# IFDA (IoT Firmware Deep Analysis) > Static analysis pipeline for extracted IoT firmware: pointed at one ELF or an unpacked root filesystem, it disassembles binaries with Capstone for x86, ARM/Thumb-2, AArch64 and MIPS, recovers functions, call graphs and exploit mitigations, and reports candidate issues from dangerous-function calls, call-graph taint paths, CVE correlation through cve-bin-tool, embedded secrets, script injection patterns and filesystem hardening checks. Reports come out as JSON, Markdown and a CycloneDX SBOM. Optional add-ons are Ghidra headless pseudocode, moria-based extraction of raw images and a Go service with a job queue, REST API, bilingual web UI and an LLM agent that triages a finished scan's findings. - Type: Tool - Targets: Binary · Firmware - Category: Firmware tools - Relationship: Foundation tool - Sources reviewed: 2026-10-27 - Added to the catalog: 2026-11-03 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/ifda-iot-firmware-deep-analysis/index.md) ## Requirements & limits - The reviewed main commit 90c11c2 of 2026-09-21 is the 29th since the project began on 2026-06-10. CHANGELOG calls it v4.4, while the latest tag is V4.1, five commits earlier, there are no GitHub releases and pyproject.toml still declares 2.0.0. README describes a first iteration covering binary reverse engineering and vulnerability discovery; emulated or dynamic validation is listed as planned, not built. - The Python 3.10+ core needs capstone, pyelftools, cryptography, Pillow and cve-bin-tool, which README calls required: it keeps a local CVE database of 1 GB or more and needs network access on first use, and without it correlation falls back to a small curated database with a warning. Optional parts are yara-python, Ghidra headless with JDK 17+ for pseudocode, CuPy for GPU chart rendering, the Go 1.22+ service for the REST API and web UI, and the moria submodule, built with CMake and a C++20 compiler, for unpacking raw images. Linux and macOS are supported; Windows only through WSL2. - Input is a single ELF, an extracted firmware tree or, through the service's extract job, a raw image whose filesystem region the analyst chooses. README and the requirements document limit use to firmware the operator owns or is authorized to assess. The repository contains no firmware; its tests build cross-compiled x86_64, MIPS, ARM and AArch64 samples, and README reports 25 passed and 2 skipped with cross-compilers and Ghidra installed. - README calls decompilation-free static analysis heuristic: findings carry confidence scores, and taint results are candidate paths for analyst validation, not proven exploits. The optional AI analysis sends a finished scan to an OpenAI-compatible or Anthropic-protocol endpoint the user configures, storing API keys encrypted; the model pulls finding evidence, pseudocode, init scripts and service data through tools. README says these features were tested with Claude models. - Apache-2.0, added on 2026-09-17; cve-bin-tool (GPL-3.0) is only invoked as a subprocess, and moria is MIT. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. ## More in Firmware and hardware - [basefind2](https://awesomerea.org/resources/basefind2/index.md) · Tool - [JTAGulator](https://awesomerea.org/resources/jtagulator/index.md) · Tool - [BIOSUtilities](https://awesomerea.org/resources/biosutilities/index.md) · Tool - [allyourbase](https://awesomerea.org/resources/allyourbase/index.md) · Tool - [ghidra_kernelcache](https://awesomerea.org/resources/ghidra-kernelcache/index.md) · Tool - [esp32_image_parser](https://awesomerea.org/resources/esp32-image-parser/index.md) · Tool ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.