Cerbero Suite 9 Release

We are excited to announce the release of Cerbero Suite 9! All our customers with a valid license can now upgrade directly within the application. What follows are the most relevant new features.

Cerbero Shell

One of the main new features of this release is Cerbero Shell, a small command language designed for binary analysis. It powers the new shell view, is available in the analysis workspace as well as in other workspaces, can be run from the terminal with the cshell tool, and can be embedded by plugins through the Pro.Shell module.

At its simplest, the shell is a calculator that speaks the language of reverse engineering: integers are always displayed in both decimal and hexadecimal, while bitwise operations, bytes, and encodings are first-class citizens.

> 0x401000 + 0x1a2b0
4305584 (0x41b2b0)
> (1 << 20) - 1
1048575 (0xfffff)
> b64dec("TVqQ")
b"MZ\x90"

When a file is being analyzed, the shell exposes function domains for inspecting it: PE, .NET, ELF and Mach-O structures, strings, disassembly, and much more. Results are values, so they can be filtered with ‘grep’ and chained with the pipe operator. For instance, to check whether an executable imports GetProcAddress:

> pe.imports -> grep "getproc"
[0]:
  dll: "KERNEL32.dll"
  functions:
    [0]:
      name: "GetProcAddress"

The same style works everywhere: strings.filter rx.email rx:true keeps only strings that look like email addresses, dotnet.disasm(token) -> print prints the disassembly of a .NET method, and appending ? to any function name shows its documentation.

The language is intentionally not Python: it never executes arbitrary code, every function is read-only, and mutating operations require explicit consent. This makes the shell safe to expose even to automated agents. Plugins can extend it with their own functions.

The complete guide to the language is available in our SDK documentation.

Currently, only built-in file formats are exposed to Cerbero Shell. We’re in the process of exposing all applicable optional packages as well.

Filter Line Options

All filter lines now have options available, such as case sensitivity, whole-word matching, and regular expressions. Additionally, we provide a set of common regular expression search patterns for convenience.

In this CTF memory challenge, we filtered by email, which gave us one of the flags.

File Search

File system views now support file search.

This is convenient when you need to search for specific file names within a file system.

System Settings

We have improved the system settings, and it is now possible to register context menu associations on Linux and macOS as well.

Additionally, plugins can register their own file associations.

Proxy Settings

We have introduced proxy settings for organizations that need to route their network traffic through a proxy.

Miscellaneous

* Scan performance has been improved, especially for file types such as Portable Executable that use file ranges to detect foreign data.
* XML parsing has been greatly improved to handle malformed samples even better.
* The SDK has been expanded considerably.
* Packing filters have been added.
* Many bug fixes and improvements.

CPIO Format Package

We are happy to announce support for the CPIO archive format. The new CPIO Format package lets you inspect and extract CPIO archives directly within the application, including all four header variants and truncated archives recovered from disk images.

CPIO is a stream-based Unix archive format that has been in continuous use since 1977. While the tar format gets more attention, CPIO is the on-disk format used by Linux initramfs images, RPM packages, and Solaris/AIX backup tools, and it remains a frequent finding in firmware dumps and forensic investigations. Having native support in Cerbero Suite means analysts can inspect any of these without falling back on the system cpio tool, which is awkward to script against and refuses to operate on incomplete archives.

FDT Format Package

We are happy to announce support for the Flattened Device Tree (FDT / DTB) format. The new FDT Format package lets you parse and explore device tree blobs directly within the application, with an interactive tree navigator and per-node binary view.

FDT is the binary format that bootloaders hand to the Linux kernel (and other operating systems) to describe non-discoverable hardware on ARM, ARM64, RISC-V, PowerPC and similar platforms. A DTB encodes the entire hardware topology of a board: CPUs and their cache hierarchy, physical memory regions, on-chip peripherals like UARTs, I²C and SPI controllers, GPIO banks, USB hosts, MMC/SD, Ethernet MACs and GPUs, interrupt routing, clock and power domains, kernel boot arguments and reserved memory regions. The same blob is used as device tree overlays (.dtbo) to patch a base tree at boot for HATs, capes and optional peripherals. DTBs are routinely pulled from boot partitions, firmware images and recovery dumps during security research, IoT analysis and forensic investigations. Having native FDT support in Cerbero Suite means analysts can read out a device’s hardware description — the same information the OS uses to bring the system up — without leaving the analysis environment.

