TOOL

Name: moria
Upstream: https://github.com/nmatt0/moria
License: MIT
Language: C++20 (CMake)
Latest release: v0.2.1 (tagged; prebuilt binaries for linux-x86_64/arm64 and macos-arm64, plus a .deb)
Runtime deps: zlib, liblzma, liblz4, libzstd only. No subprocess, no network calls.

WHAT IT DOES

moria identifies files and embedded content in firmware and IoT images and in
extracted rootfs trees, with confidence scores and sourced metadata as JSON.
Identification-first, and it also extracts, in-house and without sudo:

• filesystems: SquashFS, ext2/3/4, F2FS, UBIFS (and UBI), JFFS2, cramfs,
  EROFS, romfs, YAFFS2, FAT, exFAT, NTFS, HFS+, XFS, btrfs, ISO9660
• archives and containers: ZIP, tar, cpio, U-Boot uImage/FIT, Android boot
  and sparse images, VBF (Ford/Volvo ECU container)
• reverses some known vendor payload obfuscation, carves raw byte ranges, and
  flags UPX-packed executables

WHY IT FITS KALI

Firmware and embedded/IoT assessment is core pentest work, and this is the
map-and-unpack step. moria complements binwalk: identification-first with
confidence tiers, in-house multi-filesystem extraction, and structured JSON
output that is easy to drive from scripts or an LLM tool caller. It is offline,
deterministic, and fuzzed.

PACKAGING (READY)

A debian/ directory is maintained in the upstream repo, and the release
workflow builds a .deb that is attached to every GitHub release:

• debian/: https://github.com/nmatt0/moria/tree/master/debian
• Prebuilt .deb (amd64 and arm64): on each release at
  https://github.com/nmatt0/moria/releases
• Source/binary package name: moria-fw. Debian already ships a package named
  moria (the umoria roguelike), so the packaging name is disambiguated; the
  installed command stays /usr/bin/moria.
• debhelper-compat (= 13), debian/rules uses the cmake buildsystem. The
  in-repo debian/ is generic/Debian-targeted (Maintainer: the author,
  distribution unstable), a ready starting point for the Kali house style
  (Maintainer: Kali Developers, distribution kali-dev). There is a
  debian/watch on the GitHub tags.
• Builds cleanly with dpkg-buildpackage; lintian is clean apart from the
  expected non-archive-build notes (suite name and no ITP bug to close).

I am happy to maintain it as Uploader and keep it current with upstream
releases.