EEmberBOM
Menu

Offline firmware component inventory

Know what actually shipped in your firmware.

EmberBOM reads real compiler and linker evidence from supported STM32 builds, identifies included third-party components, and exports a reviewable CycloneDX 1.6 SBOM.

Check compatibility and download Inspect real sample output

No card. Windows x64 and Linux x64. Evaluation use is governed by the license notice.

Runs locallyNo telemetryNo source uploadCycloneDX 1.6

Built for review, not theatre

A result your firmware team can trace.

Reads build participation

Uses compile_commands.json and the GNU linker map instead of assuming every library in the source tree reached the firmware.

Preserves uncertainty

Separates confirmed components, items needing review, unknown linked inputs, and source-tree candidates that were not built.

Exports practical evidence

Produces scan JSON, a CycloneDX 1.6 SBOM, a single-file HTML report, and an optional review YAML overlay.

Real fixture output

Inspect the result before installing the tool.

These files were generated by EmberBOM v0.1.0-rc.9 from the STM32 fixture used in release acceptance. They are not hand-written mockups and contain no customer project data.

Top of an EmberBOM RC9 report showing one confirmed component, one component needing review, one unknown linked input, four unmatched build inputs, and two candidates not in the build
HTML reportReadable, single-file review output Scan JSONStructured evidence and classifications CycloneDX 1.6Machine-readable SBOM export Sample checksumsVerify the three files byte-for-byte

Why build evidence changes the answer

QuestionSource-tree inventoryEmberBOM in its supported scope
Was it present?Can list files found in the treeAlso records candidates that were not built
Was it linked?May require separate build analysisReads compile commands and the GNU linker map
What if identity is uncertain?Depends on the generatorKeeps unknown and review-required findings explicit

Initial supported scope

Check all six items before downloading.

  • Target platform: STM32
  • Build system: CMake
  • Compiler: GNU Arm Embedded Toolchain
  • compile_commands.json is available
  • A GNU linker map is available
  • Windows x64 or Linux x64

Current evaluation release

v0.1.0-rc.9 · published 18 July 2026

Use the free evaluation only after every compatibility item above is true. The release was built for Windows x64 and Linux x64, checked in CI, and accepted against the release fixture.

Windows x64

Download ZIP c6a5be2d63a02cbbfd483862db8946c7b91a88d123aad364f7d716a1bb4cab49

Linux x64

Download tar.gz 0c9e324eb098865649edbdfd2644170cb4c25ebd234b4b1394a9d841b5ba9c50
Accepted release checksums Installation and quick start Evaluation and commercial license

A checksum confirms the downloaded bytes; it does not expand EmberBOM's supported scope. The evaluation lasts fourteen consecutive days from first use.

Ten-minute path

Build normally. Scan locally. Review the evidence.

  1. 01

    Prepare the normal build

    Generate compile commands and a GNU linker map from the project you are authorized to scan.

  2. 02

    Run EmberBOM locally

    Point the CLI at the project, build directory, linker map, firmware, and a separate output directory.

  3. 03

    Review before relying

    Read confirmed, review-required, unknown, and excluded findings before sharing the exported SBOM.

Founding price

One clear license. No subscription.

The purchase is a self-service software license, not consulting or project analysis.

Founding Team License

$99 USD · one-time

One-time purchase. Taxes may apply.

  • One legal organization
  • Up to five internal users
  • Eligible versions released during the first 12 months remain usable afterward
  • No automatic renewal
  • 14-day compatibility refund after purchase
  • No consulting, custom project configuration, or SLA
Ask about the founding license

Live Paddle checkout is disabled. The free evaluation download remains available, and no payment is accepted by email.

Important answers

Before you rely on a report.

Is EmberBOM a vulnerability scanner?

No. It inventories component evidence and exports an SBOM. It does not provide vulnerability data or claim that firmware is secure.

Does EmberBOM upload my project?

No. The CLI runs locally, has no automatic telemetry, and writes outputs only to the directory you specify.

Does a paid license include support?

It includes documentation and access to generally released corrections during the update period. It does not include project inspection, custom configuration, consulting, or a response-time commitment.

Can I share the generated SBOM?

Yes. Your organization may use and share the reports and SBOMs it generates, subject to rights and restrictions that apply to its own project and third-party content.