AwesomeREA.org

Tool

FwAnalyzer

Rule-based checker for filesystem images taken from firmware: it reads ext2/3/4, FAT/VFAT, SquashFS and UBIFS images, cpio archives or a directory, and writes a JSON report of every file that breaks the rules in a TOML configuration. Rules cover SUID and world-writable files, allowed owners, SELinux labels and Linux capabilities, per-file metadata, content regexes, SHA-256 digests, JSON fields and external scripts such as the bundled checksec wrapper; it can also extract values such as version strings and compare the file tree or selected files with a previous run. Cruise describes it as part of a firmware security check suite, and check.py with an Android OTA unpacker runs it over each image in a firmware package.

Requirements & limits

  • Latest release at review: 1.4.4, published 2022-10-24 without an attached binary; releases 1.4.1 to 1.4.3 attach a prebuilt Linux fwanalyzer. The reviewed master commit, from 2023-10-08, only fixes typos after that release and is the latest commit; the repository is not archived, and the Makefile still sets VERSION=1.4.1.
  • Built from source with Go (go.mod declares Go 1.13; the Makefile defaults GOOS to linux) through make deps and make, giving build/fwanalyzer. Each filesystem backend calls external programs: e2ls and e2cp from e2tools for ext images, mdir and mcopy from mtools for FAT, unsquashfs, ubireader_list_files from ubi_reader, and cpio. SELinux and capability data need the author's patched e2tools and squashfs-tools forks, and ext symlink handling needs e2tools' link_support branch; the Dockerfile lists the full dependency set on a golang:1.13 image.
  • Input is a filesystem image or unpacked directory the user already has; FwAnalyzer itself does not unpack firmware packages. check.py needs an unpacker script that maps configurations to images, and the bundled Android OTA unpacker relies on the separate extract_android_ota_payload and mkbootimg_tools projects. Findings depend entirely on the user's configuration: the devices folder supplies sample Android user-build, Android property and generic Linux root-filesystem rules, and the report lists rule offenders rather than assessed vulnerabilities.
  • make test runs Go unit tests, and the integration target runs test/test.py, written for Python 2, against bundled fixtures in test/: small ext2, SquashFS, UBIFS, VFAT and cpio images, hello-world ELF builds for ARM32, ARM64 and x86-64, and prebuilt e2cp and unsquashfs helper executables; make testsetup uses sudo setcap. CircleCI builds and tests inside the Docker image, while the GitHub workflow only lints with golangci-lint v1.29.
  • Apache-2.0, copyright Cruise LLC; the external filesystem tools keep their own licenses. The reviewed sources state no REA use, and this collection did not build or run the tool or analyze any image.

About this entry

Type
Tool
Category
Firmware tools
Relationship
Foundation tool
Targets
Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. Readme.md GitHub · cruise-automation/fwanalyzer · Revision a0db450
  2. Building.md GitHub · cruise-automation/fwanalyzer · Revision a0db450
  3. Changelog.md GitHub · cruise-automation/fwanalyzer · Revision a0db450
  4. Checksec.md GitHub · cruise-automation/fwanalyzer · Revision a0db450
  5. Dockerfile GitHub · cruise-automation/fwanalyzer · Revision a0db450
  6. Makefile GitHub · cruise-automation/fwanalyzer · Revision a0db450
  7. go.mod GitHub · cruise-automation/fwanalyzer · Revision a0db450
  8. devices/Readme.md GitHub · cruise-automation/fwanalyzer · Revision a0db450
  9. devices/android/Readme.md GitHub · cruise-automation/fwanalyzer · Revision a0db450
  10. pkg/extparser/extparser.go#L40-L43 GitHub · cruise-automation/fwanalyzer · Revision a0db450
  11. test GitHub · cruise-automation/fwanalyzer · Revision a0db450
  12. .circleci/config.yml GitHub · cruise-automation/fwanalyzer · Revision a0db450
  13. LICENSE GitHub · cruise-automation/fwanalyzer · Revision a0db450
  14. https://github.com/cruise-automation/fwanalyzer/releases/tag/1.4.4

More in Firmware and hardware

All 42 entries in Firmware and hardware