[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-96173":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":13,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":14,"stars7d":14,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":14,"compositeScore":16,"rankGlobal":9,"rankLanguage":9,"license":17,"archived":18,"fork":18,"defaultBranch":19,"hasWiki":20,"hasPages":18,"topics":21,"createdAt":9,"pushedAt":9,"updatedAt":22,"readmeContent":23,"aiSummary":24,"trendingCount":14,"starSnapshotCount":14,"syncStatus":25,"lastSyncTime":26,"discoverSource":27},96173,"moria","nmatt0\u002Fmoria","nmatt0","IoT firmware identification and extraction",null,"C++",144,18,1,0,27,46.54,"MIT License",false,"master",true,[],"2026-09-20 04:01:32","# moria\n\n**IoT firmware identification and extraction**\n\nmoria identifies files and the structures embedded inside firmware and IoT images (filesystems, kernels, bootloaders, archives, keys) and unpacks most of what it finds, without root. It reports each finding with a byte offset, a type, and a confidence score, and it speaks clean JSON so scripts and LLM agents can drive it as easily as people can.\n\n## Why moria\n\n- **Extracts a broad set of filesystems in-process, without sudo:** SquashFS, ext2\u002F3\u002F4, F2FS, XFS, btrfs, HFS+, NTFS, EROFS, JFFS2, UBIFS, and more.\n- **Recursive by default.** A gzip-wrapped SquashFS inside a UBI volume unpacks all the way down.\n- **Deterministic.** The same input always produces the same output; conflict resolution has no random tie-break.\n- **Safe on hostile input.** Every read is bounds-checked, every write goes through `openat` + `O_NOFOLLOW` (no path-traversal or symlink escape), and decompression is bounded against bombs.\n- **Identification-first.** A readable tree by default, JSON (`-j`) for tools, with offsets and confidence on every finding.\n\n## Build & Install\n\n```\ncmake -S . -B build -DCMAKE_BUILD_TYPE=Release\ncmake --build build -j\ncmake --install build --prefix ~\u002F.local     # or \u002Fusr\u002Flocal (needs sudo)\n```\n\nBuild needs `cmake`, a C++20 compiler, and the zlib, liblzma, lz4, and zstd development libraries (the decompressors used by `--extract`). On Debian\u002FUbuntu: `sudo apt install cmake g++ zlib1g-dev liblzma-dev liblz4-dev libzstd-dev`. To build without one (a minimal or identify-only build), configure with `-DMORIA_OPTIONAL_CODECS=ON` and the missing codec is simply disabled.\n\nThe `moria` binary is **self-contained**: all signature sets are embedded at build time, so the binary works anywhere with nothing installed alongside it (`cp build\u002Fmoria ~\u002F.local\u002Fbin` is enough, and a downloaded release binary just runs). To use external signatures instead of the embedded ones (to test a new `.toml` without rebuilding, say), pass `--sigs DIR` or set `$MORIA_SIGDIR`.\n\n## Usage\n\nOutput is human-readable by default. Pass `-j` for JSON.\n\n```\nmoria \u003Cfile>              # identify: a findings tree with offsets, types, and confidence\nmoria \u003Cdir>               # scan a tree: a type summary plus the notable files\nmoria -j \u003Cfile>           # JSON, for tools and agents\nmoria -e \u003Cfile>           # extract to \u003Cfile>.extracted\u002F   (-C DIR to choose the output dir)\nmoria -c \u003Cfile>           # carve raw byte ranges to \u003Cfile>.carved\u002F (no parsing)\nmoria -E \u003Cfile>           # entropy pass: flag unidentified \u002F possibly-encrypted regions\nmoria --list \u003Carchive>    # list tar\u002Fcpio\u002Fzip members without extracting\nmoria --broad \u003Cpath>      # also load the ~2.5k general file-type signatures\nmoria --help\n```\n\n## Extraction\n\n`-e` unpacks recognized formats under `\u003Cfile>.extracted\u002F`, one directory per region (`0x\u003Coffset>-\u003Ctype>\u002F`), plus a `manifest.json` mapping offsets to paths. It recurses into nested containers automatically and rebuilds UBI images volume by volume. Guards (`--depth`, `--max-files`, `--max-bytes`, and a decompression-ratio cap) bound hostile input; a tripped guard stops that branch and still returns everything recovered.\n\nUnpacked in-process, no external tools and no sudo:\n\n- **Filesystems:** SquashFS, ext2\u002F3\u002F4, F2FS, FAT12\u002F16\u002F32, exFAT, NTFS, HFS+\u002FHFSX, XFS, btrfs, JFFS2, UBI\u002FUBIFS, romfs, YAFFS2, cramfs, EROFS\n- **Archives and images:** ZIP, tar, cpio, ISO 9660, Android sparse, Android boot\n- **Kernels and wrappers:** U-Boot uImage, U-Boot FIT, standalone gzip \u002F xz \u002F zstd \u002F lz4 streams\n- **Firmware packages:** RAE Systems \u002F Honeywell RFP (section table; LZARI-decompresses each section)\n\n## Signatures\n\n- `signatures\u002F` is the hand-written core: firmware filesystems, containers, kernels, and common formats, each with structural validation.\n- `signatures-firmware\u002F` holds vendor firmware-container magics and loads by default.\n- `signatures-generated\u002F` holds ~2.5k general file-type magics derived from `file(1)`'s magic database and loads only with `--broad`.\n\nTo add a format, drop a `.toml` in `signatures\u002F`. A small C++ validator is only needed for checks the declarative layer can't express, such as CRCs or cross-block pointers.\n\n## Scope\n\nmoria does structural identification, extraction, and carving. Secret\u002Fcredential scanning, SBOM, CVE, and license analysis are a separate tool ([mithril](https:\u002F\u002Fgithub.com\u002Fnmatt0\u002Fmithril)).\n\n## License\n\nMIT, see `LICENSE`. Third-party code and derived-data licenses are listed in `THIRD_PARTY.md`.\n","moria 是一款用于嵌入式物联网固件识别与提取的命令行工具。它能在无 root 权限下，通过内建签名库精准定位固件镜像中的文件系统（如 SquashFS、ext4、UBIFS、JFFS2 等）、内核、引导程序、压缩包及密钥等结构，并支持递归解包、偏移定位、置信度评分和安全边界控制；输出支持可读树状视图与标准 JSON 格式，便于自动化集成与分析。适用于固件逆向分析、IoT 安全审计、二进制供应链审查及嵌入式设备取证等场景。",2,"2026-09-11 02:30:11","CREATED_QUERY"]