Firmwarehound

A dockerized tool for automated firmware analysis that identifies firmware formats, extracts embedded filesystems, and determines key characteristics such as target architecture, platform type, and system components.

Structured JSON output from an analyzed firmware image

Initial situation

Firmware is a central component of many embedded systems – from routers and IoT devices to industrial controllers. It is often delivered as a binary package without documentation or a standardized format. For security analyses, reverse engineering, or comparative studies, a structured analysis of such images is required. Currently, there is no generic tool that can automatically identify various firmware formats, analyze them, and extract basic information.

Project goal

To automatically analyze firmware, the underlying format must first be recognized – a challenge since firmware comes in very different forms (archives such as tar, gz, zip, or cpio; binary data for specific platforms as hex files; filesystems like ISO9660 or UDF) and often contains little or no metadata. The target platform can usually only be determined through indirect characteristics such as embedded ELF files or typical instruction patterns. The goal is to develop a dockerized tool for automated firmware image analysis that can recognize common firmware formats, identify contained filesystems, and extract them if necessary.

Solution developed and its benefits

Firmwarehound is a comprehensive, dockerized solution that automates the entire firmware analysis pipeline. The tool provides a modular architecture that supports extensible analyzers, detectors, and extractors to handle the diverse landscape of firmware formats.

• Automatic detection of firmware formats and container types
• Recursive extraction of nested archives and filesystems
• Architecture identification through ELF binary analysis
• Platform detection from embedded metadata
• Structured JSON output for integration with other tools
• Docker-based deployment for consistent and isolated execution
• Modular design allowing easy addition of new analyzers, detectors and extractors
• Configurable command-line interface
• Ability to analyze multiple firmware images in one run

The tool simplifies firmware analysis by eliminating manual format identification and extraction steps. Users can quickly gain insights into firmware composition, understand the internal structure, and compare firmware versions across different devices.

By providing consistent, reproducible analysis results in a standardized format, Firmwarehound enables automated analysis workflows and facilitates further research.

Key terms

• FirmwareSoftware embedded in hardware devices that provides low-level control
• FilesystemMethod of organizing and storing files (e.g., SquashFS, JFFS2, UBIFS)
• ELFExecutable and Linkable Format – standard binary format for executables on Unix systems
• ArchitectureTarget CPU instruction set (ARM, MIPS, x86, PowerPC, etc.)
• DockerContainerization platform for consistent deployment environments
• Reverse EngineeringProcess of analyzing software to understand its structure and behavior

Customer

Internal FHNW Project
Institute for Mobile and Distributed Systems (IMVS)
University of Applied Sciences Northwestern Switzerland
Bahnhofstrasse 6
5210 Windisch
IMVS Website

Team