LittleFS Format Package

We are happy to announce support for LittleFS file system images. The new LittleFS Format package lets you browse and extract files from LittleFS images directly within the application.

LittleFS is a block-based file system designed for microcontrollers, with a focus on power-loss resilience and wear leveling. It is widely used in embedded devices built on platforms such as ESP32, STM32, nRF52, RP2040, and Mbed OS. LittleFS stores metadata in redundant block pairs and organizes file data using either inline storage or a CTZ skip-list structure that provides efficient random access. Having native support in Cerbero Suite means analysts can inspect firmware dumps and flash images from IoT devices, sensor nodes, and consumer electronics without needing external tools.

VDEX Format Package

We are happy to announce support for the Android ART VDEX format. The new VDEX Format package lets you inspect VDEX containers and extract their embedded DEX files directly within the application.

VDEX is the Verified DEX container format produced by the Android ART dex2oat compiler. It ships alongside OAT files in /system/framework/ or /data/dalvik-cache/ and stores the DEX bytecode together with verification metadata that ART uses to skip class verification at class-load time. The format has evolved significantly across Android releases. Having native VDEX support in Cerbero Suite is useful when analyzing Android firmware images, dalvik caches recovered during forensic acquisitions, or APK companion artifacts encountered during malware reverse engineering.

SPIFFS Format Package

We are happy to announce support for the SPIFFS (SPI Flash File System) format. The new SPIFFS Format package lets you browse and extract files from SPIFFS images directly within the application.

SPIFFS is a flat file system designed for SPI NOR flash memory, widely used in ESP8266, ESP32, and other embedded microcontrollers. It provides wear leveling and power-loss resilience with minimal RAM overhead, making it the go-to file system for storing configuration files, web assets, and sensor data on IoT devices. SPIFFS uses a page-based layout with per-block object lookup tables and 16-bit object IDs. Unlike traditional file systems, it has no directory support — files are stored with flat paths (e.g. /config.json). Having native support in Cerbero Suite means analysts can inspect ESP32 firmware dumps, IoT flash images, and embedded device storage encountered during security research, vulnerability assessment, or forensic investigations without needing external tools or knowing the flash geometry parameters.

WASM Format & Decompiler Packages

We are happy to announce two new packages, released together: the WASM Format package and the WASM Decompiler package. Together they bring native WebAssembly analysis to Cerbero Suite: parsing, disassembly, decompilation, data cross-references, and unified navigation between all of them.

Continue reading “WASM Format & Decompiler Packages”

F2FS Format Package

We are happy to announce support for the F2FS (Flash-Friendly File System) format. The new F2FS Format package lets you browse and extract files from F2FS images directly within the application.

F2FS is a log-structured file system designed by Samsung for NAND flash storage, merged into the Linux kernel in version 3.8. It is the default user-data file system on many Android devices and is also used on Chrome OS, Tizen, and other flash-based storage systems. F2FS employs a Node Address Table (NAT) for efficient inode resolution, multi-level hash-based directories, and supports inline data for small files, extended attributes, and transparent compression (LZO, LZ4, ZSTD). Having native support in Cerbero Suite means analysts can inspect Android user-data partitions, IoT firmware, and flash storage images encountered during security research, vulnerability assessment, or forensic investigations without needing external tools.

DotNETBinaryFormatter Format Package

We are happy to announce support for the .NET BinaryFormatter serialization format. The new DotNET BinaryFormatter Format package replaces the old decoder with a full parser, providing reliable parsing and embedded object detection for malware analysis and forensic investigations.

BinaryFormatter (System.Runtime.Serialization.Formatters.Binary.BinaryFormatter) is a .NET binary serialization mechanism that has been widely used since the early days of .NET. It is also notoriously insecure: deserialization of untrusted data can lead to arbitrary code execution, which has made it a favored vector for .NET exploitation payloads. Malware authors frequently embed executables, shellcode, and configuration data inside BinaryFormatter byte arrays. Having native support in Cerbero Suite means analysts can safely inspect these payloads, navigate the serialized object graph, and extract embedded objects without risking code execution.