EMBA v1.4.1 - Follow the white rabbit

[m-1-k-3]

Test the matrix with EMBA

This release reflects the recent updates in our system emulation engine.

Short summary of the latest highlights:

• We started rebuilding and upgrading the toolchain of the system emulation engine - With the current work in place we can further update the outdated FirmAE and firmadyne environment which our emulation engine is originally based on
• Linux kernel upgraded from version 4.1.17 (the original firmadyne and FirmAE version) to version 4.1.52 - The original firmadyne kernel is from 01/2016 and a bit rusty. With the update to 4.1.52 (which is from 05/2018) we moved forward in time for more than 2 years. In the future we plan further updates to include more modern kernels.
• Busybox updated from 1.29.3 to the current version 1.36.1
• Multiple libnvram patches were merged from the rehosting repo of libnvram which is maintained primarly by @AndrewFasano
• Including an optional netcat listener to the system emulation engine
• Further debugging possibilities via strace, gdb and gdbserver added to the system emulation engine
• Handling of time64/time32 support in firmware via updated musl libc for libnvram - This hopefully results in an improved handling on more modern firmware
• Improved environment for ARM64 and MIPS64 architecture
• FIRST EPSS (Exploit Prediction Scoring System) integration - see FIRST EPSS (Exploit Prediction Scoring System) integration #1109
• Updated docker base image to Kali 2024-2
• @gluesmith2021 fixed multiple bugs in our version detection and CVE engine - see here

---

Now, start your fresh Kali Linux (put enough CPU power and RAM into it) and install EMBA:

└─$ git clone https://github.com/e-m-b-a/emba.git
└─$ cd emba 
└─$ sudo ./installer.sh -d

This will install all pre-requisites, including the docker base image and the cve database, which will need some bandwith, harddrive space and time.

Afterwards, you are ready to analyse your first firmware with EMBA:

└─$ sudo ./emba -l ~/log -f ~/firmware -p ./scan-profiles/quick-scan.emba

---

Beside your ongoing support with feedback, testing, working on issues and spreading EMBA you can now also support EMBA as a sponsor.

Check it out here and start being an essential part of the future of EMBA

---

It is always a pleasure to welcome new contributors to EMBA. This time we can welcome:

• @gluesmith2021 made their first contribution in Version string fixes for isc:dhcp and gnu:glibc #1150

