{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/quarkslab/pyrrha/blob/54cfe78055740336283a02a75cfd8694f48cf2b9/docs/installation.md",
    "https://github.com/quarkslab/pyrrha/blob/54cfe78055740336283a02a75cfd8694f48cf2b9/docs/index.md",
    "https://github.com/quarkslab/pyrrha/blob/54cfe78055740336283a02a75cfd8694f48cf2b9/docs/mappers/index.md",
    "https://github.com/quarkslab/pyrrha/blob/54cfe78055740336283a02a75cfd8694f48cf2b9/docs/mappers/fs.md",
    "https://github.com/quarkslab/pyrrha/blob/54cfe78055740336283a02a75cfd8694f48cf2b9/docs/mappers/fs-cg.md",
    "https://github.com/quarkslab/pyrrha/blob/54cfe78055740336283a02a75cfd8694f48cf2b9/docs/mappers/exe-decomp.md",
    "https://github.com/quarkslab/pyrrha/blob/54cfe78055740336283a02a75cfd8694f48cf2b9/docs/.snippets/diffing_pyrrha_exports.py",
    "https://github.com/quarkslab/pyrrha/blob/54cfe78055740336283a02a75cfd8694f48cf2b9/pyproject.toml",
    "https://github.com/quarkslab/pyrrha/blob/54cfe78055740336283a02a75cfd8694f48cf2b9/CHANGELOG.md",
    "https://github.com/quarkslab/pyrrha/blob/54cfe78055740336283a02a75cfd8694f48cf2b9/.gitlab-ci.yml",
    "https://github.com/quarkslab/pyrrha/blob/54cfe78055740336283a02a75cfd8694f48cf2b9/ci/ida/Dockerfile",
    "https://github.com/quarkslab/pyrrha/tree/54cfe78055740336283a02a75cfd8694f48cf2b9/tests/test_fw",
    "https://github.com/quarkslab/pyrrha/blob/54cfe78055740336283a02a75cfd8694f48cf2b9/LICENSE",
    "https://github.com/quarkslab/pyrrha/releases/tag/v2.0.3",
    "https://pypi.org/project/pyrrha-mapper/2.0.3/"
  ],
  "category": "firmware",
  "description_en": "Quarkslab's firmware cartography tool, which indexes an extracted firmware filesystem into a database browsed with NumbatUI, Quarkslab's fork of the Sourcetrail code explorer. The fs mapper uses LIEF to map ELF and PE files, their imports and exports and the symlinks that point to them; fs-cg disassembles every executable with IDA Pro or Ghidra and links their call graphs across binaries, and decomp indexes one executable's decompiled functions with call cross-references. JSON exports can be post-processed in Python, for example to diff two firmware versions.",
  "description_zh": "Quarkslab 的固件“测绘”工具，将已提取的固件文件系统编入数据库，再用 NumbatUI（Quarkslab 基于 Sourcetrail 代码浏览器的分支）浏览。fs 映射器借助 LIEF 映射 ELF 和 PE 文件、其导入与导出，以及指向这些文件的符号链接；fs-cg 用 IDA Pro 或 Ghidra 反汇编每个可执行文件，并把各二进制的调用图跨文件连接起来；decomp 则为单个可执行文件的反编译函数建立索引并附调用交叉引用。JSON 导出可用 Python 进一步处理，例如比较两个固件版本的差异。",
  "entry_url": "https://awesomerea.org/resources/pyrrha/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/pyrrha/",
  "evidence_url": "https://github.com/quarkslab/pyrrha/blob/54cfe78055740336283a02a75cfd8694f48cf2b9/README.md",
  "group": "tools",
  "id": "pyrrha",
  "json_url": "https://awesomerea.org/resources/pyrrha/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/pyrrha/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/pyrrha/index.md",
  "name": "Pyrrha",
  "name_zh": "Pyrrha 固件测绘工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v2.0.3, published to GitHub and PyPI as pyrrha-mapper on 2026-09-21; the reviewed main commit sets the same version. v2.0.0 (2026-07-07) added the Ghidra backend and removed the earlier Quokka dependency. pyproject.toml marks the package Beta and lists Linux and Windows.",
    "Input is a firmware root filesystem that the user has already extracted or mounted, or a single executable for decomp; Pyrrha does not unpack firmware images. The fs quick start uses an OpenWrt x86-64 rootfs downloaded from the OpenWrt project.",
    "pyproject.toml requires Python 3.11+, although the installation page says 3.10. fs needs no disassembler, but fs-cg and decomp need a local IDA Pro 9.1+ or Ghidra 12.0+, found on PATH or through IDADIR or GHIDRA_INSTALL_DIR; a Ghidra-based Docker image is published on GitHub's registry, and the IDA CI image is built from the user's own Hex-Rays installer and licence. Results are viewed in NumbatUI or, without newer features such as node renaming, Sourcetrail 2021.4.19.",
    "The GitLab CI file runs pytest unit tests and CLI runs of each mapper, with IDA and Ghidra images for fs-cg and decomp; the GitHub workflows only build documentation and publish releases. tests/test_fw is a small 32-bit ARM Linux fixture holding an OpenSSL 1.1.1n executable built with Buildroot and glibc libraries.",
    "Apache-2.0; NumbatUI is a separate GPL-3.0 project, and IDA Pro is commercial software. The README lists SSTIC, Hack.lu, Pass The SALT and RE//verse talks by the authors."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v2.0.3，于 2026-09-21 发布到 GitHub，并以 pyrrha-mapper 名称发布到 PyPI；所审阅的 main 提交设定的也是该版本。v2.0.0（2026-07-07）新增 Ghidra 后端，并移除了原先对 Quokka 的依赖。pyproject.toml 将该软件包标为 Beta，并列出 Linux 和 Windows。",
    "输入为使用者已提取或挂载的固件根文件系统；decomp 的输入则是单个可执行文件。Pyrrha 本身不解包固件镜像。fs 的快速入门示例使用从 OpenWrt 项目下载的 OpenWrt x86-64 根文件系统。",
    "pyproject.toml 要求 Python 3.11+，而安装页面写的是 3.10。fs 不需要反汇编器，但 fs-cg 和 decomp 需要本地安装 IDA Pro 9.1+ 或 Ghidra 12.0+，可放在 PATH 中，或通过 IDADIR 或 GHIDRA_INSTALL_DIR 指定位置；GitHub 镜像仓库提供基于 Ghidra 的 Docker 镜像，而用于 CI 的 IDA 镜像须以使用者自己的 Hex-Rays 安装程序和许可证构建。结果可在 NumbatUI 中查看，也可用 Sourcetrail 2021.4.19 查看，但无法使用节点重命名等新功能。",
    "GitLab CI 配置运行 pytest 单元测试以及各映射器的命令行测试，其中 fs-cg 和 decomp 使用 IDA 与 Ghidra 镜像；GitHub 工作流只构建文档和发布版本。tests/test_fw 是一个小型 32 位 ARM Linux 测试样例，包含以 Buildroot 构建的 OpenSSL 1.1.1n 可执行文件和 glibc 库。",
    "采用 Apache-2.0 许可；NumbatUI 是采用 GPL-3.0 的独立项目，IDA Pro 是商业软件。README 列出了作者在 SSTIC、Hack.lu、Pass The SALT 和 RE//verse 的演讲。"
  ],
  "targets": [
    "binary",
    "firmware"
  ],
  "url": "https://github.com/quarkslab/pyrrha",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}