From a raw firmware binary to reproducible security evidence
Find the weaknesses in your firmware before it ships. Start from a binary, source code or datasheets, with no board required. Every finding comes with evidence your team, your lab or your customer can reproduce.
From a raw firmware binary to reproducible security evidence
Find the weaknesses in your firmware before it ships. Start from a binary, source code or datasheets, with no board required. Every finding comes with evidence your team, your lab or your customer can reproduce.
Rehosting firmware is tedious.
When you can get the hardware
Even with the device on your desk, production hardware often has its debug access disabled. When it’s available, reconstructing the sequence of events that led to a failure can be a time-consuming process.
When you can’t
Generic emulators don’t model your target’s hardware, so the firmware hangs or crashes early. You fix one missing piece, run again and see where it stops next.
From a raw binary to evidence, in 3 steps
Retrace is our rehosting tool: it gets the binary running without the board. It uses static analysis to see what the firmware expects, and time travel debugging to run the iterations, so every fix is based on what actually ran.
Epoch records the whole execution in a trace: every instruction, every register, every memory access. Nothing is left out, and every replay is identical, so any finding can be reproduced.
Move backwards and forwards, with all runtime information available for your analysis. Leverage esFirmware to run fault injection campaigns.
Explore a real firmware trace, for free.
Get familiar with Epoch and time travel debugging: move backwards and forwards through the U-Boot boot of a Novatek camera, recorded in a trace of more than 21 million instructions.
Go to the live demo ↗
Record the firmware, don’t just debug it live.
A debugger shows you one moment of the firmware, live. Epoch records the whole run, so you can come back to any moment, as often as you need. Read: Turning dynamic analysis into an AI problem →
Fault injection on emulated firmware
Leverage the esFirmware tool to run fault injection campaigns on the emulated firmware, across the code you choose, the fault model you select and against the success criteria you define. It’s purpose-built for fault injection, so every campaign runs efficiently.
One platform for the whole investigation.
esReverse turns the whole workflow into a shared workspace. Retrace, Epoch and esFirmware run there, next to the tools your team already uses, and what you find doesn’t disappear when a session ends. Discover esReverse →
Start from firmware that already runs
Once Retrace gets the firmware running, the emulated target is saved in the project. Anyone on the team can pick it up without setting it up again.
Work on the same recordings
Every Epoch recording is shared. Tags and comments stay on the exact instruction, so a finding is still there for the next person who opens it.
Keep every result in one place
esFirmware campaign results and your own tools, such as Ghidra, IDA, Binary Ninja or radare2, sit in the same workspace as the recordings they refer to.
For teams that need firmware running, without months of manual effort.
Manufacturers
Find weaknesses before silicon or a test bench exists, while a fix is still a code change rather than a recall.
Security teams
Assess the third-party firmware in your products: get it running and see what it does.
Evaluation labs
For CC, SESIP and PSA evaluations: less time on bring-up and trace navigation, more time on test design.
Compliance owners
The Cyber Resilience Act asks manufacturers to document how they tested their products. Reproducible recordings can back up those test reports.
See it in action.
25 million instructions, one skip to bypass secure boot
We recorded a full secure boot in emulation, then simulated faults across it. Skipping a single instruction was enough to make the bootloader accept an unsigned image.
2 checks in MCUboot that a single fault could break
We followed MCUboot from start-up to signature verification. Faulting the public key check or the signature result could make it load an attacker’s image.
40 million instructions recorded in minutes, one overflow found
We ran U-Boot in QEMU and sent it a malicious network reply. The recording shows exactly where it writes past its buffer (CVE-2019-14192).
Let’s look at your firmware.
Tell us what you need to secure. We’ll check whether your target is a good fit and walk you through the workflow on a case like yours.
Frequently Asked Questions
Retrace starts from a binary, source code or datasheets. You don’t need a board.
No. Everything is deployed on your premises, and nothing leaves your environment unless you decide so.
Yes. With esReverse, you add your tools to the platform and combine them with Retrace, Epoch and esFirmware in one workspace, so their results sit next to the recordings.
Epoch gives you deep, reproducible evidence on your critical code paths, and automates how you produce it. That evidence feeds the technical documentation the EU Cyber Resilience Act requires, and paves the way to self-assessment.
