# mithril

> Offline C++ scanner for the contents of firmware and IoT software, pointed at a single file or an already unpacked root filesystem, that reports embedded secrets, a software bill of materials, known CVEs, open-source licenses, boot-security configuration and weak or publicly known keys, each finding with its evidence and a confidence level. Its SBOM also recovers components from ELF version banners, libc filenames and the kernel banner in stripped images and is written as CycloneDX and SPDX, while the CVE pass joins it against a local OSV and NVD mirror annotated with CISA KEV and EPSS. It does not unpack images; the author's companion tool moria handles identification and extraction.

- Type: Tool
- Targets: Firmware
- Category: Firmware tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-03
- Original resource: <https://github.com/nmatt0/mithril>
- Primary source: <https://github.com/nmatt0/mithril/blob/3f5bf55f9481b6447f4a8fb410862baff55b07f8/README.md>
- Catalog page: <https://awesomerea.org/resources/mithril-iot-scanner/>
- Record JSON: <https://awesomerea.org/resources/mithril-iot-scanner/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/mithril-iot-scanner/index.md)

## Requirements & limits

- A young, fast-moving project: the repository was created on 2026-09-07, and v0.4.0, published 2026-10-22, is the latest release at review, with Linux x86_64 and arm64 and macOS arm64 archives plus Debian packages for amd64 and arm64; the reviewed commit is the merge of that release.
- Source builds need CMake 3.20+ and a C++20 compiler and link no third-party libraries; flake.nix, package.nix and Debian packaging are included. Input is a firmware file or a directory already extracted by moria or another unpacker; the --boot pass also reads a raw AMI or EDK2 BIOS image to report UEFI Secure Boot posture.
- Scans make no network calls. The CVE pass needs a local mirror in .local/share/mithril under the home directory (or $MITHRIL_DB), downloaded once with --fetch-db from the project's weekly rebuilt db-latest release and checked against published SHA-256 sums (needs curl), or rebuilt from OSV.dev, NVD, CISA KEV, EPSS and the optional kernel.org feed with --update-db. README notes that the kernel checklist is curated rather than exhaustive, so an empty kernel result does not mean the kernel is clean, and that secret findings are well-formed matches, never confirmed live credentials.
- The compiled-in key corpora are built from public keys and certificates vendored under data/: the public halves of rapid7 ssh-badkeys, the Vagrant insecure public key, eMudhra intermediate CA certificates, AOSP test-key public halves and the PKfail AMI test Platform Key certificate. THIRD_PARTY.md states that no private-key material is stored, and the key tests generate their keys with openssl at run time.
- MIT; the vendored key data keeps its upstream MIT or Apache-2.0 terms, and the mirrored vulnerability feeds belong to their sources.

## Primary sources

1. <https://github.com/nmatt0/mithril/blob/3f5bf55f9481b6447f4a8fb410862baff55b07f8/README.md>
2. <https://github.com/nmatt0/mithril/blob/3f5bf55f9481b6447f4a8fb410862baff55b07f8/CMakeLists.txt>
3. <https://github.com/nmatt0/mithril/blob/3f5bf55f9481b6447f4a8fb410862baff55b07f8/THIRD_PARTY.md>
4. <https://github.com/nmatt0/mithril/blob/3f5bf55f9481b6447f4a8fb410862baff55b07f8/docs/engine-design.md>
5. <https://github.com/nmatt0/mithril/blob/3f5bf55f9481b6447f4a8fb410862baff55b07f8/docs/boot-security.md>
6. <https://github.com/nmatt0/mithril/blob/3f5bf55f9481b6447f4a8fb410862baff55b07f8/docs/key-weakness.md>
7. <https://github.com/nmatt0/mithril/blob/3f5bf55f9481b6447f4a8fb410862baff55b07f8/docs/cve-join.md>
8. <https://github.com/nmatt0/mithril/blob/3f5bf55f9481b6447f4a8fb410862baff55b07f8/src/cveupdate.cpp>
9. <https://github.com/nmatt0/mithril/blob/3f5bf55f9481b6447f4a8fb410862baff55b07f8/tests/test_der_keys.py>
10. <https://github.com/nmatt0/mithril/blob/3f5bf55f9481b6447f4a8fb410862baff55b07f8/LICENSE>
11. <https://github.com/nmatt0/mithril/releases/tag/v0.4.0>

## More in Firmware and hardware

- [img4tool](https://awesomerea.org/resources/img4tool/index.md) · Tool
- [payload dumper](https://awesomerea.org/resources/payload-dumper/index.md) · Tool
- [PMCA-RE RELOADED](https://awesomerea.org/resources/pmca-re-reloaded/index.md) · Tool
- [ThisFirmwareDoesNotExist](https://awesomerea.org/resources/thisfirmwaredoesnotexist/index.md) · Tool
- [intel_ma](https://awesomerea.org/resources/intel-ma/index.md) · Tool
- [qemu-rtd2841](https://awesomerea.org/resources/qemu-rtd2841/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.