Avatar² vs CFR

Avatar² is a free Python framework for dynamic analysis of embedded-device firmware. It coordinates targets, memory layouts and execution plans so firmware execution can be divided across multiple targets. Targets communicate through protocols with emulators, analysis frameworks or physical devices. The handbook documents GDB, OpenOCD, J-Link, QEMU and PANDA targets. OpenOCDTarget connects to physical targets over JTAG, while JLinkTarget supports SWD and JTAG. PANDA support includes recording and replaying execution and managing analysis plugins. Memory layouts define regions and rules for forwarding reads and writes between targets. The project documents installation through pip, from source or in Docker, where QEMU and PANDA are the defaults. It lists Linux support and ARM Cortex-M3 and x86-64 architectures. The README provides target build scripts for Ubuntu 20.04; other distributions are not officially supported, though they may work with modifications. The project uses the Apache-2.0 license and is maintained by EURECOM's Software and System Security Group. Maintainers direct users to a public mailing list and an invite-based Slack community.

CFR is a free Java decompiler that reconstructs Java source from Java class files. It can process individual named classes, classes found on a classpath, or a whole JAR, and the command-line tool can place output in a chosen directory with the --outputdir option. Decompilation behavior can be adjusted through command-line options or an options file. The maker says CFR handles many features from Java 9, 12, and 14, and it can attempt class files from other JVM languages; those are rendered as Java rather than their original language. CFR is written in Java 6 and is said to run wherever Java 6 does. It is available as a downloadable JAR, through Maven, and from GitHub. The FAQ notes an API from version 0.135, and the project repository identifies the license as MIT. CFR handles bytecode rather than native code. Its maker also notes that some inputs fall into edge cases where output may be poor. There are no paid plans or usage limits stated.