Ffind

Identify file types and extract ext2/3/4 or F2FS filesystems from firmware images.

Updated Nov 23, 2025
One-click install
npx skills add https://github.com/consigcody94/bounty-buddy --skill ffind-consigcody94
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: Ffind
Source: https://github.com/consigcody94/bounty-buddy/tree/main/.claude/skills/ffind
Command: npx skills add https://github.com/consigcody94/bounty-buddy --skill ffind-consigcody94

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires e2fsprogs, f2fs-tools, util-linux.

What problem does it solve?

Analyzing firmware images and extracting embedded filesystems is a critical but often manual and complex step in IoT security research. This skill automates the identification of file types and the extraction of common Linux filesystems from firmware, streamlining the reverse engineering process.

Core Features & Use Cases

  • Advanced File Type Detection: Automatically identifies various file types within a given path or firmware image.
  • Filesystem Extraction: Extracts ext2/3/4 and F2FS filesystems for deeper offline analysis.
  • Use Case: Analyze a downloaded IoT device firmware image to automatically extract its root filesystem, allowing you to browse its contents, identify configuration files, and search for hardcoded credentials without needing physical access to the device.

Quick Start

Use the Ffind skill to extract all filesystems from the firmware image located at '/path/to/firmware.bin'.

Frequently Asked Questions about Ffind

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract filesystems from firmware images?

Ffind extracts embedded ext2/3/4 and F2FS filesystems from firmware binaries and IoT device images. Use the -e flag to extract, -d to specify the output directory, and invoke ffind from the iothackbot bin directory. Extraction requires sudo access.

Can I identify file types within a firmware binary before extraction?

Yes, Ffind analyzes firmware inputs to automatically identify embedded file types without extraction. Use the -a flag to show all detected types and -v for verbose output. Results display as text, JSON, or quiet format.

What filesystems does Ffind support for extraction?

Ffind extracts ext2/3/4 and F2FS filesystems from firmware images. The tool depends on e2fsprogs and f2fs-tools to handle these Linux filesystem formats commonly found in IoT and embedded device firmware.

Do I need special tools to extract IoT device firmware filesystems?

Ffind requires e2fsprogs, f2fs-tools, and util-linux as dependencies to identify and extract Linux filesystems from firmware. These tools automate what would otherwise be manual reverse engineering of embedded device images.

Why extract firmware filesystems instead of analyzing the binary directly?

Extracting filesystems allows offline analysis of configuration files, binaries, and hardcoded credentials without physical device access. Ffind streamlines this critical step in IoT security research by automating identification and extraction.

Can Ffind handle multiple firmware images or bundles at once?

Yes, Ffind accepts one or more firmware inputs and analyzes each to identify artifact types and extract filesystems. Use the -d flag to organize extracted outputs from multiple images into separate directories.