v0.3.0

moria 0.3.0 adds a large batch of firmware formats and a byte-exact executable unpacker, and makes the recursive -e output readable as a tree. All identification and extraction stays in-process: no external extractors, no sudo. The binary embeds its signature sets, so each release tarball is just the binary, man page, and license.

Highlights

Executable unpacking

• UPX: byte-exact ELF reconstruction (equivalent to upx -d), all NRV2B/D/E and LZMA variants, x86/i386/ARM/ARM64, LE and BE.

New filesystems (identify + extract)

• LittleFS (Zephyr/Mbed/ESP-IDF/nRF/STM32 default flash FS).
• SPIFFS (ESP8266/ESP32 SPI-NOR).

New identify coverage

• GPT and MBR partition tables, rendered as a labeled region map.
• LUKS1 / LUKS2 encrypted volumes with header parameters.
• Legacy block filesystems: NILFS2, Minix, ReiserFS, UFS/FFS, APFS, LogFS.
• ESP32 partition table + NVS key/value store (with blob recovery).

New firmware containers and streams

• Windows CE XIP ROM (nk.bin / .cos), MS-CAB (stored/MSZIP/LZX), and CFBF compound files / Windows Installer .msi.
• Artosyn OTRA upgrade images (AR8030 / VT4 / VR04): SHA-256-verified, LZO1X-decompressed per partition.
• Standalone legacy .lzma streams.

Robustness and output

• UBIFS orphaned-inode recovery for partial/rootless captures (lost+found-style).
• Boot-level artifact identification plus verified-boot metadata.
• Per-section Shannon-entropy column under -E.
• Recursive extraction now renders as a tree in human -e output.

Build and packaging

• Nix flake support; single-sourced version (VERSION file); CTest-registered test suite.

Install

• Homebrew: brew install nmatt0/tap/moria
• Prebuilt binaries / .deb: attached below (linux-x86_64, linux-arm64, macos-arm64).
• From source: cmake -S . -B build -DCMAKE_BUILD_TYPE=Release && cmake --build build -j

Thanks

This release includes community contributions from:

• @skmagiik — Windows CE and CAB/CFBF extraction support (#48)
• @XuliGan4eg2006 — Artosyn OTRA firmware identify + extract (#46)
• @wilco375 — honor partition boundaries when a finding overruns them (#33)
• @kleindotc — Nix flake support (#32)
• @3ch0less — ESP32 partition table + NVS extraction (#30)
• @0xDyews — register unit tests with CTest (#14)

Thank you!