AwesomeREA.org

Tool

IFDA (IoT Firmware Deep Analysis)

Static analysis pipeline for extracted IoT firmware: pointed at one ELF or an unpacked root filesystem, it disassembles binaries with Capstone for x86, ARM/Thumb-2, AArch64 and MIPS, recovers functions, call graphs and exploit mitigations, and reports candidate issues from dangerous-function calls, call-graph taint paths, CVE correlation through cve-bin-tool, embedded secrets, script injection patterns and filesystem hardening checks. Reports come out as JSON, Markdown and a CycloneDX SBOM. Optional add-ons are Ghidra headless pseudocode, moria-based extraction of raw images and a Go service with a job queue, REST API, bilingual web UI and an LLM agent that triages a finished scan's findings.

Targets
Binary · Firmware
Category
Firmware tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • The reviewed main commit 90c11c2 of 2026-09-21 is the 29th since the project began on 2026-06-10. CHANGELOG calls it v4.4, while the latest tag is V4.1, five commits earlier, there are no GitHub releases and pyproject.toml still declares 2.0.0. README describes a first iteration covering binary reverse engineering and vulnerability discovery; emulated or dynamic validation is listed as planned, not built.
  • The Python 3.10+ core needs capstone, pyelftools, cryptography, Pillow and cve-bin-tool, which README calls required: it keeps a local CVE database of 1 GB or more and needs network access on first use, and without it correlation falls back to a small curated database with a warning. Optional parts are yara-python, Ghidra headless with JDK 17+ for pseudocode, CuPy for GPU chart rendering, the Go 1.22+ service for the REST API and web UI, and the moria submodule, built with CMake and a C++20 compiler, for unpacking raw images. Linux and macOS are supported; Windows only through WSL2.
  • Input is a single ELF, an extracted firmware tree or, through the service's extract job, a raw image whose filesystem region the analyst chooses. README and the requirements document limit use to firmware the operator owns or is authorized to assess. The repository contains no firmware; its tests build cross-compiled x86_64, MIPS, ARM and AArch64 samples, and README reports 25 passed and 2 skipped with cross-compilers and Ghidra installed.
  • README calls decompilation-free static analysis heuristic: findings carry confidence scores, and taint results are candidate paths for analyst validation, not proven exploits. The optional AI analysis sends a finished scan to an OpenAI-compatible or Anthropic-protocol endpoint the user configures, storing API keys encrypted; the model pulls finding evidence, pseudocode, init scripts and service data through tools. README says these features were tested with Claude models.
  • Apache-2.0, added on 2026-09-17; cve-bin-tool (GPL-3.0) is only invoked as a subprocess, and moria is MIT. No REA connection is stated, and nothing was run in this review.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · cn0xroot/IFDA · Revision 90c11c2
  2. CHANGELOG.md GitHub · cn0xroot/IFDA · Revision 90c11c2
  3. firmware-analysis-requirements.md GitHub · cn0xroot/IFDA · Revision 90c11c2
  4. ENVIRONMENT.md GitHub · cn0xroot/IFDA · Revision 90c11c2
  5. service/README.md GitHub · cn0xroot/IFDA · Revision 90c11c2
  6. pyproject.toml GitHub · cn0xroot/IFDA · Revision 90c11c2
  7. .gitmodules GitHub · cn0xroot/IFDA · Revision 90c11c2
  8. LICENSE GitHub · cn0xroot/IFDA · Revision 90c11c2

More in Firmware and hardware

All 65 entries in Firmware and hardware