Tool

FwAnalyzer

Rule-based checker for filesystem images taken from firmware: it reads ext2/3/4, FAT/VFAT, SquashFS and UBIFS images, cpio archives or a directory, and writes a JSON report of every file that breaks the rules in a TOML configuration. Rules cover SUID and world-writable files, allowed owners, SELinux labels and Linux capabilities, per-file metadata, content regexes, SHA-256 digests, JSON fields and external scripts such as the bundled checksec wrapper; it can also extract values such as version strings and compare the file tree or selected files with a previous run. Cruise describes it as part of a firmware security check suite, and check.py with an Android OTA unpacker runs it over each image in a firmware package.

Targets: Firmware
Category: Firmware tools
Relationship: Foundation tool
Sources reviewed: 2026-10-20

Requirements & limits

Latest release at review: 1.4.4, published 2022-10-24 without an attached binary; releases 1.4.1 to 1.4.3 attach a prebuilt Linux fwanalyzer. The reviewed master commit, from 2023-10-08, only fixes typos after that release and is the latest commit; the repository is not archived, and the Makefile still sets VERSION=1.4.1.
Built from source with Go (go.mod declares Go 1.13; the Makefile defaults GOOS to linux) through make deps and make, giving build/fwanalyzer. Each filesystem backend calls external programs: e2ls and e2cp from e2tools for ext images, mdir and mcopy from mtools for FAT, unsquashfs, ubireader_list_files from ubi_reader, and cpio. SELinux and capability data need the author's patched e2tools and squashfs-tools forks, and ext symlink handling needs e2tools' link_support branch; the Dockerfile lists the full dependency set on a golang:1.13 image.
Input is a filesystem image or unpacked directory the user already has; FwAnalyzer itself does not unpack firmware packages. check.py needs an unpacker script that maps configurations to images, and the bundled Android OTA unpacker relies on the separate extract_android_ota_payload and mkbootimg_tools projects. Findings depend entirely on the user's configuration: the devices folder supplies sample Android user-build, Android property and generic Linux root-filesystem rules, and the report lists rule offenders rather than assessed vulnerabilities.
make test runs Go unit tests, and the integration target runs test/test.py, written for Python 2, against bundled fixtures in test/: small ext2, SquashFS, UBIFS, VFAT and cpio images, hello-world ELF builds for ARM32, ARM64 and x86-64, and prebuilt e2cp and unsquashfs helper executables; make testsetup uses sudo setcap. CircleCI builds and tests inside the Docker image, while the GitHub workflow only lints with golangci-lint v1.29.
Apache-2.0, copyright Cruise LLC; the external filesystem tools keep their own licenses.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

Readme.md GitHub · cruise-automation/fwanalyzer · Revision a0db450
Building.md GitHub · cruise-automation/fwanalyzer · Revision a0db450
Changelog.md GitHub · cruise-automation/fwanalyzer · Revision a0db450
Checksec.md GitHub · cruise-automation/fwanalyzer · Revision a0db450
Dockerfile GitHub · cruise-automation/fwanalyzer · Revision a0db450
Makefile GitHub · cruise-automation/fwanalyzer · Revision a0db450
go.mod GitHub · cruise-automation/fwanalyzer · Revision a0db450
devices/Readme.md GitHub · cruise-automation/fwanalyzer · Revision a0db450
devices/android/Readme.md GitHub · cruise-automation/fwanalyzer · Revision a0db450
pkg/extparser/extparser.go#L40-L43 GitHub · cruise-automation/fwanalyzer · Revision a0db450
test GitHub · cruise-automation/fwanalyzer · Revision a0db450
.circleci/config.yml GitHub · cruise-automation/fwanalyzer · Revision a0db450
LICENSE GitHub · cruise-automation/fwanalyzer · Revision a0db450
https://github.com/cruise-automation/fwanalyzer/releases/tag/1.4.4

Requirements & limits

About this entry

Primary sources

More in Firmware and hardware