Why convert FAP to ELF?
People move to .elf to disassemble, debug, or reverse-engineer a Flipper Zero application, because ELF is the format every binutils and disassembler tool understands. FAP files are built as ARM ELF executables that the Flipper App Loader copies to RAM and relocates at runtime, so the underlying ELF structure is already there.
How to convert FAP to ELF
readelf
Run readelf -a app.fap to dump the ELF headers, sections, and symbols directly; no conversion is needed since FAP already carries ELF structure.
arm-none-eabi-objdump
Disassemble the ARM Thumb code with arm-none-eabi-objdump -d -Mthumb app.fap to view the assembly of each function.
Ghidra
Copy the file to app.elf and import it into Ghidra, choosing the ARM Cortex little-endian language, for a full decompilation and analysis workspace.
About these formats
A .fap file is a Flipper Application Package, an app built for the Flipper Zero multi-tool. It is an ELF executable for the device's ARM Cortex-M4 MCU with Flipper-specific metadata, an…
Open .FAP details →An ELF file is the binary executable format used by Linux, Android, the BSDs and most Unix-like systems - the equivalent of Windows EXE. On Linux you run it directly; a PS2 homebrew .elf…
Open .ELF details →Quality & what to watch
- A
.fapbundles Flipper-specific metadata and image assets on top of the ELF, so it is not a clean standalone system ELF. - The code is position-independent and relocated by the App Loader at load time, so raw addresses in a static dump are not the final runtime addresses.
- It targets the Flipper's ARM Cortex-M4 core, so you must select ARM/Thumb settings for the disassembly to make sense.
Frequently asked questions
Do I actually need to convert a .fap to .elf?
.elf is only for convenience with GUI tools like Ghidra.