AwesomeREA.org

Tool

FA (Firmware Analysis)

Python framework, mainly used as an IDA plugin, that turns the manual steps of locating symbols, such as finding a string, following its cross-reference and taking the function start, into reusable signatures. Hjson SIG files, grouped into per-platform projects, chain commands that search bytes, strings, immediates or Keystone-assembled opcodes, filter by operands and cross-references, and then set names, types, constants, enums and struct members; Python scripts can drive the same interpreter. In IDA it adds an FA menu and toolbar to find all of a project's symbols, draft a temporary signature from the current function and export symbols plus a C header, and a separate loader runs signatures over a raw ELF file without IDA.

Targets
Binary · Firmware
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: v1.0.11, published 2026-03-25 without attached files; it tags the reviewed master commit, and the same version is on PyPI as fa 1.0.11. The README installs it by cloning the repository and running pip install -e, says the code base is very IDA-oriented and only considers Ghidra, radare2 or other disassemblers for the future.
  • The README supports IDA 8.0+, and a March 2026 commit added IDA 9.0 support to make-offset. The package requires Python 3.8+; its dependencies, including keystone-engine, capstone, hjson and rpyc, are installed into IDA's Python. IDA can also run the plugin in script mode to write a symbols file, while the ELF loader script imports pyelftools, which is listed only in the testing requirements.
  • The binaries, IDA databases and signatures come from the analyst: the repository ships only two small test projects under fa/signatures and no signature sets for real firmware. The README groups signatures into projects partly to lower false positives, and the ELF loader reports symbols with several matches instead of choosing one.
  • CI lints with flake8 and runs pytest on Python 3.8 to 3.12; the tests check find-bytes on mocked memory segments and ELF symbol search on a small ARM ELF built at test time with Keystone and simpleelf, and neither runs IDA. GPL-3.0 license text; pyproject.toml classifies it as GPLv3 or later. Nothing was installed or run.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · doronz88/fa · Revision b584a37
  2. commands.md GitHub · doronz88/fa · Revision b584a37
  3. fa/ida_plugin.py GitHub · doronz88/fa · Revision b584a37
  4. elf_loader.py GitHub · doronz88/fa · Revision b584a37
  5. pyproject.toml GitHub · doronz88/fa · Revision b584a37
  6. requirements.txt GitHub · doronz88/fa · Revision b584a37
  7. requirements_testing.txt GitHub · doronz88/fa · Revision b584a37
  8. fa/signatures GitHub · doronz88/fa · Revision b584a37
  9. tests/conftest.py GitHub · doronz88/fa · Revision b584a37
  10. .github/workflows/python-app.yml GitHub · doronz88/fa · Revision b584a37
  11. LICENSE GitHub · doronz88/fa · Revision b584a37
  12. https://github.com/doronz88/fa/commit/bc88577a0af4e9a91bcfcae4d88bbf9c012fe646
  13. https://github.com/doronz88/fa/releases/tag/v1.0.11
  14. https://pypi.org/project/fa/1.0.11/

More in Native binaries

All 121 entries in Native binaries