystems, closed vendor drivers, hundreds of binaries. Manifest scanners stop at the outer layer.

openbinary opens the image all the way down and reads what is actually there.

A release audit. Six things a device maker is asked for.

SBOM and CVEsComponents named from the compiled bytes, with versions and known CVEs. Severity, KEV and EPSS on every match.zlib1.2.116 CVEs · 1 critical · 4 highCVE-2022-37434critical · EPSS 0.19CVE-2018-25032high · EPSS 0.52
Findings, confirmedUnknown bugs by weakness type, with the path from main. The fuzzer runs the handler and returns the input that triggers it.CWE-121Stack buffer overflowhighhttp_parse_request()reachable from mainfuzzcrash after 1.8 sinput saved · replays
Secrets and certificatesPrivate keys, passwords and tokens found inside the binaries. Who signed each binary, and which ones nobody did.RSA private key/etc/ssl/private.pemBasic auth credential.data 0x51c08signing1 of 2 signed · team 7VPF8GD6J4
HardeningPIE, stack canaries, fortify, NX and PAC checked per binary, listed with the binary that lacks them./usr/sbin/httpdELF armPIE ✓stack canary ✗fortify ✗NX ✓PAC n/a on arm32
Every binary readEvery binary inside the image analysed on its own: functions named, behaviour, components. Nothing picked by hand.CUGrokBotService8,321 functions · 7.6 MBElectron FrameworkMach-O · 181.8 MB+ 43 more45 binaries · all read
CRA exportsCycloneDX and SPDX per image and per binary, SARIF per binary. The CRA reports from 11 Sep 2026, in full from 11 Dec 2027.CycloneDXper image, per binarySPDXper image, per binarySARIFfindings, per binary

Inside the image. What else the unpack turns up.

Files and artifactsEvery file inside classified and kept: binaries, configs, plists, scripts, images, text. Each with the chain of formats it was wrapped in.binary 45config 14data 8image 498plist 20text 523unknown 230d2_0000d362.bindmg → apfs → arcadyan637.1 KB
Phones homeEndpoints, update servers, NTP and DNS pointers found in configs, scripts and CGIs. Surface only: verify each before treating it as a finding.115 occurrences50 shownhttps://github.com/nodejs/node-addon-api/issues2 hitshttp://github.com/tree-sitter/node-tree-sitter.gitpackage.json
Malicious insideEvery binary gets a verdict with the indicators that scored it, tagged to ATT&CK. The package rolls them up.6 malicious binariesDigitStealer16 pending analysis1 undeterminedCaptures screen, camera, microphone or keystrokesT1113 T1123 T1125
Similar imagesOther images in the corpus that share components, CVEs, formats and architectures, ranked by overlap.4%Tiny_Shield_1.10.0.dmg3 format chains1%curl-8.4.0.tar.gz1 format chain1%zlib-static-1.3.2-r1.apk1 format chain

Release against release. What changed, side by side.

ROUTER FIRMWARE · 2.1.388 → 2.1.390 · PACKAGE DEPTH
A · 2.1.388
/usr/sbin/httpdELF arm · 212 functions
/usr/lib/libssl.so.1.0.2openssl 1.0.2u · 14 CVEs
/bin/busybox1.31.1
/usr/sbin/wanduckbehaviour: 2 endpoints
/etc/ssl/private.pemprivate key
/lib/modules/nf_conntrack.ko
B · 2.1.390
/usr/sbin/httpdELF arm · 214 functions
/usr/lib/libssl.so.1.1openssl 1.1.1w · 2 CVEs
/bin/busybox1.31.1
/usr/sbin/wanduckbehaviour: 3 endpoints · 1 new host
/etc/ssl/private.pemremoved
/usr/sbin/telemetrydnew · 41 functions · connects out

Unpack. Nested as deep as the vendor packed it.

UNPACK
134 formats, 48 architecturesFilesystems, archives, boot images, Apple images, containers. binwalk extracts 72.
Every member readFat binaries, kernel collections, daemons and drivers isolated and analysed at function level.
Static by designThe image is dissected and catalogued without running a byte. Anti-analysis loops never fire.
Encrypted imagesReported as encrypted, never guessed at. Opened with the vendor's keys when they are on file.

No operating system. Bare metal and RTOS images, read the same way.

62bare-metal images measured, chip and load address found on all
92%chip known on real vendor images
13 sfor a 44,780-function VxWorks image
15 of 195encrypted, reported as such
READSVxWorksZephyrNuttXFreeRTOSThreadXuC/OSTriCoreRH850RXSuperH8051MSP430XtensaESP32 ROMs

Built for. Device makers, security teams, red teams.

Device makersAnswer for what you ship under the CRA, from the image itself.
Security teamsApprove a vendor update on what changed, not on the release note.
Red teamsStart at the reachable sink, not at the unpacker.

Firmware analysis, asked plainly.

Short answers. Docs has the long ones.

Read the docs
  1. 01

    How does an image get in?

    Drop a file, call the API, or install the GitHub App and every release asset is analysed when it is published.

  2. 02

    Which firmware formats does it unpack?

    134 filesystem, archive, boot, update and container formats, opened natively. squashfs, ubifs, jffs2, yaffs2, cramfs, ext2, U-Boot and uImage, trx, UEFI, Android boot, ESP images, Intel HEX, DfuSe, Apple UARP and more. binwalk extracts 72.

  3. 03

    Does it read bare-metal and RTOS images?

    Yes. 48 architectures are decoded, including ARM, MIPS, Xtensa, TriCore, RH850, RX, SuperH, MSP430, AVR and 8051. VxWorks, Zephyr, FreeRTOS, ThreadX, NuttX and uC/OS images are read at function level.

  4. 04

    What about encrypted firmware?

    It is reported as encrypted. Nothing is presented as read that was not.

  5. 05

    How is the SBOM different from a manifest SBOM?

    It is built from the compiled bytes. 1.84 million library signatures name components inside stripped binaries, most with a CVE-precise version, and package databases inside the image are read too. Exports CycloneDX and SPDX.

  6. 06

    Can an AI agent use it?

    Yes. 69 tools cover everything on this page. One command installs them into Claude Code, Codex, Cursor, Gemini CLI, VS Code and OpenCode.

  7. 07

    Where does it run, and who sees my images?

    Cloud, on-prem or air-gapped. Private workspaces are visible to their members only. Uploaded images are analysed and never redistributed.

Drop a firmware image.

Mach-O, ELF, PE, DEX, WASM, firmware, container and archive images. Up to 2 GB. The report is public unless you sign in.

Choose a fileSet up an agent