Bilkent University · CS491/492 Senior Design Project
What is really inside your firmware?
Sourceline identifies the open-source libraries and their exact versions inside stripped firmware binaries, recovers a Software Bill of Materials, and maps it to known vulnerabilities.
About the project
Embedded devices such as routers and IoT products ship firmware built from dozens of open-source libraries, but vendors rarely say which components and versions are inside. When a new vulnerability is published, device owners and security teams have no reliable way to know whether they are affected.
The problem
Firmware binaries are stripped and cross-compiled, so their library names and version strings are missing or unreliable. Without that information, nobody can say which CVEs apply to a device.
Our approach
We match function-level fingerprints from the firmware against a reference corpus of open-source libraries. We build the corpus by cross-compiling many versions with different compilers, optimization levels and architectures.
What sets it apart
Commercial tools in this space publish no accuracy figures. Sourceline will be evaluated on an open, reproducible benchmark, so anyone can measure and check its results.
How it works
From a firmware image to a vulnerability report in five stages.
Extract
Unpack the firmware image and collect its ELF executables and libraries.
Analyze
Disassemble each binary and recover function boundaries without symbols.
Fingerprint
Turn each function into a normalized fingerprint that holds up across architectures, compilers and optimization levels.
Match
Search the reference corpus to identify each library and its version.
Report
Build the SBOM, map components to CVEs, and present the results in the web app.
Team
Five students in Computer Engineering at Bilkent University.
Reports & deliverables
Course reports and project documents will be published here as they are completed.
| Document | Date | Status |
|---|---|---|
| No documents published yet. | ||