mcpField
F
ffind

ffind

github.com/brownfinesecuritySecurity87547 installsUpdated 21w ago
Repository

About ffind

ffind is a skill for locating and analyzing file types in files and directories, designed for firmware and IoT security analysis. It can identify artifact types and extract ext2/3/4 or F2FS filesystems, with text, JSON, and quiet output formats.

Key features

  1. 01Identify file types in files and directories
  2. 02Extract ext2/3/4 and F2FS filesystems
  3. 03Show security-relevant artifact types
  4. 04Text, JSON, and quiet output

Use cases

  1. 01Inspect file types in a firmware image
  2. 02Extract filesystems for deeper analysis
  3. 03Find security artifacts across multiple files

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/brownfinesecurity/iothackbot --skill ffind

After installing, type/ffindin Claude Code to confirm it loaded.

Details

From the project README

Ffind - Advanced File Finder with Extraction

You are helping the user find and analyze files with advanced type detection and optional filesystem extraction capabilities using the ffind tool.

Tool Overview

Ffind analyzes files and directories, identifies file types, and can extract filesystems (ext2/3/4, F2FS) for deeper analysis. It's designed for firmware and IoT device analysis.

Instructions

When the user asks to analyze files, find specific file types, or extract filesystems:

  1. Understand the target:

    • Ask what path(s) they want to analyze
    • Determine if they want to extract filesystems or just analyze
    • Ask if they want all file types or just artifact types

  2. Execute the analysis:

    • Use the ffind command from the iothackbot bin directory
    • Basic usage: ffind <path> [<path2> ...]
    • To extract filesystems: ffind <path> -e
    • Custom extraction directory: ffind <path> -e -d /path/to/output
    • Show all file types: ffind <path> -a
    • Verbose output: ffind <path> -v

  3. Output formats:

    • --format text (default): Human-readable colored output with type summaries
    • --format json: Machine-readable JSON
    • --format quiet: Minimal output

  4. Extraction capabilities:

    • Supports ext2/ext3/ext4 filesystems (requires e2fsprogs)
    • Supports F2FS filesystems (requires f2fs-tools)
    • Requires sudo privileges for extraction
    • Default extraction location: /tmp/ffind_<timestamp>

Examples

Analyze a firmware file to see file types:

ffind /path/to/firmware.bin

Extract all filesystems from a firmware image:

sudo ffind /path/to/firmware.bin -e

Analyze multiple files and show all types:

ffind /path/to/file1.bin /path/to/file2.bin -a

Extract to a custom directory:

sudo ffind /path/to/firmware.bin -e -d /tmp/my-extraction

Important Notes

  • Name collision: The Sleuth Kit also ships a ffind (it finds file names for a given inode and takes a disk image plus an inode number). If which ffind points at /usr/bin/ffind or /usr/local/bin/ffind, the iothackbot flags below (-e, -d <dir>, -a, --format) will be misread by the wrong binary. Confirm with ffind --help (the iothackbot tool shows --extract/--format); if it shows image inode usage, invoke the iothackbot tool by its full path in the repo bin/ directory instead.
  • Extraction requires root/sudo privileges
  • Requires external tools: e2fsprogs, f2fs-tools, util-linux
  • Identifies "artifact" file types relevant to security analysis by default
  • Use -a flag to see all file types including common formats

Comments

Markdown supported