What's Changed

• Is there a mode for differential restart? #1073 by @m-1-k-3 in #1073 #1076
• restart EMBA functionality by @m-1-k-3 in restart EMBA functionality #1078
• make the quick mode quick by @m-1-k-3 in make the quick mode quick #1081
• Make the updater work again by @m-1-k-3 in Make the updater work again #1082
• fix hardening log for s16 by @m-1-k-3 in fix hardening log for s16 #1084
• Quick version identifier update by @github-actions in Quick version identifier update #1089
• Metasploit database update by @github-actions in Metasploit database update #1087
• CISA known exploited database update by @github-actions in CISA known exploited database update #1088
• Snyk database update by @github-actions in Snyk database update #1090
• Packetstorm database update by @github-actions in Packetstorm database update #1091
• fix day cnt by @m-1-k-3 in fix day cnt #1085
• fix for Spurious linux_kernel CVEs, cpe string handling by @m-1-k-3 in fix for Spurious linux_kernel CVEs, cpe string handling #1086
• Metasploit database update by @github-actions in Metasploit database update #1094
• full names and working tagging for packetstorm script by @HoxhaEndri in full names and working tagging for packetstorm script #1061
• add md5sum to binaries by @m-1-k-3 in add md5sum to binaries #1096
• installer srecord by @m-1-k-3 in installer srecord #1097
• Firmware/binary handling again by @m-1-k-3 in Firmware/binary handling again #1099
• little fixes by @m-1-k-3 in little fixes #1102
• Quick version identifier update by @github-actions in Quick version identifier update #1105
• CISA known exploited database update by @github-actions in CISA known exploited database update #1104
• Metasploit database update by @github-actions in Metasploit database update #1103
• Packetstorm database update by @github-actions in Packetstorm database update #1107
• Snyk database update by @github-actions in Snyk database update #1106
• Packetstorm database update by @github-actions in Packetstorm database update #1113
• CISA known exploited database update by @github-actions in CISA known exploited database update #1111
• Metasploit database update by @github-actions in Metasploit database update #1110
• Snyk database update by @github-actions in Snyk database update #1112
• xz backdoor detection - CVE-2024-3094 by @m-1-k-3 in xz backdoor detection - CVE-2024-3094 #1114
• FIRST EPSS (Exploit Prediction Scoring System) integration by @m-1-k-3 in FIRST EPSS (Exploit Prediction Scoring System) integration #1109
• Workflow docker builder updates by @m-1-k-3 in Workflow docker builder updates #1115
• Remove Arachni / refactoring by @m-1-k-3 in Remove Arachni / refactoring #1117
• Packetstorm database update by @github-actions in Packetstorm database update #1122
• CISA known exploited database update by @github-actions in CISA known exploited database update #1120
• csv issues f10 + p99 csv files question #1116 by @m-1-k-3 in csv issues #1116 #1118
• Metasploit database update by @github-actions in Metasploit database update #1119
• Snyk database update by @github-actions in Snyk database update #1121
• csv issues f10 + p99 csv files question #1116 by @m-1-k-3 in csv issues #1116 #1123
• f10 csv fix by @m-1-k-3 in f10 csv fix #1124
• Vars check by @m-1-k-3 in Vars check #1126
• Metasploit database update by @github-actions in Metasploit database update #1128
• CISA known exploited database update by @github-actions in CISA known exploited database update #1129
• Packetstorm database update by @github-actions in Packetstorm database update #1131
• Snyk database update by @github-actions in Snyk database update #1130
• further vars cleanup, kev in f20 by @m-1-k-3 in further vars cleanup, kev in f20 #1127
• var cleanup, status_bar fix by @m-1-k-3 in var cleanup, status_bar fix #1132
• S36 updates, l10 fixes by @m-1-k-3 in S36 updates, l10 fixes #1133
• CISA known exploited database update by @github-actions in CISA known exploited database update #1135
• Packetstorm database update by @github-actions in Packetstorm database update #1137
• Metasploit database update by @github-actions in Metasploit database update #1134
• Snyk database update by @github-actions in Snyk database update #1136
• Emulation updates by @m-1-k-3 in Emulation updates #1140
• Packetstorm database update by @github-actions in Packetstorm database update #1144
• CISA known exploited database update by @github-actions in CISA known exploited database update #1142
• Metasploit database update by @github-actions in Metasploit database update #1141
• s115 qemu command output by @m-1-k-3 in s115 qemu command output #1145
• Snyk database update by @github-actions in Snyk database update #1143
• Packetstorm database update by @github-actions in Packetstorm database update #1149
• CISA known exploited database update by @github-actions in CISA known exploited database update #1147
• Metasploit database update by @github-actions in Metasploit database update #1146
• Snyk database update by @github-actions in Snyk database update #1148
• Metasploit database update by @github-actions in Metasploit database update #1151
• Packetstorm database update by @github-actions in Packetstorm database update #1153
• Snyk database update by @github-actions in Snyk database update #1152
• Version string fixes for isc:dhcp and gnu:glibc by @gluesmith2021 in Version string fixes for isc:dhcp and gnu:glibc #1150
• Update default-scan-no-notify.emba by @BenediktMKuehne in Update default-scan-no-notify.emba #1156
• Packetstorm database update by @github-actions in Packetstorm database update #1161
• Quick version identifier update by @github-actions in Quick version identifier update #1160
• CISA known exploited database update by @github-actions in CISA known exploited database update #1158
• fix zlib (unzip) version string by @gluesmith2021 in fix zlib (unzip) version string #1164
• JTR hash sorting by @BenediktMKuehne in JTR hash sorting #1154
• Dhcp version strings and blacklist fix by @gluesmith2021 in Dhcp version strings and blacklist fix #1163
• f20 cpe handling Improve "ISC DHCP" detection and CVE search #1155 by @m-1-k-3 in f20 cpe handling #1155 #1166
• MODULE_BLACKLIST array handling by @m-1-k-3 in MODULE_BLACKLIST array handling #1168
• CISA known exploited database update by @github-actions in CISA known exploited database update #1170
• Quick version identifier update by @github-actions in Quick version identifier update #1171
• Metasploit database update by @github-actions in Metasploit database update #1169
• Snyk database update by @github-actions in Snyk database update #1172
• Packetstorm database update by @github-actions in Packetstorm database update #1173
• improve not on YARA settings by @m-1-k-3 in improve not on YARA settings #1176
• F20 CVE version range checking: fix and dead code removal by @gluesmith2021 in F20 CVE version range checking: fix and dead code removal #1165
• Less regex / f20 and s21 wording by @m-1-k-3 in Less regex / f20 and s21 wording #1177
• Update unblob and binwalk installer by @m-1-k-3 in Update unblob and binwalk installer #1178
• System emulation updates by @m-1-k-3 in System emulation updates #1157
• Revert "System emulation updates" by @m-1-k-3 in Revert "System emulation updates" #1179
• Metasploit database update by @github-actions in Metasploit database update #1181
• CISA known exploited database update by @github-actions in CISA known exploited database update #1182
• Packetstorm database update by @github-actions in Packetstorm database update #1185
• Quick version identifier update by @github-actions in Quick version identifier update #1184
• Packetstorm database update by @github-actions in Packetstorm database update #1191
• Snyk database update by @github-actions in Snyk database update #1190
• CISA known exploited database update by @github-actions in CISA known exploited database update #1189
• Metasploit database update by @github-actions in Metasploit database update #1188
• System emulator updates by @m-1-k-3 in System emulator updates #1180
• Snyk script improved by @HoxhaEndri in Snyk script improved #1186
• System emulation updates by @m-1-k-3 in System emulation updates #1193
• Metasploit database update by @github-actions in Metasploit database update #1194
• CISA known exploited database update by @github-actions in CISA known exploited database update #1195
• Quick version identifier update by @github-actions in Quick version identifier update #1196
• Packetstorm database update by @github-actions in Packetstorm database update #1198
• System emulation updates by @m-1-k-3 in System emulation updates #1199
• Snyk database update by @github-actions in Snyk database update #1197
• Update README.md by @BenediktMKuehne in Update README.md #1200

New Contributors

• @gluesmith2021 made their first contribution in Version string fixes for isc:dhcp and gnu:glibc #1150

Full Changelog: 1.4.0-ICS-testing-edt...1.4.1-white-rabbit

---

This discussion was created from the release EMBA v1.4.1 - Follow the white rabbit.