AwesomeREA.org

Tool

Pyrrha

Quarkslab's firmware cartography tool, which indexes an extracted firmware filesystem into a database browsed with NumbatUI, Quarkslab's fork of the Sourcetrail code explorer. The fs mapper uses LIEF to map ELF and PE files, their imports and exports and the symlinks that point to them; fs-cg disassembles every executable with IDA Pro or Ghidra and links their call graphs across binaries, and decomp indexes one executable's decompiled functions with call cross-references. JSON exports can be post-processed in Python, for example to diff two firmware versions.

Requirements & limits

  • Latest release at review: v2.0.3, published to GitHub and PyPI as pyrrha-mapper on 2026-09-21; the reviewed main commit sets the same version. v2.0.0 (2026-07-07) added the Ghidra backend and removed the earlier Quokka dependency. pyproject.toml marks the package Beta and lists Linux and Windows.
  • Input is a firmware root filesystem that the user has already extracted or mounted, or a single executable for decomp; Pyrrha does not unpack firmware images. The fs quick start uses an OpenWrt x86-64 rootfs downloaded from the OpenWrt project.
  • pyproject.toml requires Python 3.11+, although the installation page says 3.10. fs needs no disassembler, but fs-cg and decomp need a local IDA Pro 9.1+ or Ghidra 12.0+, found on PATH or through IDADIR or GHIDRA_INSTALL_DIR; a Ghidra-based Docker image is published on GitHub's registry, and the IDA CI image is built from the user's own Hex-Rays installer and licence. Results are viewed in NumbatUI or, without newer features such as node renaming, Sourcetrail 2021.4.19.
  • The GitLab CI file runs pytest unit tests and CLI runs of each mapper, with IDA and Ghidra images for fs-cg and decomp; the GitHub workflows only build documentation and publish releases. tests/test_fw is a small 32-bit ARM Linux fixture holding an OpenSSL 1.1.1n executable built with Buildroot and glibc libraries.
  • Apache-2.0; NumbatUI is a separate GPL-3.0 project, and IDA Pro is commercial software. The README lists SSTIC, Hack.lu, Pass The SALT and RE//verse talks by the authors. The reviewed sources state no REA use, and this collection mapped no firmware.

About this entry

Type
Tool
Category
Firmware tools
Relationship
Foundation tool
Targets
Binary · Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · quarkslab/pyrrha · Revision 54cfe78
  2. docs/installation.md GitHub · quarkslab/pyrrha · Revision 54cfe78
  3. docs/index.md GitHub · quarkslab/pyrrha · Revision 54cfe78
  4. docs/mappers/index.md GitHub · quarkslab/pyrrha · Revision 54cfe78
  5. docs/mappers/fs.md GitHub · quarkslab/pyrrha · Revision 54cfe78
  6. docs/mappers/fs-cg.md GitHub · quarkslab/pyrrha · Revision 54cfe78
  7. docs/mappers/exe-decomp.md GitHub · quarkslab/pyrrha · Revision 54cfe78
  8. docs/.snippets/diffing_pyrrha_exports.py GitHub · quarkslab/pyrrha · Revision 54cfe78
  9. pyproject.toml GitHub · quarkslab/pyrrha · Revision 54cfe78
  10. CHANGELOG.md GitHub · quarkslab/pyrrha · Revision 54cfe78
  11. .gitlab-ci.yml GitHub · quarkslab/pyrrha · Revision 54cfe78
  12. ci/ida/Dockerfile GitHub · quarkslab/pyrrha · Revision 54cfe78
  13. tests/test_fw GitHub · quarkslab/pyrrha · Revision 54cfe78
  14. LICENSE GitHub · quarkslab/pyrrha · Revision 54cfe78
  15. https://github.com/quarkslab/pyrrha/releases/tag/v2.0.3
  16. https://pypi.org/project/pyrrha-mapper/2.0.3/

More in Firmware and hardware

All 44 entries in Firmware and hardware