Quokka Q-firm

Q-firm is a firmware security analysis product for Android devices. It analyzes the firmware and pre-installed, hidden, and privileged system applications that ship with Android devices to identify vulnerabilities and threats before devices are released to customers. The product combines multiple analysis techniques, including static (SAST), dynamic (DAST), interactive (IAST), and forced-path execution analysis, within a single workflow. It uses a flow-based vulnerability scanning engine to scan execution paths for escalation-of-privilege (EoP) vulnerabilities and privacy leaks, and inspects compiled binaries even when source code is unavailable or obfuscated. Q-firm generates software bills of materials (SBOMs) mapped to specific library versions to support vulnerability reporting, and flags behaviors such as data leakage, privilege escalation, malware abuse potential, and command-and-control activity. It validates firmware against industry standards including NIST, NIAP, and OWASP MASVS. The tool is intended to replace or supplement manual penetration testing for evaluating firmware across multiple device models, and results are reviewed by Quokka security experts who provide additional testing and reports with prioritized remediation recommendations. Q-firm can also test any device running Android OS, including Android-based IoT devices.