What problem does it solve? After unpacking a firmware image, analysts face a full root filesystem with dozens of binaries and no clear starting point. This Skill provides a systematic static-analysis workflow for firmware rootfs: mounting or extracting filesystem images, reading startup scripts to find the main program, mining configuration files for hardcoded credentials and keys, and identifying cross-architecture ELF binaries. ## Core Features & Use Cases - Filesystem Extraction: Unpack squashfs, cramfs, cpio initramfs, ext images, and generic containers using unsquashfs, cramfsck, 7z, or loop mounts. - Startup & Config Analysis: Read inittab, rcS, and init.d scripts to determine boot order and locate the main service binary; search /etc, web directories, and wpa_supplicant.conf for passwords, tokens, SSH private keys, and backdoor accounts. - Cross-Architecture Binary Identification: Use file and cross binutils (arm-linux-gnueabi-readelf, mips readelf) to confirm architecture, endianness, and EABI details of embedded ELFs, including busybox symlink sets. - Use Case: Given an unpacked router firmware rootfs, follow the workflow to read etc/init.d/rcS, find the main httpd binary, grep the web directory for a hardcoded admin password, and confirm the binary is MIPS little-endian before deeper reverse engineering. ## Quick Start Analyze this extracted firmware rootfs directory to find the startup entry point, hardcoded credentials, and the architecture of its main binaries.
