# cn0xroot/ifda architecture

> Architecture diagram of the GitHub repository cn0xroot/ifda, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/cn0xroot/ifda
- Repository: https://github.com/cn0xroot/ifda

## Overview

IFDA analyzes a supplied ELF or extracted firmware tree: an analyst submits work through the Go service or Python CLI; the service queues a job and invokes the Python core, which loads binaries, performs reverse engineering and vulnerability checks, inventories the filesystem, and produces reports. Raw-image identification and extraction are a separate optional entry stage using moria. The README documents the service/UI and several analysis capabilities not sampled directly; those are represented at their documented module paths, with uncertain internal links omitted.

Main entry points: [`ifda/pipeline.py`](https://github.com/cn0xroot/ifda/blob/main/ifda/pipeline.py) (Analysis pipeline), [`service/api.go`](https://github.com/cn0xroot/ifda/blob/main/service/api.go) (REST API), [`service/job.go`](https://github.com/cn0xroot/ifda/blob/main/service/job.go) (Job queue and workers), [`ifda/vuln`](https://github.com/cn0xroot/ifda/tree/main/ifda/vuln) (Vulnerability checks)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_service["Service and jobs"]
  node_web["Web UI<br/>[main.go]"]
  node_api["REST API<br/>[api.go]"]
  node_auth[("Session auth<br/>[auth.go]")]
  node_jobs["Job queue and workers<br/>[job.go]"]
  node_jobstore[("Job history<br/>[job.go]")]
  node_triage[("Finding triage<br/>[triage.go]")]
  node_reportdb[("Report store<br/>[reportdb.go]")]
end

subgraph group_extract["Firmware extraction"]
  node_moria["Identify and extract<br/>[__init__.py]"]
  node_tree["Extracted firmware tree"]
end

subgraph group_analysis["Binary analysis"]
  node_cli["Python CLI<br/>[cli.py]"]
  node_pipeline["Analysis pipeline<br/>[pipeline.py]"]
  node_elf["ELF metadata and strings<br/>[elf.py]"]
  node_disasm["Disassembly and call graph<br/>[disasm.py]"]
  node_mitigations["Mitigation detection<br/>[mitigations.py]"]
  node_decompile["Ghidra enrichment<br/>[decompile.py]"]
end

subgraph group_discovery["Findings and inventory"]
  node_vuln["Vulnerability checks"]
  node_rules["Signature rules<br/>[engine.py]"]
  node_inventory["Firmware inventory"]
  node_hardening["Filesystem hardening<br/>[hardening.py]"]
end

subgraph group_output["Reports and results"]
  node_report["Analysis report model<br/>[model.py]"]
  node_formats["JSON, Markdown, SBOM"]
end

node_analyst(("Analyst"))
node_raw["Firmware image"]
node_cve_tool["cve-bin-tool"]
node_ghidra["Ghidra"]

node_analyst -->|"uses"| node_web
node_web -->|"requests"| node_api
node_api -->|"checks sessions"| node_auth
node_api -->|"submits jobs"| node_jobs
node_jobs -->|"persists jobs"| node_jobstore
node_jobs -->|"runs per job"| node_cli
node_jobs -->|"stores reports"| node_reportdb
node_api -->|"updates triage"| node_triage
node_raw -.->|"identifies and extracts"| node_moria
node_moria -.->|"writes extracted files"| node_tree
node_analyst -->|"runs analysis"| node_cli
node_tree -->|"analyzes files"| node_pipeline
node_cli -->|"invokes"| node_pipeline
node_pipeline -->|"loads binaries"| node_elf
node_pipeline -->|"disassembles"| node_disasm
node_pipeline -->|"detects mitigations"| node_mitigations
node_pipeline -->|"runs checks"| node_vuln
node_pipeline -->|"builds inventory"| node_inventory
node_pipeline -->|"checks filesystem"| node_hardening
node_pipeline -.->|"enriches findings"| node_decompile
node_pipeline -->|"assembles results"| node_report
node_vuln -->|"applies signatures"| node_rules
node_vuln -.->|"correlates CVEs"| node_cve_tool
node_report -->|"renders and exports"| node_formats
node_report -->|"persisted by service"| node_reportdb
node_ghidra -.->|"provides enrichment"| node_decompile

