{ "added_at": "2026-11-02", "additional_evidence_urls": [ "https://github.com/attify/firmware-analysis-toolkit/blob/54dd1a2a4705f2cafc14924497df6791813aab55/INSTALL.md", "https://github.com/attify/firmware-analysis-toolkit/blob/54dd1a2a4705f2cafc14924497df6791813aab55/CHANGELOG.md", "https://github.com/attify/firmware-analysis-toolkit/blob/54dd1a2a4705f2cafc14924497df6791813aab55/docs/epistemics.md", "https://github.com/attify/firmware-analysis-toolkit/blob/54dd1a2a4705f2cafc14924497df6791813aab55/docs/bmc-emulation.md", "https://github.com/attify/firmware-analysis-toolkit/blob/54dd1a2a4705f2cafc14924497df6791813aab55/tests/fixtures/mcu/init-table/Makefile", "https://github.com/attify/firmware-analysis-toolkit/blob/54dd1a2a4705f2cafc14924497df6791813aab55/scripts/fat-init-trampoline-mipsel.S", "https://github.com/attify/firmware-analysis-toolkit/blob/54dd1a2a4705f2cafc14924497df6791813aab55/DEVELOPMENT.md", "https://github.com/attify/firmware-analysis-toolkit/blob/54dd1a2a4705f2cafc14924497df6791813aab55/LICENSE", "https://github.com/attify/firmware-analysis-toolkit/blob/54dd1a2a4705f2cafc14924497df6791813aab55/LICENSING.md", "https://github.com/attify/firmware-analysis-toolkit/blob/54dd1a2a4705f2cafc14924497df6791813aab55/THIRD_PARTY_NOTICES.md", "https://github.com/attify/firmware-analysis-toolkit/releases/tag/v2.0.1" ], "category": "firmware", "description_en": "Attify's firmware security toolkit, rewritten for version 2 as a Rust command-line tool built around per-image projects. It classifies unknown blobs and firmware images, extracts filesystems, inventories startup scripts, credential strings and crypto material, triages ELF binaries with radare2-based decompilation and source-to-sink taint, and inspects bare-metal MCU images, BMC flash, Edge AI model files and Android APKs. Projects can then go through preflight checks and QEMU emulation on native, FirmAE, Firmadyne or EMUX backends.", "description_zh": "Attify 的固件安全研究工具包，第 2 版改写为以单个镜像项目为中心的 Rust 命令行工具。它可识别未知数据块和固件镜像、提取文件系统，梳理启动脚本、凭据字符串和密码学材料，借助基于 radare2 的反编译与源到汇的污点分析初筛 ELF 二进制，还能检查裸机 MCU 镜像、BMC 闪存、边缘 AI 模型文件和 Android APK。之后可对项目做运行前检查，并通过原生、FirmAE、Firmadyne 或 EMUX 后端进行 QEMU 仿真。", "entry_url": "https://awesomerea.org/resources/attify-firmware-analysis-toolkit/", "entry_url_zh": "https://awesomerea.org/zh/resources/attify-firmware-analysis-toolkit/", "evidence_url": "https://github.com/attify/firmware-analysis-toolkit/blob/54dd1a2a4705f2cafc14924497df6791813aab55/README.md", "group": "tools", "id": "attify-firmware-analysis-toolkit", "json_url": "https://awesomerea.org/resources/attify-firmware-analysis-toolkit/record.json", "kind": "tool", "markdown_url": "https://awesomerea.org/resources/attify-firmware-analysis-toolkit/index.md", "markdown_url_zh": "https://awesomerea.org/zh/resources/attify-firmware-analysis-toolkit/index.md", "name": "Firmware Analysis Toolkit (FAT)", "name_zh": "FAT 固件分析工具包", "record_type": "resource", "relationship": "foundation", "requirements": [ "Latest release at review: v2.0.1, published 2026-09-26, with archives for macOS (Apple Silicon and Intel), Linux x86-64 (glibc 2.35+) and ARM64 (glibc 2.39+) and Windows x86-64, plus a separate runtime-data bundle. The reviewed master commit adds unreleased BMC inspection, native JFFS2 recovery, hash-pinned BMC emulation profiles and Redfish session and process debugging. Version 2 is a rewrite; the FAT 