跳到正文
cccskills
免费在 GitHub 公开

ffind

Advanced file finder with type detection and filesystem extraction for analyzing firmware and extracting embedded filesystems. Use when you need to analyze firmware files, identify file types, or extract ext2/3/4 or F2FS filesystems.

中文简介正在准备中。当前显示原文说明。

查看安装方法

包含的文件(1)

  • SKILL.md2.8 KB

SKILL.md(原文)

安装前可以查看交给 AI 代理的指令内容。

Ffind - Advanced File Finder with Extraction

You are helping the user find and analyze files with advanced type detection and optional filesystem extraction capabilities using the ffind tool.

Tool Overview

Ffind analyzes files and directories, identifies file types, and can extract filesystems (ext2/3/4, F2FS) for deeper analysis. It's designed for firmware and IoT device analysis.

Instructions

When the user asks to analyze files, find specific file types, or extract filesystems:

  1. Understand the target:

    • Ask what path(s) they want to analyze
    • Determine if they want to extract filesystems or just analyze
    • Ask if they want all file types or just artifact types
  2. Execute the analysis:

    • Use the ffind command from the iothackbot bin directory
    • Basic usage: ffind <path> [<path2> ...]
    • To extract filesystems: ffind <path> -e
    • Custom extraction directory: ffind <path> -e -d /path/to/output
    • Show all file types: ffind <path> -a
    • Verbose output: ffind <path> -v
  3. Output formats:

    • --format text (default): Human-readable colored output with type summaries
    • --format json: Machine-readable JSON
    • --format quiet: Minimal output
  4. Extraction capabilities:

    • Supports ext2/ext3/ext4 filesystems (requires e2fsprogs)
    • Supports F2FS filesystems (requires f2fs-tools)
    • Requires sudo privileges for extraction
    • Default extraction location: /tmp/ffind_<timestamp>

Examples

Analyze a firmware file to see file types:

ffind /path/to/firmware.bin

Extract all filesystems from a firmware image:

sudo ffind /path/to/firmware.bin -e

Analyze multiple files and show all types:

ffind /path/to/file1.bin /path/to/file2.bin -a

Extract to a custom directory:

sudo ffind /path/to/firmware.bin -e -d /tmp/my-extraction

Important Notes

  • Name collision: The Sleuth Kit also ships a ffind (it finds file names for a given inode and takes a disk image plus an inode number). If which ffind points at /usr/bin/ffind or /usr/local/bin/ffind, the iothackbot flags below (-e, -d <dir>, -a, --format) will be misread by the wrong binary. Confirm with ffind --help (the iothackbot tool shows --extract/--format); if it shows image inode usage, invoke the iothackbot tool by its full path in the repo bin/ directory instead.
  • Extraction requires root/sudo privileges
  • Requires external tools: e2fsprogs, f2fs-tools, util-linux
  • Identifies "artifact" file types relevant to security analysis by default
  • Use -a flag to see all file types including common formats

评价

还没有评价。欢迎分享你的使用感受。

评论

无需登录即可发表。欢迎分享使用感受、提问,或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

提交后会立即公开。请勿填写邮箱、电话等个人信息。URL 最多 2 个。

0 / 1000 字

此表单受 reCAPTCHA 保护,适用 Google 的隐私权政策和服务条款。

同一仓库的技能

apktool

免费

Android APK unpacking and resource extraction tool for reverse engineering. Use when you need to decode APK files, extract resources, examine AndroidManifest.xml, analyze smali code, or repackage modified APKs.

中文简介正在准备中。当前显示原文说明。

BrownFineSecurity/iothackbot8652026年6月1日 更新

chipsec

免费

Static analysis of UEFI/BIOS firmware dumps using Intel's chipsec framework. Decode firmware structure, detect known malware and rootkits (LoJax, ThinkPwn, HackingTeam, MosaicRegressor), generate EFI executable inventories with hashes, extract NVRAM variables, and parse SPI flash descriptors. Use when analyzing firmware .bin/.rom/.fd/.cap files offline without requiring hardware access.

中文简介正在准备中。当前显示原文说明。

BrownFineSecurity/iothackbot8652026年6月1日 更新

iotnet

免费

IoT network traffic analyzer for detecting IoT protocols and identifying security vulnerabilities in network communications. Use when you need to analyze network traffic, identify IoT protocols, or assess network security of IoT devices.

中文简介正在准备中。当前显示原文说明。

BrownFineSecurity/iothackbot8652026年6月1日 更新

jadx

免费

Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze app logic, search for vulnerabilities, find hardcoded credentials, or understand app behavior through readable source code.

中文简介正在准备中。当前显示原文说明。

BrownFineSecurity/iothackbot8652026年6月1日 更新

jtagprobe

免费

Probe IoT/embedded targets for exposed SWD/JTAG debug interfaces using a SEGGER J-Link. Detects whether debug is OPEN, LOCKED (readout-protected), or DEAD (fused off). Use when assessing whether a target's on-chip debug port can be reached, identifying the silicon vendor from DPIDR/IDCODE, and confirming halt+memory access for full debugger control.

中文简介正在准备中。当前显示原文说明。

BrownFineSecurity/iothackbot8652026年6月1日 更新

logicmso

免费

Analyze digital and analog captures from Saleae Logic MSO devices. Decode protocols like UART, SPI, I2C from exported binary files. Use when analyzing logic analyzer captures for CTF challenges, hardware reverse engineering, or protocol decoding.

中文简介正在准备中。当前显示原文说明。

BrownFineSecurity/iothackbot8652026年6月1日 更新

查看 BrownFineSecurity 的全部技能

报告此技能的问题