moria

moria identifies files and the structures embedded inside firmware and IoT images (filesystems, kernels, bootloaders, archives, keys) and unpacks most of what it finds, without root. It reports each finding with a byte offset, a type, and a confidence score, and it speaks clean JSON so scripts and LLM agents can drive it as easily as people can.

Good for:

• Extracting a broad set of filesystems in-process, without sudo: SquashFS, ext2/3/4, F2FS, XFS, btrfs, HFS+, NTFS, EROFS, JFFS2, UBIFS, and more.
• Recursive unpacking by default — a gzip-wrapped SquashFS inside a UBI volume unpacks all the way down.
• Identification-first triage: a readable tree by default, JSON (-j) for tools, with offsets and confidence on every finding.

Notes: Deterministic — the same input always produces the same output, with no random tie-break in conflict resolution. Safe on hostile input: every read is bounds-checked, every write goes through openat + O_NOFOLLOW (no path-traversal or symlink escape), and decompression is bounded against bombs. moria maps the bytes; its semantic companion mithril reads the contents. Created by Matt Brown, who demos both tools here.