1.x setup.sh and fat.py workflow belongs to the older release.", "Source builds need Rust 1.91+ and Python 3; the installer can add system packages and builds pinned binwalk-ng 4.0.0 and Sasquatch. The Windows build covers native analysis commands only, and workflows that need Linux filesystem semantics or Unix tools run under WSL. Optional workflows need radare2 with r2ghidra, Ghidra, Joern, angr, QEMU, GDB, tmux or Docker, and FirmAE, Firmadyne and EMUX backends are configured separately; fat doctor reports what is missing.", "Users supply the firmware images, extracted filesystems, binaries or APKs to analyze. The third-party notices state that the source tree and release bundles contain no firmware images, kernel or U-Boot binaries, proprietary model files or extracted device filesystems. BMC emulation profiles require an exact input SHA-256 for a named OpenBMC or ASUS BMC image, and the README warns that emulation executes untrusted vendor code.", "docs/epistemics.md treats results as bounded observations: startup intent does not prove reachability, Edge AI hits do not show that a model executes, shell taint is deliberately unsound and reports weak candidates, and an emulation validator proves only what it checked in that run. Test fixtures are synthetic, including Cortex-M images built from in-repo C sources with arm-none-eabi-gcc; a prebuilt MIPS PID-1 trampoline ships with its assembly source. DEVELOPMENT.md documents local cargo tests, while the GitHub workflows build and smoke-test release archives.", "FAT 2.0 is source available under FSL-1.1-ALv2, which GitHub reports as NOASSERTION: use, modification and redistribution are permitted except a commercial Competing Use, and each version also becomes available under Apache-2.0 two years after Attify first makes it available. FAT 1.x history stays MIT, the optional QEMU hook plugin source is GPL-2.0-or-later, and third-party dependencies and external assets keep their own terms. Users must be authorized to analyze their targets." ], "requirements_zh": [ "审阅时最新版本为 v2.0.1，发布于 2026-09-26，提供 macOS（Apple Silicon 与 Intel）、Linux x86-64（需 glibc 2.35+）与 ARM64（需 glibc 2.39+）以及 Windows x86-64 压缩包，另有单独的运行时数据包。所审阅的 master 提交加入了尚未发布的 BMC 检查、原生 JFFS2 恢复、以哈希固定的 BMC 仿真配置，以及 Redfish 会话和进程调试。第 2 版是重写版本；FAT 1.x 的 setup.sh 和 fat.py 流程仅适用于旧版。", "从源码构建需要 Rust 1.91+ 和 Python 3；安装脚本可安装系统软件包，并构建固定版本的 binwalk-ng 4.0.0 和 Sasquatch。Windows 版只支持原生分析命令，依赖 Linux 文件系统语义或 Unix 工具的流程需在 WSL 中运行。可选流程需要 radare2 与 r2ghidra、Ghidra、Joern、angr、QEMU、GDB、tmux 或 Docker；FirmAE、Firmadyne 和 EMUX 后端需另行配置，fat doctor 会报告缺少的组件。", "待分析的固件镜像、已提取文件系统、二进制或 APK 由使用者自备。第三方声明称，源码树和发布包均不含固件镜像、内核或 U-Boot 二进制、专有模型文件或已提取的设备文件系统。BMC 仿真配置要求输入与指定 OpenBMC 或 ASUS BMC 镜像的 SHA-256 完全一致；README 提醒，仿真会执行不可信的厂商代码。", "docs/epistemics.md 将结果视为有边界的观察：启动意图不能证明可达性，边缘 AI 命中不能说明模型会实际执行，shell 污点分析有意不追求可靠性、只报告弱候选，仿真验证器也只证明它在该次运行中检查过的内容。测试夹具为合成数据，包括用 arm-none-eabi-gcc 从仓库内 C 源码构建的 Cortex-M 镜像；仓库还附带一个预构建的 MIPS PID-1 跳板程序及其汇编源码。DEVELOPMENT.md 说明了本地运行的 cargo 测试，GitHub 工作流则用于构建发布包并做冒烟测试。", "FAT 2.0 以 FSL-1.1-ALv2 源码可得方式发布，GitHub 将其识别为 NOASSERTION：除商业性的竞争用途外，允许使用、修改和再分发，且每个版本在 Attify 首次提供两年后也可按 Apache-2.0 使用。FAT 1.x 历史仍为 MIT，可选的 QEMU hook 插件源码采用 GPL-2.0-or-later，第三方依赖和外部资源保留各自条款。使用者需获得分析目标的授权。" ], "targets": [ "binary", "firmware" ], "url": "https://github.com/attify/firmware-analysis-toolkit", "verification": "source-reviewed", "verified_at": "2026-10-19" }