Pyrrha is a firmware cartography tool which provide three level of details:
- an overview of the import/export relationships between executables;
- a firmware-wide callgraph;
- a complete map of a given decompiled binary.
It uses the open-source code source explorer NumbatUI to provide users with an easy way to navigate through and search for path to function.
An example of the symbols and libraries imported by libgcc_s.so.1 and of the symbols which reference this library.
An example of the symlinks which point on busybox.
The installation is done in two parts:
- Install
Pyrrhaitself. - Install
NumbatUI(orSourcetrail) to be able to visualize Pyrrha's results. - (Optional) Install Ghidra or IDA if you want to use
fs-cgordecompmappers.
Note
A quick start installation is available on Pyrrha documentation.
The usage workflow is composed of two steps which allow you to separate DB creation and result visualization.
- Run Pyrrha to obtain NumbatUI compatible files (
*.srctrlprjfor the project file and*.srctrldbfor the DB file). With the python package, you can just launch the commandpyrrha. - Visualize your results with Sourcetrail/NumbatUI.
Note
The detailed documentation of each mapper is available in the documentation.
Pyrrha presentations, including live demos:
-
Pyrrha & Friends: Diving into Firmware Cartography, Eloïse Brocas & Robin David, SSTIC, Rennes, France, 2025. [slides] [video]
-
Pyrrha: navigate easily into your system binaries, Eloïse Brocas, Hack.lu, Luxembourg, 2023. [slides] [video]
-
Map your Firmware!, Eloïse Brocas, Pass The SALT, Lille, France, 2023. [slides] [video]
Theory behind implementations
- Streamlining Firmware Analysis with Inter-Image Call Graphs and Decompilation, Robin David, RE//verse.io, USA, 2025. [slides] [video]
- Eloïse Brocas (@ebrocas), Quarkslab
- Robin David (@RobinDavid), Quarkslab
- Pascal Wu (@pwu42), during his internship at Quarkslab