[GH-ISSUE #44] Add firmware, embedded-system, and filesystem-image analysis #33

New issue

Closed

opened 2026-10-15 18:20:14 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-15 18:20:14 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/44

Goal

Support offline investigation of firmware and embedded-system artifacts as graphs of containers, filesystems, executables, configuration, and hardware-facing behavior.

Scope

raw firmware images, update packages, bootloaders, kernels, and filesystem images
ELF binaries across common embedded architectures
UEFI and device firmware metadata
SquashFS, cramfs, ext, FAT, CPIO, and vendor container discovery
entropy, compression, encryption, signatures, checksums, and partition maps
configuration, certificates, endpoints, init systems, services, and update logic
optional integrations with binwalk, Ghidra, Rizin, QEMU, and architecture toolchains

Safety

Default to offline, read-only extraction and static inspection.
Contain recursive extraction and enforce depth, size, and file-count budgets.
Treat emulation, hardware access, flashing, and network interaction as separate approval-gated capabilities.
Preserve parent-child hashes and exact extraction provenance.

Acceptance criteria

Representative firmware fixtures yield deterministic nested artifact graphs.
Architecture, filesystems, executables, services, and high-value configuration are discoverable.
Recursive extraction cannot escape its output root or exhaust unbounded resources.
Unsupported formats and encrypted regions remain explicit residual unknowns.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/44 ## Goal Support offline investigation of firmware and embedded-system artifacts as graphs of containers, filesystems, executables, configuration, and hardware-facing behavior. ## Scope - raw firmware images, update packages, bootloaders, kernels, and filesystem images - ELF binaries across common embedded architectures - UEFI and device firmware metadata - SquashFS, cramfs, ext, FAT, CPIO, and vendor container discovery - entropy, compression, encryption, signatures, checksums, and partition maps - configuration, certificates, endpoints, init systems, services, and update logic - optional integrations with binwalk, Ghidra, Rizin, QEMU, and architecture toolchains ## Safety - Default to offline, read-only extraction and static inspection. - Contain recursive extraction and enforce depth, size, and file-count budgets. - Treat emulation, hardware access, flashing, and network interaction as separate approval-gated capabilities. - Preserve parent-child hashes and exact extraction provenance. ## Acceptance criteria - Representative firmware fixtures yield deterministic nested artifact graphs. - Architecture, filesystems, executables, services, and high-value configuration are discoverable. - Recursive extraction cannot escape its output root or exhaust unbounded resources. - Unsupported formats and encrypted regions remain explicit residual unknowns.

bsakaguchi

2026-10-15 18:20:14 +00:00

closed this issue
added the
area: domain

roadmap

enhancement

P2: medium
labels

bsakaguchi commented

2026-10-15 18:20:15 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

Split into focused child issues:

#370

These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

@morluto commented on GitHub (Jul 20, 2026): Split into focused child issues: - [ ] #370 These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

bsakaguchi commented

2026-10-15 18:20:16 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

Closing as out of scope / premature for the current local CLI/MCP reverse-engineering focus: no supporting code exists, and these areas should be revisited only after in-tree providers and the public boundary are stable.

@morluto commented on GitHub (Jul 20, 2026): Closing as out of scope / premature for the current local CLI/MCP reverse-engineering focus: no supporting code exists, and these areas should be revisited only after in-tree providers and the public boundary are stable.

bsakaguchi referenced this issue

2026-10-15 18:28:29 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:06:10 +00:00

[GH-ISSUE #3875] [Bug] Mach-O object file's unnamed segment is reported with the name "unknown" #1496

bsakaguchi referenced this issue

2026-10-16 21:11:17 +00:00

[PR #46] [MERGED] Evolve REA into an evidence-backed analysis platform #1811

bsakaguchi added

enhancement

and removed