FAT — Firmware Analysis Toolkit

Firmware Analysis Toolkit is a security research toolkit for investigating firmware security for IoT, Physical AI, Mobile Devices & Robotics. It is primarily built for the "Offensive IoT Exploitation" training conducted by Attify.

It has been built based on actual hands-on field experience of what really matters when it comes to real firmware security investigations that matter.

FAT's goal is not just to build an exceptional world-class cutting-edge toolkit for Firmware Security Research, but also forge professionals and practitioners who operate at their peak, where the tool becomes a cognitive superpower if used in certain ways, while being easy enough to be used by those who are new to the field.

Some of the features include classifying unknown firmware, extracts filesystems, maps trust-relevant code, traces taint, and coordinating QEMU emulation.

What FAT can analyze

• Unknown blobs and directories: containers, compressed members, high-entropy regions, MCU signals, and candidate firmware files
• Firmware images: headers, update envelopes, partitions, bootloaders, and image-to-image differences
• Extracted Linux filesystems: inventory, startup intent, trust-bearing binaries, crypto material, and string evidence
• ELF binaries: imports, exports, handler tables, stripped-code sinks, decompilation, and source-to-sink taint
• Bare-metal and MCU images: vector tables, memory maps, peripheral hints, flash-write authority, and boot handoff evidence
• Edge AI artifacts: MAGIK/JZDL, TFLite, ONNX, and Qualcomm DLC files plus visible inference runtimes
• Android applications: APK inventory, discovery leads, locality, capability chains, and handoff boundaries
• Source repositories: invariant queries, patch guidance, and nearby variant searches

Quick start

Clone the repository, build with Rust 1.90 or newer, and install:

git clone https://github.com/attify/firmware-analysis-toolkit.git
cd firmware-analysis-toolkit
cargo build --release --locked
cargo install --path crates/fat_cli --locked
fat doctor

One-Shot Installer:

./scripts/install.sh --install-system-deps

Refer INSTALL.md for more customization in the installation process.

Quick Command Ref.

• Help : fat -h
• Identify a firmware: fat $firmware or fat identify --file $firmware
• New Project : fat new $firmware
• Extract file system : fat extract $firmware
• Analyze : fat analyze $firmware
• Emulation : fat emulate --project $firmware

First contact with an unknown file

fat ./firmware.bin
fat inspect update --file ./firmware.bin --rootfs ./rootfs --reference ./older.bin

Image to Runtime

The pipeline from Quick start, end to end:

fat new ./firmware.bin
fat extract .fat-projects/firmware
fat analyze .fat-projects/firmware
fat preflight .fat-projects/firmware
fat emulate --project .fat-projects/firmware

Binary triage and data flow

fat r2-triage --file ./usr/sbin/httpd --json
fat taint --file ./www/cgi-bin/diag.cgi --summary
fat taint-query --file ./www/cgi-bin/diag.cgi
fat taint-cross --rootfs ./rootfs
fat taint-cross --rootfs ./rootfs --source-profile ./my-target-models.yaml --state-profile ./my-target-state.yaml

Shell script data flow

fat taint --lang shell --file ./app/init/wifi.sh --summary
fat taint --lang shell --rootfs ./extracted-rootfs --json
fat taint --lang shell --rootfs ./extracted-rootfs --source-profile ./my-target-shell.yaml --severity high

Stripped binaries

Find sinks statically, then prepare runtime hooks for the same addresses:

fat r2-triage --file ./usr/sbin/httpd --json
fat sink-discovery --file ./usr/sbin/httpd --json > sinks.json
fat handler-table --file ./usr/sbin/httpd --json > handlers.json
fat taint --file ./usr/sbin/httpd --sink-candidates sinks.json --json > taint.json
fat instrument-hooks --from-sinks sinks.json --output hooks.yaml
fat emulate --project .fat-projects/firmware --instrument hooks.yaml

Filesystem-wide evidence sweep

fat tree --rootfs ./rootfs --profile inventory --summary --json
fat search --rootfs ./rootfs --profile credentials -I --context 2
fat startup-map --rootfs ./rootfs --profile cloud-tls
fat crypto-census --rootfs ./rootfs
fat trust-map --rootfs ./rootfs

Source-backed invariant query

fat invariant query \
  --fixture tests/fixtures/query/source/invariant-permission \
  --rule 'Every privileged override method must call enforcePermission()'
fat patch check --help
fat verify --help

Security

• Emulation executes untrusted vendor code.
• Review SECURITY.md before processing untrusted images or exposing an emulated service to a network.
• It is your responsibility to have authorisation for the targets you work on.

Detailed Guides

Maintainers

FAT was authored by adi0x90, who is also its current maintainer and principal contributor. The project is maintained under Attify.

License

FAT 2.0 is source available under FSL-1.1-ALv2. See LICENSING.md and THIRD_PARTY_NOTICES.md for more details.