attify/firmware-analysis-toolkitFirmware security research platform combining binary analysis, taint tracing, and emulation across IoT, edge AI, mobile devices, and robotics.
Firmware Analysis Toolkit is a security research toolkit for investigating firmware security for IoT, Physical AI, Mobile Devices & Robotics. It is primarily built for the "Offensive IoT Exploitation" training conducted by Attify.
It has been built based on actual hands-on field experience of what really matters when it comes to real firmware security investigations that matter.
FAT's goal is not just to build an exceptional world-class cutting-edge toolkit for Firmware Security Research, but also forge professionals and practitioners who operate at their peak, where the tool becomes a cognitive superpower if used in certain ways, while being easy enough to be used by those who are new to the field.
Some of the features include classifying unknown firmware, extracts filesystems, maps trust-relevant code, traces taint, and coordinating QEMU emulation.
Download a binary bundle from Releases, or build from source with Rust 1.91 or newer:
git clone --branch v2.0.1 --depth 1 https://github.com/attify/firmware-analysis-toolkit.git
cd firmware-analysis-toolkit
cargo build --release --locked
cargo install --path crates/fat_cli --locked
python3 scripts/build-runtime-data-bundle.py --output ./dist/fat-data.zip
fat data install --archive ./dist/fat-data.zip
fat doctor
On Arch Linux or Omarchy, start with the Arch installation steps for prerequisite packages and optional tools.
One-Shot Installer for supported hosts:
./scripts/install.sh --install-system-deps
See INSTALL.md for installer options and optional tools.
For features listed under Unreleased, use --branch master in the clone command above. BMC inspection and native JFFS2 recovery were added after v2.0.1.
fat -hfat $firmware or fat identify --file $firmwarefat inspect bmc --file $firmwarefat new $firmwarefat extract $firmwarefat analyze $firmwarefat emulate --project $firmwarefat ./firmware.bin
fat inspect update --file ./firmware.bin --rootfs ./rootfs --reference ./older.bin
fat ./firmware.bin is shorthand for fat identify --file ./firmware.bin.
It gives a compact overview of the file's identity and structure.
Add --details for supporting tables.
For raw MCU images, inspect the mapping, startup, interrupts, and hardware:
fat inspect mcu --file ./firmware.bin
fat inspect mcu --file ./firmware.bin --details
For BMC flash images, inspect layout, FIT authentication metadata, and stored environments:
fat inspect bmc --file ./flash.mtd
fat inspect bmc --file ./flash.mtd --details
Both inspection workflows support --json for the full structured analysis report.
BMC inspection also supports --sarif --fail-on-warning for CI. FIT signatures are reported as stored metadata; cryptographic validity and hardware boot enforcement are not tested.
Run supported BMC services with fat emulate --project <project> --pack bmc-romulus or the explicit ASUS vendor-kernel profile. List profiles with fat rehost profiles list; see BMC emulation for input hashes, adaptations, Redfish checks and debugging.
For disposable lab accounts, fat debug redfish-session checks ReadOnly role enforcement and session revocation with an administrator positive control. fat debug process attaches to a guest daemon through SSH and records its identity and cleanup. See BMC session and process debugging for setup and the Romulus/ASUS results.
Native extraction reconstructs JFFS2 files before inspecting nested compressed content. See Inspecting BMC firmware for the extraction workflow, case-sensitive storage requirements, SARIF output, and environment overrides.
The pipeline from Quick start, end to end:
fat new ./firmware.bin
fat extract .fat-projects/firmware
fat analyze .fat-projects/firmware
fat preflight .fat-projects/firmware
fat emulate --project .fat-projects/firmware
fat r2-triage --file ./usr/sbin/httpd --json
fat taint --file ./www/cgi-bin/diag.cgi --summary
fat taint-query --file ./www/cgi-bin/diag.cgi
fat taint-cross --rootfs ./rootfs
fat taint-cross --rootfs ./rootfs --source-profile ./my-target-models.yaml --state-profile ./my-target-state.yaml
fat taint --lang shell --file ./app/init/wifi.sh --summary
fat taint --lang shell --rootfs ./extracted-rootfs --json
fat taint --lang shell --rootfs ./extracted-rootfs --source-profile ./my-target-shell.yaml --severity high
Find sinks statically, then prepare runtime hooks for the same addresses:
fat r2-triage --file ./usr/sbin/httpd --json
fat sink-discovery --file ./usr/sbin/httpd --json > sinks.json
fat handler-table --file ./usr/sbin/httpd --json > handlers.json
fat taint --file ./usr/sbin/httpd --sink-candidates sinks.json --json > taint.json
fat instrument-hooks --from-sinks sinks.json --output hooks.yaml
fat emulate --project .fat-projects/firmware --instrument hooks.yaml
fat tree --rootfs ./rootfs --profile inventory --summary --json
fat search --rootfs ./rootfs --profile credentials -I --context 2
fat startup-map --rootfs ./rootfs --profile cloud-tls
fat crypto-census --rootfs ./rootfs
fat trust-map --rootfs ./rootfs