FAT 2.1.0

FAT 2.1.0

FAT 2.1.0 adds external campaign evidence, scriptable decompilation, and Cargo installation paths, alongside BMC inspection and native JFFS2 recovery.

Install

Prebuilt archives remain the default: download the archive for your operating system and CPU, verify its adjacent SHA-256 checksum, and keep the executable and share directory together.

Cargo is now a supported path:

cargo binstall firmware-analysis-toolkit
cargo install --locked firmware-analysis-toolkit
fat data install --release
fat doctor

cargo install compiles the dependency tree and needs Rust 1.91 or newer plus a C compiler.
Both Cargo paths install only the fat executable, so fat data install --release downloads and verifies the runtime-data bundle for the installed version.
The CLI carries cargo binstall metadata for these archives, so the prebuilt path does not compile anything.

On Arch Linux or Omarchy, the source installer still handles system packages and optional tools.

External campaign evidence

fat experiment external records bounded work performed by an external engine.
The manifest pins setup artifacts and retained evidence by SHA-256, each case names one exact input, argv vector, timeout, and accepted exit codes, and cleanup is declared and executed with its own timeout.
validate checks the whole contract before execution, and run stores the input, logs, outcome, and cleanup result in the existing FAT session and artifact model so the replay can be audited later.

Decompilation scripts

fat decompile --script applies repeatable r2 scripts after analysis and before pdg, so afn, afvn, and CC renames and comments reach the emitted pseudocode.
Script failures report the script path and line, and r2ghidra's install hint is reported as an error instead of being written as pseudocode.

BMC and firmware extraction

• inspect bmc reports raw flash layout, FIT authentication metadata, located BMC markers, and CRC-validated U-Boot environments with text, JSON, and SARIF output.
• Hash-pinned BMC profiles cover native full-flash and vendor-kernel boot, with verified FIT kernel, DTB, and initramfs assets, explicit DTB adaptations, private snapshot flash, and fresh loopback Redfish readiness observations.
• debug redfish-session tests session creation, ReadOnly cross-account denial, an administrator positive control, target restoration, and token revocation on an emulated BMC.
• debug process attaches userspace GDB over an owned temporary SSH forward and records process identity, detach, and cleanup results.
• Native JFFS2 reconstruction validates node and data CRCs, applies inode versions and dirent deletions, and preserves per-artifact failures.
• Gzip outputs use artifact-ID/format directories instead of implying a kernel role, and raw bootloader assignments stay separate from validated environments and emulation inputs.

Tooling

• The source installer uses binwalk-ng 4.0.0, installs Sasquatch and lzop, and the minimum supported Rust version is 1.91.
• FAT is published on crates.io as firmware-analysis-toolkit; the fat-toolkit-* crates are its dependencies and only fat-toolkit-plugin-api is a supported library API.

Upgrade from 2.0.1

Install the fat-data-2.1.0.zip bundle that accompanies this release; fat data install --release selects it automatically for a 2.1.0 executable.
Existing FAT 2.0.1 projects continue to load.

Full details are in the changelog and the installation guide.