Introduction
Firmware reverse-engineering toolchain that rebuilds stripped binaries to source, verifies them, and reflashes the device
Neptune
Neptune is a firmware toolchain for hardware you own. It pulls a stripped binary off the device, identifies its components, rebuilds it to source you can read, patches the vulnerable paths, checks the result against the original, and reflashes the same board.
Fielded devices run firmware their owners often cannot rebuild: the source is stale, missing, or locked inside a vendor blob. When a CVE lands on hardware in the field, the operator who owns the device is stuck waiting on a supplier who may not answer. Neptune gives that operator a way to look inside the binary, fix it, and ship the fix, and it emits an SBOM plus verification evidence on every run as a by-product.
How it works
Neptune combines multiple identification techniques with confidence-weighted scoring:
- Multi-format extraction — Parse ELF, PE, and Mach-O binaries with entropy analysis and section mapping
- Multi-architecture disassembly — Capstone-backed disassembly for x86, x86_64, ARM, AArch64, MIPS, RISC-V, and PowerPC
- Layered identification — Strings, constants, compiler ID, signature fingerprinting, cross-correlation, and AI analysis each contribute scored evidence
- SBOM generation — CycloneDX 1.6, SPDX 2.3, VEX, HTML reports, and JSON output
- Vulnerability correlation — Cross-reference identified components against NVD (via CPE) and OSV (via PURL)
Key features
Full Pipeline Analysis
Seven-stage pipeline: extraction, disassembly, scanning, fingerprinting, AI analysis, SBOM generation, and vulnerability correlation.
AI Decompilation
Claude-powered decompilation of binary functions back to readable C/C++ source code.
Binary Rebuild
Decompile an entire binary into a buildable C project with iterative refinement until the rebuild matches the original.
Cross-Platform Porting
Port verified rebuilt source to a different target triple using AI-assisted platform adaptation.
Devirtualization
Symbolic lifting to devirtualize obfuscated x86/x64 PE binaries with automatic obfuscation detection.
Malware Triage
YARA scanning, capa detection, signal ranking, behavior hypothesis generation, and structured case output.
Firmware Diff
Compare two firmware binaries or SBOMs to see added, removed, and changed components.
Signature Database
Bundled signatures across libraries and architectures, extracted from real compiled binaries.
Web Dashboard
Next.js frontend with GitHub OAuth, job management, real-time SSE progress, and signature browsing.
Remote Sandboxes
Offload builds, refinement, and analysis to AgentComputer cloud VMs with full lifecycle management.
REST API
Axum server with role-based auth, TLS, rate limiting, S3 storage, and OpenAPI docs.
Supported formats
| Category | Supported |
|---|---|
| Binary formats | ELF, PE, Mach-O |
| Architectures | x86, x86_64, ARM, AArch64, MIPS, RISC-V, PowerPC |
| SBOM formats | CycloneDX 1.6, SPDX 2.3, VEX, SARIF, HTML, JSON |
| Firmware containers | SquashFS, JFFS2, CramFS, CPIO, UBI, Android Boot |
| Vuln databases | NVD (CPE), OSV (PURL) |