click node_web "https://github.com/cn0xroot/ifda/blob/main/service/main.go"
click node_api "https://github.com/cn0xroot/ifda/blob/main/service/api.go"
click node_auth "https://github.com/cn0xroot/ifda/blob/main/service/auth.go"
click node_jobs "https://github.com/cn0xroot/ifda/blob/main/service/job.go"
click node_jobstore "https://github.com/cn0xroot/ifda/blob/main/service/job.go"
click node_triage "https://github.com/cn0xroot/ifda/blob/main/service/triage.go"
click node_reportdb "https://github.com/cn0xroot/ifda/blob/main/service/reportdb.go"
click node_moria "https://github.com/cn0xroot/ifda/blob/main/ifda/ingest/__init__.py"
click node_cli "https://github.com/cn0xroot/ifda/blob/main/ifda/cli.py"
click node_pipeline "https://github.com/cn0xroot/ifda/blob/main/ifda/pipeline.py"
click node_elf "https://github.com/cn0xroot/ifda/blob/main/ifda/loader/elf.py"
click node_disasm "https://github.com/cn0xroot/ifda/blob/main/ifda/re/disasm.py"
click node_mitigations "https://github.com/cn0xroot/ifda/blob/main/ifda/re/mitigations.py"
click node_decompile "https://github.com/cn0xroot/ifda/blob/main/ifda/re/decompile.py"
click node_vuln "https://github.com/cn0xroot/ifda/tree/main/ifda/vuln"
click node_rules "https://github.com/cn0xroot/ifda/blob/main/ifda/rules/engine.py"
click node_inventory "https://github.com/cn0xroot/ifda/tree/main/ifda/inventory"
click node_hardening "https://github.com/cn0xroot/ifda/blob/main/ifda/fs/hardening.py"
click node_report "https://github.com/cn0xroot/ifda/blob/main/ifda/model.py"
click node_formats "https://github.com/cn0xroot/ifda/tree/main/ifda/report"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_web,node_api,node_auth,node_jobs,node_jobstore,node_triage,node_reportdb toneBlue
class node_moria,node_tree toneAmber
class node_cli,node_pipeline,node_elf,node_disasm,node_mitigations,node_decompile toneMint
class node_vuln,node_rules,node_inventory,node_hardening toneRose
class node_report,node_formats,node_analyst,node_raw,node_cve_tool,node_ghidra toneIndigo
```

## Components

### Service and jobs

- [Web UI](https://github.com/cn0xroot/ifda/blob/main/service/main.go): `service/main.go`
- [REST API](https://github.com/cn0xroot/ifda/blob/main/service/api.go): `service/api.go`
- [Session auth](https://github.com/cn0xroot/ifda/blob/main/service/auth.go): `service/auth.go`
- [Job queue and workers](https://github.com/cn0xroot/ifda/blob/main/service/job.go): `service/job.go`
- [Job history](https://github.com/cn0xroot/ifda/blob/main/service/job.go): `service/job.go`
- [Finding triage](https://github.com/cn0xroot/ifda/blob/main/service/triage.go): `service/triage.go`
- [Report store](https://github.com/cn0xroot/ifda/blob/main/service/reportdb.go): `service/reportdb.go`

### Firmware extraction

- [Identify and extract](https://github.com/cn0xroot/ifda/blob/main/ifda/ingest/__init__.py): `ifda/ingest/__init__.py`
- **Extracted firmware tree**

### Binary analysis

- [Python CLI](https://github.com/cn0xroot/ifda/blob/main/ifda/cli.py): `ifda/cli.py`
- [Analysis pipeline](https://github.com/cn0xroot/ifda/blob/main/ifda/pipeline.py): `ifda/pipeline.py`
- [ELF metadata and strings](https://github.com/cn0xroot/ifda/blob/main/ifda/loader/elf.py): `ifda/loader/elf.py`
- [Disassembly and call graph](https://github.com/cn0xroot/ifda/blob/main/ifda/re/disasm.py): `ifda/re/disasm.py`
- [Mitigation detection](https://github.com/cn0xroot/ifda/blob/main/ifda/re/mitigations.py): `ifda/re/mitigations.py`
- [Ghidra enrichment](https://github.com/cn0xroot/ifda/blob/main/ifda/re/decompile.py): `ifda/re/decompile.py`

### Findings and inventory

- [Vulnerability checks](https://github.com/cn0xroot/ifda/tree/main/ifda/vuln): `ifda/vuln`
- [Signature rules](https://github.com/cn0xroot/ifda/blob/main/ifda/rules/engine.py): `ifda/rules/engine.py`
- [Firmware inventory](https://github.com/cn0xroot/ifda/tree/main/ifda/inventory): `ifda/inventory`
- [Filesystem hardening](https://github.com/cn0xroot/ifda/blob/main/ifda/fs/hardening.py): `ifda/fs/hardening.py`

### Reports and results

- [Analysis report model](https://github.com/cn0xroot/ifda/blob/main/ifda/model.py): `ifda/model.py`
- [JSON, Markdown, SBOM](https://github.com/cn0xroot/ifda/tree/main/ifda/report): `ifda/report`

### Other components

- **Analyst**
- **Firmware image**
- **cve-bin-tool**
- **Ghidra**

## Connections

- Analyst → Web UI: uses
- Web UI → REST API: requests
- REST API → Session auth: checks sessions
- REST API → Job queue and workers: submits jobs
- Job queue and workers → Job history: persists jobs
- Job queue and workers → Python CLI: runs per job
- Job queue and workers → Report store: stores reports
- REST API → Finding triage: updates triage
- Firmware image → Identify and extract: identifies and extracts
- Identify and extract → Extracted firmware tree: writes extracted files
- Analyst → Python CLI: runs analysis
- Extracted firmware tree → Analysis pipeline: analyzes files
- Python CLI → Analysis pipeline: invokes
- Analysis pipeline → ELF metadata and strings: loads binaries
- Analysis pipeline → Disassembly and call graph: disassembles
- Analysis pipeline → Mitigation detection: detects mitigations
- Analysis pipeline → Vulnerability checks: runs checks
- Analysis pipeline → Firmware inventory: builds inventory
- Analysis pipeline → Filesystem hardening: checks filesystem
- Analysis pipeline → Ghidra enrichment: enriches findings
- Analysis pipeline → Analysis report model: assembles results
- Vulnerability checks → Signature rules: applies signatures
- Vulnerability checks → cve-bin-tool: correlates CVEs
- Analysis report model → JSON, Markdown, SBOM: renders and exports
- Analysis report model → Report store: persisted by service
- Ghidra → Ghidra enrichment: provides enrichment