Is there a mode for differential restart?

[CowBoy4mH3LL]

Basically, is there a switch to ignore modules that have already successfully completed in past cycles on the same firmware?

As such, it may be worth doing a diff on the firmware at start to verify it has not changed.
Otherwise analysis would probably need to start from scratch anyways.

Did not find any directives in the help menu, hence asking :)

[m-1-k-3]

If you restart the same scan with the same firmware and the same log directory you should get a note like the following:

this gives you the possibility to try a restart. Warning: this feature is an experimental feature but should work not to bad in most cases

[m-1-k-3]

have you done a clean installation with "sudo ./installer.sh -d"?
What is the output of "sudo docker images"?

[CowBoy4mH3LL]

Seems like the latest image

Also ---
sudo docker pull embeddedanalyzer/emba
Using default tag: latest
latest: Pulling from embeddedanalyzer/emba
Digest: sha256:eb64476d7e42d1a101bd041dd9a48fd0c9f314195214ceb6f73def86a51d8108
Status: Image is up to date for embeddedanalyzer/emba:latest
docker.io/embeddedanalyzer/emba:latest

[CowBoy4mH3LL]

Also -- this is a fresh clone of the latest release

[m-1-k-3]

ok, the base image looks good. I do not understand how you got the failed checks from #1073 (reply in thread)

Is a dependency check working?
sudo ./emba -d 1

Is a typical EMBA scan on a random firmware working? What are your starting parameters?

[CowBoy4mH3LL]

Did a fresh install -- but running with the -i switch still comes up with that same issue

EMBA scan works all good if I use the -y switch, i.e. remove the old log dir -- otherwise -i switch fails with dependency checks

Here is the dependency check results of sudo ./emba -d 1 -- Ill spend some time debugging the -i switch anyways

==> Imported 13 helper files


==> Imported 86 module/s

╔═══════════════════════════════════════════════════════════════╗
║                            E M B A                            ║
║                   EMBEDDED FIRMWARE ANALYZER                  ║
╚═══════════════════════════════════════════════════════════════╝



MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMM EMBA ICS testing edt. MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMM version 1.4.0 MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWWWWWWWWWWWWWWWWWWWWWMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWWWWWWWWWWWWWWWWWWWWWMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMKl,,,,,,,,,,,,,,,,,,:OMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO'                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMW0xONWMMMMMMMMMMMMMMMMMMMMMMMMMMMMXxkXWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMXxkXWMMMMMMMMMMMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd. 'cxKWMMMMMMMMMMMMMMMMMMMMMMMMM0' .;d0NMMMMMMMMMMMMMMMMMMMMMMMMMMO' .:d0NMMMMMMMMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd     .;oOXWMMMMMMMMMMMMMMMMMMMMM0'    .'ckKWMMMMMMMMMMMMMMMMMMMMMMO'    .'lkKWMMMMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd         .:xKNMMMMMMMMMMMMMMMMMM0'        .;o0NMMMMMMMMMMMMMMMMMMMO.        .;d0NMMMMMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd            .,lkXWMMMMMMMMMMMMMM0'           .'cxKWMMMMMMMMMMMMMMMO'           .'ckKWMMMMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd                .:d0NMMMMMMMMMMM0'               .;oONMMMMMMMMMMMMO.               .;oONMMMMMMMMMMMO.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd                   .,lkXWMMMMMMM0'                   'cxKWMMMMMMMMO'                  .'cxKWMMMMMMMO'                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd                       .;d0NMMMM0'                      .;oOKNMMMM0'                      .;oONWMMMO'                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd                          .'cxKW0'                          .'cxKW0'                          'cxKWO'                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd                              .;;.                              .;;.                             .;;.                   dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd                                                                                                                        dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd                                                                                                                        dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd           ,xxxxxxxxxl.                    .lxxxxxxxxd,                      ;xxxxxxxxxc.                               dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd           lWMMMMMMMM0'                    '0MMMMMMMMNc                      dWMMMMMMMMk.                               dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd           lWMMMMMMMM0'                    '0MMMMMMMMNc                      dWMMMMMMMMk.                               dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd           lWMMMMMMMM0'                    '0MMMMMMMMNc                      dWMMMMMMMMk.                               dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd           lWMMMMMMMM0'                    '0MMMMMMMMNc                      dWMMMMMMMMk.                               dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd           'lllllllll:.                    .:llllllllc.                      ,lllllllll;                                dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd                                                                                                                        dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd                                                                                                                        dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd                                                                                                                        dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd                                                                                                                        dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd            ..........                      ..........                        ..........                                dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd           :0KKKXKKXKx.                    .xXKKXKKKK0:                      lKKXXKKXXKd.                               dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd           lWMMMMMMMM0'                    '0MMMMMMMMNc                      dWMMMMMMMMk.                               dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd           lWMMMMMMMM0'                    '0MMMMMMMMNc                      dWMMMMMMMMk.                               dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd           lWMMMMMMMMO'                    '0MMMMMMMMNc                      dWMMMMMMMMk.                               dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd           lNWWWWWWWWO.                    'OWWWWWWWWXc                      oNWWWWWWWWk.                               dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd           .,,,,,,,,,'                      ',,,,,,,,,.                      .,,,,,,,,,.                                dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd                                                                                                                        dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd                                                                                                                        dWMMMMMMMMMMMMM
MMMMMMMMMMMMMWd                                                                                                                        dWMMMMMMMMMMMMM
MMMMMMMMNOkxxx;                                                                                                                        ;xxxxONMMMMMMMM
MMMMMMMM0,                                                                                                                                  ,0MMMMMMMM
MMMMMMMM0,                                                                                                                                  ,0MMMMMMMM
MMMMMMMMN0kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk0NMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM

