{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/doronz88/fa/blob/b584a37f920995310f257d428e1a0b387cbf489e/commands.md",
    "https://github.com/doronz88/fa/blob/b584a37f920995310f257d428e1a0b387cbf489e/fa/ida_plugin.py",
    "https://github.com/doronz88/fa/blob/b584a37f920995310f257d428e1a0b387cbf489e/elf_loader.py",
    "https://github.com/doronz88/fa/blob/b584a37f920995310f257d428e1a0b387cbf489e/pyproject.toml",
    "https://github.com/doronz88/fa/blob/b584a37f920995310f257d428e1a0b387cbf489e/requirements.txt",
    "https://github.com/doronz88/fa/blob/b584a37f920995310f257d428e1a0b387cbf489e/requirements_testing.txt",
    "https://github.com/doronz88/fa/tree/b584a37f920995310f257d428e1a0b387cbf489e/fa/signatures",
    "https://github.com/doronz88/fa/blob/b584a37f920995310f257d428e1a0b387cbf489e/tests/conftest.py",
    "https://github.com/doronz88/fa/blob/b584a37f920995310f257d428e1a0b387cbf489e/.github/workflows/python-app.yml",
    "https://github.com/doronz88/fa/blob/b584a37f920995310f257d428e1a0b387cbf489e/LICENSE",
    "https://github.com/doronz88/fa/commit/bc88577a0af4e9a91bcfcae4d88bbf9c012fe646",
    "https://github.com/doronz88/fa/releases/tag/v1.0.11",
    "https://pypi.org/project/fa/1.0.11/"
  ],
  "category": "native-analysis",
  "description_en": "Python framework, mainly used as an IDA plugin, that turns the manual steps of locating symbols, such as finding a string, following its cross-reference and taking the function start, into reusable signatures. Hjson SIG files, grouped into per-platform projects, chain commands that search bytes, strings, immediates or Keystone-assembled opcodes, filter by operands and cross-references, and then set names, types, constants, enums and struct members; Python scripts can drive the same interpreter. In IDA it adds an FA menu and toolbar to find all of a project's symbols, draft a temporary signature from the current function and export symbols plus a C header, and a separate loader runs signatures over a raw ELF file without IDA.",
  "description_zh": "一个主要以 IDA 插件形式使用的 Python 框架，把定位符号时的手工步骤（例如查找字符串、跟随交叉引用、跳到函数起始处）写成可复用的签名。Hjson 格式的 SIG 文件按平台归入不同项目，其中串联的命令可搜索字节、字符串、立即数或用 Keystone 汇编出的指令，按操作数和交叉引用筛选，再设置名称、类型、常量、枚举和结构体成员；也可用 Python 脚本调用同一解释器。在 IDA 中，它添加 FA 菜单和工具栏，用于查找项目的全部符号、根据当前函数生成临时签名草稿，以及导出符号和 C 头文件；另有一个加载器可在不使用 IDA 的情况下对原始 ELF 文件运行签名。",
  "entry_url": "https://awesomerea.org/resources/fa-firmware-analysis/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/fa-firmware-analysis/",
  "evidence_url": "https://github.com/doronz88/fa/blob/b584a37f920995310f257d428e1a0b387cbf489e/README.md",
  "group": "tools",
  "id": "fa-firmware-analysis",
  "json_url": "https://awesomerea.org/resources/fa-firmware-analysis/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/fa-firmware-analysis/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/fa-firmware-analysis/index.md",
  "name": "FA (Firmware Analysis)",
  "name_zh": "FA（Firmware Analysis）符号定位自动化工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v1.0.11, published 2026-03-25 without attached files; it tags the reviewed master commit, and the same version is on PyPI as fa 1.0.11. The README installs it by cloning the repository and running pip install -e, says the code base is very IDA-oriented and only considers Ghidra, radare2 or other disassemblers for the future.",
    "The README supports IDA 8.0+, and a March 2026 commit added IDA 9.0 support to make-offset. The package requires Python 3.8+; its dependencies, including keystone-engine, capstone, hjson and rpyc, are installed into IDA's Python. IDA can also run the plugin in script mode to write a symbols file, while the ELF loader script imports pyelftools, which is listed only in the testing requirements.",
    "The binaries, IDA databases and signatures come from the analyst: the repository ships only two small test projects under fa/signatures and no signature sets for real firmware. The README groups signatures into projects partly to lower false positives, and the ELF loader reports symbols with several matches instead of choosing one.",
    "CI lints with flake8 and runs pytest on Python 3.8 to 3.12; the tests check find-bytes on mocked memory segments and ELF symbol search on a small ARM ELF built at test time with Keystone and simpleelf, and neither runs IDA. GPL-3.0 license text; pyproject.toml classifies it as GPLv3 or later."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v1.0.11，发布于 2026-03-25，未附带任何文件；该标签指向所审阅的 master 提交，PyPI 上也有同版本的 fa 1.0.11。README 的安装方式是克隆仓库后运行 pip install -e，并说明代码库高度面向 IDA，对 Ghidra、radare2 等其他反汇编器的支持仅在未来考虑之列。",
    "README 称支持 IDA 8.0+，2026 年 3 月的一次提交为 make-offset 加入了 IDA 9.0 支持。软件包要求 Python 3.8+；keystone-engine、capstone、hjson、rpyc 等依赖需安装到 IDA 自带的 Python 中。IDA 也可在脚本模式下运行该插件并写出符号文件；ELF 加载器脚本则需要 pyelftools，而它只列在测试依赖中。",
    "二进制文件、IDA 数据库和签名均由分析者自行提供：仓库在 fa/signatures 下只附带两个小型测试项目，没有面向真实固件的签名集。README 将签名按项目划分，部分目的在于降低误报；ELF 加载器遇到多处匹配的符号时会如实报告，而不会替用户选定其一。",
    "CI 使用 flake8 做静态检查，并在 Python 3.8 至 3.12 上运行 pytest；测试在模拟内存段上检查 find-bytes，并在测试时用 Keystone 和 simpleelf 生成的小型 ARM ELF 上检查 ELF 符号搜索，均不运行 IDA。许可证文本为 GPL-3.0，pyproject.toml 的分类标注为 GPLv3 或更高版本。"
  ],
  "targets": [
    "binary",
    "firmware"
  ],
  "url": "https://github.com/doronz88/fa",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}