AwesomeREA.org

Tool

mithril

Offline C++ scanner for the contents of firmware and IoT software, pointed at a single file or an already unpacked root filesystem, that reports embedded secrets, a software bill of materials, known CVEs, open-source licenses, boot-security configuration and weak or publicly known keys, each finding with its evidence and a confidence level. Its SBOM also recovers components from ELF version banners, libc filenames and the kernel banner in stripped images and is written as CycloneDX and SPDX, while the CVE pass joins it against a local OSV and NVD mirror annotated with CISA KEV and EPSS. It does not unpack images; the author's companion tool moria handles identification and extraction.

Targets
Firmware
Category
Firmware tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • A young, fast-moving project: the repository was created on 2026-09-07, and v0.4.0, published 2026-10-22, is the latest release at review, with Linux x86_64 and arm64 and macOS arm64 archives plus Debian packages for amd64 and arm64; the reviewed commit is the merge of that release.
  • Source builds need CMake 3.20+ and a C++20 compiler and link no third-party libraries; flake.nix, package.nix and Debian packaging are included. Input is a firmware file or a directory already extracted by moria or another unpacker; the --boot pass also reads a raw AMI or EDK2 BIOS image to report UEFI Secure Boot posture.
  • Scans make no network calls. The CVE pass needs a local mirror in .local/share/mithril under the home directory (or $MITHRIL_DB), downloaded once with --fetch-db from the project's weekly rebuilt db-latest release and checked against published SHA-256 sums (needs curl), or rebuilt from OSV.dev, NVD, CISA KEV, EPSS and the optional kernel.org feed with --update-db. README notes that the kernel checklist is curated rather than exhaustive, so an empty kernel result does not mean the kernel is clean, and that secret findings are well-formed matches, never confirmed live credentials.
  • The compiled-in key corpora are built from public keys and certificates vendored under data/: the public halves of rapid7 ssh-badkeys, the Vagrant insecure public key, eMudhra intermediate CA certificates, AOSP test-key public halves and the PKfail AMI test Platform Key certificate. THIRD_PARTY.md states that no private-key material is stored, and the key tests generate their keys with openssl at run time.
  • MIT; the vendored key data keeps its upstream MIT or Apache-2.0 terms, and the mirrored vulnerability feeds belong to their sources. Nothing was built or run and no firmware was scanned in this review; the reviewed sources establish no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · nmatt0/mithril · Revision 3f5bf55
  2. CMakeLists.txt GitHub · nmatt0/mithril · Revision 3f5bf55
  3. THIRD_PARTY.md GitHub · nmatt0/mithril · Revision 3f5bf55
  4. docs/engine-design.md GitHub · nmatt0/mithril · Revision 3f5bf55
  5. docs/boot-security.md GitHub · nmatt0/mithril · Revision 3f5bf55
  6. docs/key-weakness.md GitHub · nmatt0/mithril · Revision 3f5bf55
  7. docs/cve-join.md GitHub · nmatt0/mithril · Revision 3f5bf55
  8. src/cveupdate.cpp GitHub · nmatt0/mithril · Revision 3f5bf55
  9. tests/test_der_keys.py GitHub · nmatt0/mithril · Revision 3f5bf55
  10. LICENSE GitHub · nmatt0/mithril · Revision 3f5bf55
  11. https://github.com/nmatt0/mithril/releases/tag/v0.4.0

More in Firmware and hardware

All 65 entries in Firmware and hardware