Upload the image. Get the components.
Standard SBOM tools want a repository and a package manifest. You have a squashfs image from an ODM who will not give you source. We read the image.
What goes in
Raw .bin, Intel HEX, Motorola S-record, .elf, and container and filesystem formats including squashfs, UBI, JFFS2, cramfs, tar, cpio, zip, gzip, xz, LZMA, LZ4, zstd and U-Boot images. Nested combinations are normal and get unpacked recursively. Vendor-mangled squashfs variants that mainline unsquashfs refuses are handled with a patched extractor.
What comes out
A component list. RTOS kernels, TCP/IP stacks, crypto and TLS libraries, BusyBox and the rest of the userland, bootloaders, and vendor SDKs, with versions where the image gives them up.
Every row carries a confidence level and the evidence that produced it: the file it came from, the byte offset, and the exact string we matched.
We never guess a version. If the image says only "OpenSSL" with no version, you get "OpenSSL, version unknown" at low confidence. A number you cannot point to in the binary is worse than no number, because it puts every other row under suspicion.
What it cannot do
Statically linked code often loses its banner entirely, so a library compiled into a monolithic binary can be invisible. Stripped binaries lose symbol names. Encrypted or signed-and-packed images cannot be unpacked without keys. We report what we found and how confident we are; we do not fill the gaps with inference.
This is why the build-time path exists alongside it. Where you compile from source, the manifest is ground truth. Merged, the two cover more than either alone, and the merge records which side saw what.
What it costs
Included at Team, €399 a month, twenty deep scans a month. Not quoted, not gated behind a demo. Everyone else who does this either prices it at enterprise level or will not tell you the price at all.