// Tool

Sentinel: a firmware scanner that will not guess

Open source github.com/DilipMallavarapu/sentinel-firmware Go and Python

Sentinel is a static analysis tool for extracted firmware. It walks a root filesystem and reports things like exploit mitigation posture, hardcoded keys and certificates, shipped SSH backdoors, and the services a device exposes. That part is not new. Tools like EMBA and FACT already do a lot of it, and they cover more formats than I do.

What is different is the rule Sentinel holds itself to: it does not state a finding it cannot back with evidence, and it does not report something as absent when it only failed to look.

The problem it is built around

Most firmware scanners are tuned for recall. They surface everything that might matter and leave you to sort the real issues from the noise. That is fine until you need to hand a finding to a vendor who will push back, or until the scanner quietly reports something false and you repeat it.

Two ideas keep Sentinel honest:

Presence is separate from reachability. Saying a binary has no stack canary is a statement about the file on disk. Saying it is exploitable is a much bigger claim. Sentinel keeps those apart and never lets the first quietly become the second.
Every confirmed finding carries a proof. When Sentinel marks a finding as confirmed, it stores the exact bytes the claim was derived from, plus a check that re-runs offline with no network and no target attached. If the proof does not re-verify, the finding does not get to be confirmed.

Present, absent, or unknown

The part I care about most is the third state. A scanner that reads a mitigation from an ELF symbol table has to admit when the symbol table is not readable. If it prints absent in that case, it is guessing, and the guess is wrong often enough to matter.

Sentinel reports present, absent, or unknown, and every image-wide number is stated over the population it was actually measured on. If it could not read the symbols for 40 of 100 binaries, it says coverage was measured on 60, not that 40 are unprotected.

This is not theory. An earlier version of Sentinel read stack canary data through ELF section headers. OpenWrt strips those headers to save space, so the tool reported zero canaries across every binary, when the truth was the opposite. The fix was to read the dynamic symbol table straight from the program headers, and to make the result three-valued so an unreadable table reads as unknown, not as a false zero. The tool now measures it correctly and says so with a denominator.

Where it fits

Sentinel is not trying to replace the large firmware frameworks on breadth of detection. It is useful in a narrower spot: when you need a finding that is defensible, reproducible, and honest about its own limits. For disclosure work, an evidence package a vendor or a CNA can re-check byte for byte is worth more than a longer list of maybes.

It is written as a fast Go worker for the binary scanning, with the analysis and the evidence model in Python. The code and the checks are on GitHub.