How cn0xroot/ifda works
IFDA analyzes a supplied ELF or extracted firmware tree: an analyst submits work through the Go service or Python CLI; the service queues a job and invokes the Python core, which loads binaries, performs reverse engineering and vulnerability checks, inventories the filesystem, and produces reports. Raw-image identification and extraction are a separate optional entry stage using moria. The README documents the service/UI and several analysis capabilities not sampled directly; those are represented at their documented module paths, with uncertain internal links omitted.
Main entry points: pipeline.py Analysis pipeline · api.go REST API · job.go Job queue and workers · vuln Vulnerability checks
Components 25
Service and jobs
- Web UI
service/main.go - REST API
service/api.go - Session auth
service/auth.go - Job queue and workers
service/job.go - Job history
service/job.go - Finding triage
service/triage.go - Report store
service/reportdb.go
Firmware extraction
- Identify and extract
ifda/ingest/__init__.py - Extracted firmware tree
Binary analysis
- Python CLI
ifda/cli.py - Analysis pipeline
ifda/pipeline.py - ELF metadata and strings
ifda/loader/elf.py - Disassembly and call graph
ifda/re/disasm.py - Mitigation detection
ifda/re/mitigations.py - Ghidra enrichment
ifda/re/decompile.py
Findings and inventory
- Vulnerability checks
ifda/vuln - Signature rules
ifda/rules/engine.py - Firmware inventory
ifda/inventory - Filesystem hardening
ifda/fs/hardening.py
Reports and results
- Analysis report model
ifda/model.py - JSON, Markdown, SBOM
ifda/report
Other components
- Analyst
- Firmware image
- cve-bin-tool
- Ghidra
Connections 26
- Analyst → Web UI: uses
- Web UI → REST API: requests
- REST API → Session auth: checks sessions
- REST API → Job queue and workers: submits jobs
- Job queue and workers → Job history: persists jobs
- Job queue and workers → Python CLI: runs per job
- Job queue and workers → Report store: stores reports
- REST API → Finding triage: updates triage
- Firmware image → Identify and extract: identifies and extracts
- Identify and extract → Extracted firmware tree: writes extracted files
- Analyst → Python CLI: runs analysis
- Extracted firmware tree → Analysis pipeline: analyzes files
- Python CLI → Analysis pipeline: invokes
- Analysis pipeline → ELF metadata and strings: loads binaries
- Analysis pipeline → Disassembly and call graph: disassembles
- Analysis pipeline → Mitigation detection: detects mitigations
- Analysis pipeline → Vulnerability checks: runs checks
- Analysis pipeline → Firmware inventory: builds inventory
- Analysis pipeline → Filesystem hardening: checks filesystem
- Analysis pipeline → Ghidra enrichment: enriches findings
- Analysis pipeline → Analysis report model: assembles results
- Vulnerability checks → Signature rules: applies signatures
- Vulnerability checks → cve-bin-tool: correlates CVEs
- Analysis report model → JSON, Markdown, SBOM: renders and exports
- Analysis report model → Report store: persisted by service
- Ghidra → Ghidra enrichment: provides enrichment