GO KALI FREE

Binwalk

Forensics

Intermediatelow risk

Shows file offset, description, and size of embedded content. Extraction creates _extracted folder.

Installation

Basic Syntax
binwalk [options] <file>
Quick Facts
Full Name
Binwalk Firmware Analysis Tool
License
MIT License
Author
ReFirm Labs
Written In
Python
Platforms
Linux, macOS, Windows
Category
Firmware Analysis
First Release
2010
Key Feature
Signature Scanning & Extraction
Tool Overview
Binwalk is a fast, easy-to-use tool for analyzing, reverse engineering, and extracting firmware images. It scans binary files for embedded file signatures and filesystem structures, then extracts them for further analysis.
Created by Craig Heffner at ReFirm Labs, Binwalk has become the standard tool for IoT security researchers, firmware reverse engineers, and embedded systems analysts. It supports dozens of common file formats and compression types.
Beyond simple extraction, Binwalk provides entropy analysis to identify encrypted or compressed sections, recursive extraction for nested content, and a signature database that can be customized for specific firmware formats.
Common Commands
binwalk firmware.binScan a file and print a signature analysis of embedded file types and offsets.
binwalk -e firmware.binExtract known file types found in the image using matched extraction rules.
binwalk --dd='.*' firmware.binExtract every signature match to disk regardless of type.
binwalk -M -e firmware.binRecursively scan and extract (matryoshka) through nested archives and filesystems.
binwalk -A firmware.binScan for common executable opcode signatures (architecture fingerprinting).
binwalk -E firmware.binPerform an entropy analysis to locate compressed or encrypted regions.
binwalk -E -J firmware.binRun entropy analysis and save the entropy graph as a PNG (requires matplotlib).
binwalk -B firmware.binRun a raw signature (magic) scan — the default behavior, stated explicitly.
binwalk -R "\x50\x4b\x03\x04" firmware.binSearch the file for a specific raw byte sequence (here, a ZIP header).
binwalk -Y firmware.binIdentify the CPU architecture using the capstone disassembler.
binwalk --dd='png image:png' firmware.binExtract only PNG matches and give them a .png extension.
binwalk -D 'jpeg:jpg' firmware.binExtract JPEG signatures to files with a .jpg extension.
binwalk -C ./out -e firmware.binExtract into a chosen output directory instead of the default.
binwalk -o report.txt firmware.binWrite the scan log to a file.
binwalk --csv firmware.binEmit scan results in CSV format for parsing.
Step-by-Step Guide
  1. 1Acquire the raw firmware file you wish to analyze
  2. 2Execute a preliminary scan to map out embedded structures
  3. 3Use the extraction flag to pull out the internal file systems
  4. 4Navigate through the newly created extraction folder
  5. 5Search the contents for hardcoded keys, passwords, or configuration files
  6. 6Further disassemble any interesting compiled binaries found inside
Warnings
Use Cases
Firmware Analysis
Scan firmware images to identify embedded filesystems, kernels, and configuration files for security auditing.
IoT Security Research
Extract firmware from IoT devices to find hardcoded credentials, vulnerable services, and backdoors.
Binary Reverse Engineering
Map the internal structure of compiled binaries to understand data organization and embedded components.
Entropy Detection
Identify encrypted or compressed sections within firmware to assess reverse engineering difficulty.
Embedded File Recovery
Extract embedded filesystems, bootloaders, and data partitions from monolithic firmware images.
Key Features
Related Tools
Foremost
Forensics
File carving tool for recovering files based on headers, footers, and data structures.
ExifTool
Forensics
Metadata extraction tool for analyzing file properties and embedded data.
Autopsy
Forensics
Digital forensics platform for disk image analysis and file recovery.
Frequently Asked Questions
What is Binwalk used for?
Binwalk is a firmware analysis tool used to scan binary files for embedded file signatures, extract embedded content, and perform entropy analysis to detect encryption or compression in firmware images.
Can Binwalk extract encrypted firmware?
No, Binwalk cannot decrypt encrypted firmware payloads. It can identify encrypted sections through entropy analysis, but decryption requires the encryption key or external tools.
How does Binwalk extract files?
Binwalk uses signature matching to locate embedded files and filesystems within a binary, then carves them out into a _extracted directory. The -Me flag enables recursive extraction for nested content.
What is entropy analysis in Binwalk?
Entropy analysis (-E flag) measures the randomness of data sections. High entropy indicates encryption or compression, while low entropy suggests structured data or uncompressed content.
Tags
#forensics#firmware#analysis
Output Explanation
Displays a list of memory offsets alongside descriptions of the file formats or compression types discovered at those locations. When extracting, it generates a subfolder containing the dumped files.
Ethical Usage Notice
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.