Build-Aware Firmware Inventory
Embedded products cannot be represented accurately by package-manager lock files alone. SBOMator combines build metadata, configuration, filesystem, and binary evidence — so the delivered firmware, not the developer workstation, becomes the inventory boundary.
Embedded Linux + RTOS
Firmware-only mode
west.yml plus built modules, and a Kconfig .config filter remove host-only noise.
Yocto / OpenEmbedded / BitBake
Recipe and manifest parsing with package, version, and license extraction.
Yocto false-positive control
Recognizes backported security fixes and typically-disabled embedded features instead of relying only on upstream version numbers.
RTOS recognition
embOS, ThreadX, NetX, FileX, USBX, GUIX, Micrium, SafeRTOS, FreeRTOS, VxWorks, Zephyr and Arm RTX — from headers, archives, and filesystem evidence.
Nordic nRF specialization
CC310, Oberon, CMSIS-DSP, SoftDevices, radio and NFC stacks, plus native archive inventory.
Embedded accelerators
Component mappings and enrichment for NVIDIA CUDA/TensorRT and Hailo software stacks.
Native + Firmware Depth — evidence below the manifest layer
Native and embedded dependencies are often copied, statically linked, cross-compiled, or buried inside firmware images. SBOMator follows those evidence paths.
SOURCE
CMake, includes, known SDK paths, source signatures
VENDORED
Known libraries, review
BINARY
.a, .lib, .so, .ko, .o, symbols, CPE
FIRMWARE
HEX, U-Boot, SquashFS, CPIO, EXT4
Cross-architecture
ARM, AArch64, RISC-V, MIPS, Xtensa, PowerPC and native toolchains.
Recursive unpacking
Vendor headers, partitions, and nested compressed filesystems.
Integrity evidence
Artifact hashing plus local binary fingerprint lookup.
Package-manager bridge
vcpkg enrichment and Conan handling through cdxgen.
User-review boundary
Ambiguous vendored candidates remain review evidence — not invented certainty.
Component reconciliation
Multiple scanners merged with provenance and dependency relationships.
Inventory the Firmware You Actually Ship
Bring build, source, filesystem, and binary evidence together in a defensible SBOM for embedded products.