Ffind

Detect artifact file types and extract ext2/3/4 or F2FS filesystems from firmware images.

811|123|Updated Nov 17, 2025
One-click install
npx skills add https://github.com/BrownFineSecurity/iothackbot --skill ffind
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: Ffind
Source: https://github.com/BrownFineSecurity/iothackbot/tree/main/.claude/skills/ffind
Command: npx skills add https://github.com/BrownFineSecurity/iothackbot --skill ffind

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires e2fsprogs, f2fs-tools, util-linux.

What problem does it solve?

This Skill simplifies complex firmware analysis by automatically identifying various file types and extracting embedded filesystems. It eliminates the manual effort of dissecting binary blobs, allowing for quicker discovery of critical configuration files, executables, and potentially vulnerable components within IoT firmware.

Core Features & Use Cases

  • Advanced File Type Detection: Automatically identifies relevant file types (artifacts) within firmware images or directories.
  • Filesystem Extraction: Extracts common embedded filesystems like ext2/3/4 and F2FS for in-depth offline analysis.
  • Security-Focused Analysis: Prioritizes file types relevant to security assessments, such as executables, configuration files, and scripts.
  • Use Case: Analyze a downloaded IoT device firmware image, automatically extract its root filesystem, and then browse the extracted files to look for hardcoded credentials or insecure configurations.

Quick Start

Use the ffind skill to analyze the firmware image located at /path/to/my_iot_firmware.bin and extract any embedded filesystems for further inspection.

Frequently Asked Questions about Ffind

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract filesystems from firmware images?

Firmware extraction identifies and extracts embedded filesystems like ext2/3/4 and F2FS from binary firmware images. Ffind automates this by detecting file types within the firmware, then extracts matching filesystems to a specified directory for offline analysis of configuration files, executables, and other artifacts.

What file types can ffind detect in IoT device firmware?

File type detection in firmware analysis identifies embedded artifacts relevant to security assessment, including executables, configuration files, scripts, and filesystem headers. Ffind automatically scans firmware binaries and directories to locate these types without manual dissection of binary blobs.

Can I extract ext4 and F2FS filesystems from a single firmware image?

Filesystem extraction supports both ext2/3/4 and F2FS formats within the same firmware image. Ffind identifies all detected filesystems and extracts them with optional sudo elevation, allowing comprehensive analysis of multiple embedded filesystem types in one operation.

Do I need elevated permissions to extract firmware filesystems?

Filesystem extraction with ffind includes optional sudo support for operations requiring elevated permissions. The Skill handles extraction to a default timestamped directory in /tmp or to a custom directory you specify, managing permission requirements as needed.

What output formats does firmware analysis provide?

Analysis output formats include text, JSON, and quiet modes, allowing integration with automation workflows or detailed reporting. Ffind returns file type detection results and extraction metadata in your chosen format for downstream processing or security assessment documentation.