Tool

IFDA (IoT Firmware Deep Analysis)

Static analysis pipeline for extracted IoT firmware: pointed at one ELF or an unpacked root filesystem, it disassembles binaries with Capstone for x86, ARM/Thumb-2, AArch64 and MIPS, recovers functions, call graphs and exploit mitigations, and reports candidate issues from dangerous-function calls, call-graph taint paths, CVE correlation through cve-bin-tool, embedded secrets, script injection patterns and filesystem hardening checks. Reports come out as JSON, Markdown and a CycloneDX SBOM. Optional add-ons are Ghidra headless pseudocode, moria-based extraction of raw images and a Go service with a job queue, REST API, bilingual web UI and an LLM agent that triages a finished scan's findings.

Targets: Binary · Firmware
Category: Firmware tools
Relationship: Foundation tool
Sources reviewed: 2026-10-27

Requirements & limits

The reviewed main commit 90c11c2 of 2026-09-21 is the 29th since the project began on 2026-06-10. CHANGELOG calls it v4.4, while the latest tag is V4.1, five commits earlier, there are no GitHub releases and pyproject.toml still declares 2.0.0. README describes a first iteration covering binary reverse engineering and vulnerability discovery; emulated or dynamic validation is listed as planned, not built.
The Python 3.10+ core needs capstone, pyelftools, cryptography, Pillow and cve-bin-tool, which README calls required: it keeps a local CVE database of 1 GB or more and needs network access on first use, and without it correlation falls back to a small curated database with a warning. Optional parts are yara-python, Ghidra headless with JDK 17+ for pseudocode, CuPy for GPU chart rendering, the Go 1.22+ service for the REST API and web UI, and the moria submodule, built with CMake and a C++20 compiler, for unpacking raw images. Linux and macOS are supported; Windows only through WSL2.
Input is a single ELF, an extracted firmware tree or, through the service's extract job, a raw image whose filesystem region the analyst chooses. README and the requirements document limit use to firmware the operator owns or is authorized to assess. The repository contains no firmware; its tests build cross-compiled x86_64, MIPS, ARM and AArch64 samples, and README reports 25 passed and 2 skipped with cross-compilers and Ghidra installed.
README calls decompilation-free static analysis heuristic: findings carry confidence scores, and taint results are candidate paths for analyst validation, not proven exploits. The optional AI analysis sends a finished scan to an OpenAI-compatible or Anthropic-protocol endpoint the user configures, storing API keys encrypted; the model pulls finding evidence, pseudocode, init scripts and service data through tools. README says these features were tested with Claude models.
Apache-2.0, added on 2026-09-17; cve-bin-tool (GPL-3.0) is only invoked as a subprocess, and moria is MIT.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · cn0xroot/IFDA · Revision 90c11c2
CHANGELOG.md GitHub · cn0xroot/IFDA · Revision 90c11c2
firmware-analysis-requirements.md GitHub · cn0xroot/IFDA · Revision 90c11c2
ENVIRONMENT.md GitHub · cn0xroot/IFDA · Revision 90c11c2
service/README.md GitHub · cn0xroot/IFDA · Revision 90c11c2
pyproject.toml GitHub · cn0xroot/IFDA · Revision 90c11c2
.gitmodules GitHub · cn0xroot/IFDA · Revision 90c11c2
LICENSE GitHub · cn0xroot/IFDA · Revision 90c11c2

Requirements & limits

About this entry

Primary sources

More in Firmware and hardware