[*] Wed Mar  6 00:37:40 EST 2024 - Enable python virtual environment ./external/emba_venv


[+] Dependency check
=================================================================


[*] Network connection:
    Internet connection - ok
    EMBA release version - ok
    Docker image version - ok
    EMBA github version - ok
    CVE database version - ok
    ChatGPT-API key not set - see https://github.com/e-m-b-a/emba/wiki/AI-supported-firmware-analysis for more information


[*] Elementary:
    user permission - ok
    Docker compose version - docker compose ok
    configuration directory - ok
    Python virtual environment - ok


[*] Load kernel modules on host system:
    ufs kernel module - ok
    nandsim kernel module - ok
    ubi kernel module - ok
    nbd kernel module - ok


[*] Necessary utils on system:
    docker - ok
    docker-compose - ok
    inotifywait - ok
    notify-send - ok


[*] Wed Mar  6 00:37:48 EST 2024 - EMBA sets up the docker environment.

[*] Wed Mar  6 00:37:48 EST 2024 - EMBA initializes docker container.

==> Imported 13 helper files


==> Imported 86 module/s

╔═══════════════════════════════════════════════════════════════╗
║                            E M B A                            ║
║                   EMBEDDED FIRMWARE ANALYZER                  ║
╚═══════════════════════════════════════════════════════════════╝


[*] Wed Mar  6 00:37:55 EST 2024 - Enable python virtual environment /external/emba_venv


[+] Dependency check
=================================================================


[*] Network connection:
    Isolation  - ok


[*] Elementary:
    user permission - ok
    host distribution - ok
    configuration directory - ok
    external directory - ok
    Python virtual environment - ok


[*] Necessary utils on system:
    awk - ok
    basename - ok
    bash - ok
    bash (version): 5 - ok
    cat - ok
    chmod - ok
    chown - ok
    cp - ok
    cut - ok
    date - ok
    dirname - ok
    dpkg-deb - ok
    echo - ok
    eval - ok
    find - ok
    grep - ok
    head - ok
    kill - ok
    ln - ok
    ls - ok
    md5sum - ok
    mkdir - ok
    mknod - ok
    modinfo - ok
    mv - ok
    netstat - ok
    openssl - ok
    printf - ok
    pwd - ok
    readelf - ok
    realpath - ok
    rm - ok
    rmdir - ok
    sed - ok
    seq - ok
    sleep - ok
    sort - ok
    strings - ok
    tee - ok
    touch - ok
    tr - ok
    uniq - ok
    unzip - ok
    wc - ok


