{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/cn0xroot/IFDA/blob/90c11c2179c8a1c907529a9e866c06b636375077/CHANGELOG.md",
    "https://github.com/cn0xroot/IFDA/blob/90c11c2179c8a1c907529a9e866c06b636375077/firmware-analysis-requirements.md",
    "https://github.com/cn0xroot/IFDA/blob/90c11c2179c8a1c907529a9e866c06b636375077/ENVIRONMENT.md",
    "https://github.com/cn0xroot/IFDA/blob/90c11c2179c8a1c907529a9e866c06b636375077/service/README.md",
    "https://github.com/cn0xroot/IFDA/blob/90c11c2179c8a1c907529a9e866c06b636375077/pyproject.toml",
    "https://github.com/cn0xroot/IFDA/blob/90c11c2179c8a1c907529a9e866c06b636375077/.gitmodules",
    "https://github.com/cn0xroot/IFDA/blob/90c11c2179c8a1c907529a9e866c06b636375077/LICENSE"
  ],
  "category": "firmware",
  "description_en": "Static analysis pipeline for extracted IoT firmware: pointed at one ELF or an unpacked root filesystem, it disassembles binaries with Capstone for x86, ARM/Thumb-2, AArch64 and MIPS, recovers functions, call graphs and exploit mitigations, and reports candidate issues from dangerous-function calls, call-graph taint paths, CVE correlation through cve-bin-tool, embedded secrets, script injection patterns and filesystem hardening checks. Reports come out as JSON, Markdown and a CycloneDX SBOM. Optional add-ons are Ghidra headless pseudocode, moria-based extraction of raw images and a Go service with a job queue, REST API, bilingual web UI and an LLM agent that triages a finished scan's findings.",
  "description_zh": "面向已解包 IoT 固件的静态分析流水线：对单个 ELF 或解包后的根文件系统，它用 Capstone 反汇编 x86、ARM/Thumb-2、AArch64 和 MIPS 二进制，恢复函数、调用图和漏洞缓解措施，并从危险函数调用、调用图污点路径、借助 cve-bin-tool 的 CVE 关联、内嵌密钥、脚本注入模式和文件系统加固检查中报告候选问题。报告以 JSON、Markdown 和 CycloneDX SBOM 输出。可选组件包括 Ghidra 无界面伪代码、基于 moria 的原始镜像解包，以及一个 Go 服务，提供任务队列、REST API、中英双语网页界面，并可由大模型智能体对已完成的扫描结果进行分诊。",
  "entry_url": "https://awesomerea.org/resources/ifda-iot-firmware-deep-analysis/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/ifda-iot-firmware-deep-analysis/",
  "evidence_url": "https://github.com/cn0xroot/IFDA/blob/90c11c2179c8a1c907529a9e866c06b636375077/README.md",
  "group": "tools",
  "id": "ifda-iot-firmware-deep-analysis",
  "json_url": "https://awesomerea.org/resources/ifda-iot-firmware-deep-analysis/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/ifda-iot-firmware-deep-analysis/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/ifda-iot-firmware-deep-analysis/index.md",
  "name": "IFDA (IoT Firmware Deep Analysis)",
  "name_zh": "IFDA IoT 固件深度分析工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The reviewed main commit 90c11c2 of 2026-09-21 is the 29th since the project began on 2026-06-10. CHANGELOG calls it v4.4, while the latest tag is V4.1, five commits earlier, there are no GitHub releases and pyproject.toml still declares 2.0.0. README describes a first iteration covering binary reverse engineering and vulnerability discovery; emulated or dynamic validation is listed as planned, not built.",
    "The Python 3.10+ core needs capstone, pyelftools, cryptography, Pillow and cve-bin-tool, which README calls required: it keeps a local CVE database of 1 GB or more and needs network access on first use, and without it correlation falls back to a small curated database with a warning. Optional parts are yara-python, Ghidra headless with JDK 17+ for pseudocode, CuPy for GPU chart rendering, the Go 1.22+ service for the REST API and web UI, and the moria submodule, built with CMake and a C++20 compiler, for unpacking raw images. Linux and macOS are supported; Windows only through WSL2.",
    "Input is a single ELF, an extracted firmware tree or, through the service's extract job, a raw image whose filesystem region the analyst chooses. README and the requirements document limit use to firmware the operator owns or is authorized to assess. The repository contains no firmware; its tests build cross-compiled x86_64, MIPS, ARM and AArch64 samples, and README reports 25 passed and 2 skipped with cross-compilers and Ghidra installed.",
    "README calls decompilation-free static analysis heuristic: findings carry confidence scores, and taint results are candidate paths for analyst validation, not proven exploits. The optional AI analysis sends a finished scan to an OpenAI-compatible or Anthropic-protocol endpoint the user configures, storing API keys encrypted; the model pulls finding evidence, pseudocode, init scripts and service data through tools. README says these features were tested with Claude models.",
    "Apache-2.0, added on 2026-09-17; cve-bin-tool (GPL-3.0) is only invoked as a subprocess, and moria is MIT."
  ],
  "requirements_zh": [
    "所审阅的 main 分支提交 90c11c2 日期为 2026-09-21，是项目自 2026-06-10 开始以来的第 29 次提交。CHANGELOG 称其为 v4.4，而最新标签是早五次提交的 V4.1，GitHub 上没有发布版本，pyproject.toml 仍声明为 2.0.0。README 称这是第一阶段，涵盖二进制逆向与漏洞发现；仿真或动态验证列为计划中的功能，尚未实现。",
    "Python 3.10+ 核心需要 capstone、pyelftools、cryptography、Pillow 以及 README 称为必需的 cve-bin-tool：后者在本地维护 1 GB 以上的 CVE 数据库，首次使用需联网；缺少它时，CVE 关联会退回到一个小型人工整理的数据库并给出警告。可选组件包括 yara-python、用于生成伪代码的 Ghidra 无界面模式与 JDK 17+、用于 GPU 图表渲染的 CuPy、提供 REST API 和网页界面的 Go 1.22+ 服务，以及用 CMake 和 C++20 编译器构建、用于解包原始镜像的 moria 子模块。支持 Linux 和 macOS；Windows 只能通过 WSL2 使用。",
    "输入可以是单个 ELF、已解包的固件目录，或经服务的解包任务处理、由分析者选定文件系统区域的原始镜像。README 和需求文档限定只能分析操作者拥有或获授权评估的固件。仓库不含任何固件；测试会自行构建 x86_64、MIPS、ARM 和 AArch64 交叉编译样本，README 报告在安装交叉编译器和 Ghidra 的情况下 25 项通过、2 项跳过。",
    "README 指出这种不依赖反编译的静态分析属于启发式方法：每项结果都带置信度，污点结果只是需要分析者验证的候选路径，并非已证实的漏洞利用。可选的 AI 分析会把已完成的扫描发送到用户配置的 OpenAI 兼容或 Anthropic 协议端点，API 密钥加密存储；模型通过工具调用读取结果证据、伪代码、init 脚本和服务信息。README 称这些功能是在 Claude 模型上测试的。",
    "采用 Apache-2.0 许可，于 2026-09-17 加入；cve-bin-tool（GPL-3.0）仅以子进程方式调用，moria 采用 MIT 许可。"
  ],
  "targets": [
    "binary",
    "firmware"
  ],
  "url": "https://github.com/cn0xroot/IFDA",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}