e-m-b-a / emba

EMBA - The firmware security analyzer
https://www.securefirmware.de
GNU General Public License v3.0
2.49k stars 223 forks source link

The s110 module cannot be executed normally #1175

Closed zut-zyq closed 1 month ago

zut-zyq commented 1 month ago

I encountered some problems in the s110 module and emba.log during use.

  1. I execute EMBA="." FIRMWARE=/firmware LOG=/log docker-compose run emba in the EMBA root directory
  2. enter docker and execute ./emba -l /log -f /firmware -i -c -t -P 8 -T 8 , and wait for the execution to complete.
  3. After checking the s110 module log, the log shows that yara is not installed. But the yara environment is installed in the docker environment. image image
  4. Using EMBA outside docker has the same problem.
  5. And by checking emba.log, I found that I did not set the -e parameter, but the s115 module call record appeared in the log, but only the end call of the module was recorded, and the start call of the module was not recorded. image
m-1-k-3 commented 1 month ago

I recommend start EMBA not from the container. The emba startup script is designed to ensure everything is in place and should be working (including dependencies, auto threading and so on).

Please try it from the outside of the container:

 ./emba -l ~/log -f ~/firmware -p ./scan-profiles/default-scan.emba
m-1-k-3 commented 1 month ago

btw. to enable yara tests you need to enable it in the default settings here or as shown in the scanning profile here

zut-zyq commented 1 month ago

btw. to enable yara tests you need to enable it in the default settings here or as shown in the scanning profile here

Thanks!

m-1-k-3 commented 1 month ago

As the note from the module is somehow wrong I will update it for better understanding.