[*] External utils:
    bc - ok
    tree - ok
    unzip - ok
    7z - ok
    jchroot - ok
    uboot mkimage - ok
    binwalk extractor - ok
    cpu_rec - ok
    unblob - ok
    unrar - ok
    john - ok
    pixd visualizer - ok
    PHP iniscan - ok
    pixd image renderer - ok
    progpilot php ini checker - ok
    luacheck - ok
    APKHunt apk scanner - ok
    rpm - ok
    patool - ok
    EnGenius decryptor - ok
    Android payload.bin extractor - ok
    Buffalo decryptor - ok
    ubireader image extractor - ok
    ubireader file extractor - ok
    UEFI Firmware parser - ok
    UEFI image extractor - ok
    UEFI AMI PFAT extractor - ok
    Binarly FwHunt analyzer - ok
    NVD CVE database - ok
    CVE Searchsploit - ok
    Routersploit EDB database - ok
    Routersploit CVE database - ok
    Metasploit CVE database - ok
    checksec script - ok
    sshdcc script - ok
    sudo-parser script - ok
    BMC decryptor - ok
    shellcheck script - ok
    fdtdump - ok
    linux-exploit-suggester.sh script - ok
    objdump disassembler - ok
    radare2 - ok
    bandit - python vulnerability scanner - ok
    qemu-[ARCH]-static - ok
    yara - ok
    ssdeep - ok
    cyclonedx - ok
    vmlinux-to-elf - ok
    STACS hash detection - ok
    Qemu system emulator ARM - ok
    Qemu system emulator ARM64 - ok
    Qemu system emulator MIPS - ok
    Qemu system emulator MIPSel - ok
    Qemu system emulator MIPS64 - ok
    Qemu system emulator MIPS64el - ok
    Qemu system emulator NIOS2 - ok
    Qemu system emulator x86 - ok
    console.* - ok
    busybox.* - ok
    libnvram.* - ok
    libnvram_ioctl.* - ok
    vmlinux.mips* - ok
    zImage.armel - ok
    fixImage.sh - ok
    preInit.sh - ok
    inferFile.sh - ok
    inferService.sh - ok
    Routersploit installation - ok
    Arachni web scanner installation - ok
    TestSSL.sh installation - ok
    Nikto web server analyzer - ok
    Cutycapt screenshot tool - ok
    snmp-check tool - ok
    Nmap portscanner - ok
    hping3 - ok
    ping - ok
    Metasploit framework - ok
    Running Qemu network service - ok
    Running Qemu telnet service - ok
    GHIDRA - ok
    CWE Checker - ok


==> Imported 13 helper files


==> Imported 86 module/s

╔═══════════════════════════════════════════════════════════════╗
║                            E M B A                            ║
║                   EMBEDDED FIRMWARE ANALYZER                  ║
╚═══════════════════════════════════════════════════════════════╝


[*] Wed Mar  6 00:38:08 EST 2024 - Enable python virtual environment /external/emba_venv


[+] Dependency check
=================================================================


[*] Network connection:
    ChatGPT-API key not set - see https://github.com/e-m-b-a/emba/wiki/AI-supported-firmware-analysis for more information


[*] Elementary:
    user permission - ok
    host distribution - ok
    configuration directory - ok
    external directory - ok
    Python virtual environment - ok


[*] Necessary utils on system:
    awk - ok
    basename - ok
    bash - ok
    bash (version): 5 - ok
    cat - ok
    chmod - ok
    chown - ok
    cp - ok
    cut - ok
    date - ok
    dirname - ok
    dpkg-deb - ok
    echo - ok
    eval - ok
    find - ok
    grep - ok
    head - ok
    kill - ok
    ln - ok
    ls - ok
    md5sum - ok
    mkdir - ok
    mknod - ok
    modinfo - ok
    mv - ok
    netstat - ok
    openssl - ok
    printf - ok
    pwd - ok
    readelf - ok
    realpath - ok
    rm - ok
    rmdir - ok
    sed - ok
    seq - ok
    sleep - ok
    sort - ok
    strings - ok
    tee - ok
    touch - ok
    tr - ok
    uniq - ok
    unzip - ok
    wc - ok


[*] External utils:
    bc - ok
    tree - ok
    unzip - ok
    7z - ok


[!] Wed Mar  6 00:38:10 EST 2024 - Test ended on Wed Mar  6 00:38:10 EST 2024 and took about 0 days and 00:00:32 

[m-1-k-3]

har ... I got your problem. The help is regarding -i is wrong:

-i                Ignores log path check

-i is only EMBA internally used and I will remove it from the help (or add a comment)
Sorry and thx for pointing us on this inconsistency

[m-1-k-3]

ok, I did another test and something is broken in here. I will take a deeper look at this issue.

[m-1-k-3]

see #1077

[m-1-k-3]

Please check PR #1078

[secsonthebeach]

Would a “restart” allow for the specification of a new scan profile?
For example, could I run a quick scan profile, and then later run EMBA again using the default or full scan profiles?
Would doing so append the logs, or would it be more like starting over?

[m-1-k-3]

Sorry but this would not work. The restart mechanism is only checking if a module was already finished without further tests. As some modules have different behavior in the different scanning modes this restart scan will not re-run modules with different behavior as they are already finished. In theory you probably could try tweaking your emba.log to run the needed modules but I would not recommend doing so.,

So, if you need more details after a quick scan you need to startup again with a default or full scan.