FACT

Spec sheet

Purpose

FACT automates firmware security analysis for devices such as routers, IoT equipment, UEFI systems, webcams, and drones.Read 8 Oct 2026 · fkie-cad.github.io

Security

The maintainers caution that FACT is not intended as a public internet service and that its web interface is not hardened; they recommend resetting passwords before use on networks that are not fully trusted.Read 8 Oct 2026 · github.com

License

FACT is free software under GPL version 3 or, at the user's option, any later version; some plugins may use different licenses.Read 8 Oct 2026 · github.com

Analysis

It identifies software, versions, boot services, known CVEs, hard-coded credentials, cryptographic material, CPU architecture, and potential implementation flaws.Read 8 Oct 2026 · fkie-cad.github.io

Authentication

FACT offers optional basic authentication, roles, and user management.Read 8 Oct 2026 · github.com

Comparison

FACT can identify changed or equal files and changed software versions between firmware images.Read 8 Oct 2026 · fkie-cad.github.io

Extensibility

Extractors, analysis features, and comparison functions are implemented as plugins, and additional plugins can be added to a local installation.Read 8 Oct 2026 · fkie-cad.github.io

Firmware extraction

FACT automates identifying firmware container formats and unpacking firmware layers.Read 8 Oct 2026 · fkie-cad.github.io

Integration

FACT provides a REST API covering almost all of its features.Read 8 Oct 2026 · fkie-cad.github.io

Interface

The product provides a browser-based interface for browsing firmware components and navigating analysis results.Read 8 Oct 2026 · github.com

Limitations

The repository describes FACT as a research prototype, and says its Dockerized version is currently unmaintained.Read 8 Oct 2026 · github.com

Maker and funding

FACT is developed by Fraunhofer FKIE and the FACT community, with partial funding from Germany's Federal Office for Information Security and others.Read 8 Oct 2026 · fkie-cad.github.io

Requirements

The documented minimum system requirements are 4 CPU cores, 8 GB RAM, and 10 GB disk space, with additional disk space needed for extracted files and analysis results.Read 8 Oct 2026 · github.com

Search

FACT stores firmware files and analysis results in a searchable database that supports searching byte patterns in unpacked files.Read 8 Oct 2026 · fkie-cad.github.io

Supported systems

The installer lists Debian 13 and Ubuntu 22.04, 24.04, and 26.04 as stable, with Kali support marked experimental.Read 8 Oct 2026 · github.com

Plans and prices

Every FACT plan and price →

Where Specifiction places it

• Reverse Engineering Tools#15 of 738.0