# How to Handle Firmware Analysis with Binwalk and EMBA: A Complete Pentesting Workflow

> Master firmware analysis with Binwalk v3 and EMBA. Extract images, audit configs, and detect CVEs for a complete pentesting workflow. Learn more now.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-02

---

**Use Binwalk v3 to recursively extract firmware images, fall back to unblob for incomplete extractions, then run EMBA to automate CVE detection and configuration auditing.**

The `reverse-skill` repository defines a structured firmware security testing methodology based on the OWASP Firmware Security Testing Methodology (FSTM). Handling firmware analysis with Binwalk and EMBA follows a two-stage pipeline: first extracting the filesystem using Binwalk's Rust-based engine, then analyzing the unpacked contents with the Embedded Analyzer for automated vulnerability discovery.

## Extract the Firmware Filesystem with Binwalk (Stage 4)

According to [`skills/firmware-pentest/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md), Stage 4 centers on filesystem extraction. The workflow prioritizes **Binwalk v3** (the Rust implementation) for its speed and concurrency advantages over the legacy Python version.

### Identify Firmware Headers and Entropy

Before extraction, determine the firmware structure and check for compression or encryption. High entropy values (≈ 0.95–1.0) indicate encrypted blobs that require additional reverse engineering.

```bash

# Magic signature identification

binwalk firmware.bin

# Generate entropy plot to detect encryption

binwalk -E firmware.bin

```

The entropy plot generates a PNG visualization (`firmware.bin.png`) revealing encrypted segments as flat high-value regions.

### Recursive Extraction and Fallback Strategies

Perform recursive "matryoshka" extraction using Binwalk's `-Me` flags. If the primary tool fails to unpack specific formats, the methodology documented in [`skills/firmware-pentest/references/extraction-methodology.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/extraction-methodology.md) mandates falling back to **unblob**, then to format-specific utilities.

```bash

# Recursive extraction with Binwalk v3

binwalk -Me firmware.bin

# Fallback if extraction is incomplete

unblob -d out/ firmware.bin

```

### Format-Specific Unpacking

After initial extraction, identify the filesystem type under directories like `squashfs-root/` and unpack with specialized tools:

- **SquashFS**: `unsquashfs -d rootfs/ squashfs-root.squashfs`
- **JFFS2**: `jefferson rootfs.jffs2 -d rootfs/`
- **UBI**: `ubireader_extract_files rootfs.ubi -o rootfs/`

These commands are detailed in the extraction methodology reference.

## Automate Static Analysis with EMBA (Stage 5)

Stage 5 leverages **EMBA** (Embedded Analyzer) to perform automated static analysis. As noted in the skill documentation, EMBA handles approximately 80 % of the analysis workload through CVE matching, configuration auditing, and dangerous function detection.

### Running EMBA Scans

Execute EMBA with root privileges against the original firmware binary or extracted filesystem. The command structure follows the specifications in [`skills/firmware-pentest/references/emba-automated-analysis.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/emba-automated-analysis.md):

```bash
sudo emba -l ./logs -f ./firmware.bin -p ./scan-profiles/default-scan.emba

```

This generates an HTML report in `./logs` containing vulnerability findings and system reconnaissance data.

### Interpreting EMBA Reports

The generated report highlights:

- **Known CVEs** applicable to detected libraries and binaries
- **Hard-coded credentials** and insecure default configurations
- **Dangerous function calls** identified by EMBA's built-in rule sets

Manual validation is required; as stated in [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md), EMBA is not a silver bullet and findings must be verified against actual version strings and runtime conditions.

## Handle Encrypted or Obfuscated Firmware

When Binwalk's entropy analysis reveals values approaching 1.0 across the entire image, the firmware is likely encrypted or heavily obfuscated. In such cases:

1. Proceed to hardware-based extraction via UART/JTAG dumping
2. Reverse engineer the bootloader to locate decryption keys
3. Re-run the Binwalk extraction pipeline after decryption

## Summary

- **Binwalk v3** provides the primary extraction engine through the `-Me` recursive flags, with **unblob** serving as the recommended fallback tool.
- The extraction methodology in [`extraction-methodology.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/extraction-methodology.md) covers entropy analysis, header identification, and format-specific handlers for SquashFS, JFFS2, and UBI.
- **EMBA** automates static analysis and generates HTML reports covering CVEs, credentials, and configuration flaws.
- High entropy readings (≈ 0.95–1.0) indicate encrypted firmware requiring preprocessing before extraction.

## Frequently Asked Questions

### How do I know if firmware is encrypted before extracting it?

Run `binwalk -E firmware.bin` to generate an entropy plot. If the entropy value approaches 1.0 uniformly across the image, the firmware is likely encrypted or compressed with strong obfuscation, requiring decryption attempts before successful extraction.

### What should I do if Binwalk fails to extract a filesystem?

If `binwalk -Me` produces incomplete results, fall back to `unblob -d out/ firmware.bin` as documented in [`extraction-methodology.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/extraction-methodology.md). For persistent failures, use format-specific tools like `jefferson` for JFFS2 or `ubireader_extract_files` for UBI images.

### Can EMBA replace manual firmware analysis?

No. While EMBA handles approximately 80 % of static analysis tasks through automated CVE matching and configuration checks, the `reverse-skill` documentation emphasizes that results require manual validation against actual binary versions and runtime behavior.

### Do I need root privileges to run EMBA?

Yes. The EMBA scanner requires `sudo` access to perform deep filesystem analysis, extract archives, and access low-level system information. Use the command `sudo emba -l ./logs -f ./firmware.bin -p ./scan-profiles/default-scan.emba`.