Binwalk Package Description

Binwalk is a tool for searching a given binary image for embedded files and executable code. Specifically, it is designed for identifying files and code embedded inside of firmware images. Binwalk uses the libmagic library, so it is compatible with magic signatures created for the Unix file utility. Binwalk also includes a custom magic signature file which contains improved signatures for files that are commonly found in firmware images such as compressed/archived files, firmware headers, Linux kernels, bootloaders, filesystems, etc.

Binwalk Homepage | Kali Binwalk Repo

  • Author: Craig Heffner
  • License: MIT

Tools included in the binwalk package

binwalk – A firmware analysis tool
[email protected]:~# binwalk -h

Binwalk v1.2.2-1
Craig Heffner, http://www.devttys0.com

Usage: binwalk [OPTIONS] [FILE1] [FILE2] [FILE3] ...

Signature Analysis:
    -B, --binwalk                 Perform a file signature scan (default)
    -R, --raw-bytes=<string>      Search for a custom signature
    -A, --opcodes                 Scan for executable code signatures
    -C, --cast                    Cast file contents as various data types
    -m, --magic=<file>            Specify an alternate magic file to use
    -x, --exclude=<filter>        Exclude matches that have <filter> in their description
    -y, --include=<filter>        Only search for matches that have <filter> in their description
    -I, --show-invalid            Show results marked as invalid
    -T, --ignore-time-skew        Do not show results that have timestamps more than 1 year in the future
    -k, --keep-going              Show all matching results at a given offset, not just the first one
    -b, --dumb                    Disable smart signature keywords

Strings Analysis:
    -S, --strings                 Scan for ASCII strings (may be combined with -B, -R, -A, or -E)
    -s, --strlen=<n>              Set the minimum string length to search for (default: 3)

Entropy Analysis:
    -E, --entropy                 Plot file entropy (may be combined with -B, -R, -A, or -S)
    -H, --heuristic               Identify unknown compression/encryption based on entropy heuristics (implies -E)
    -K, --block=<int>             Set the block size for entropy analysis (default: 1024)
    -a, --gzip                    Use gzip compression ratios to measure entropy
    -N, --no-plot                 Do not generate an entropy plot graph
    -F, --marker=<offset:name>    Add a marker to the entropy plot graph
    -Q, --no-legend               Omit the legend from the entropy plot graph
    -J, --save-plot               Save plot as an SVG (implied if multiple files are specified)

Binary Diffing:
    -W, --diff                    Hexdump / diff the specified files
    -K, --block=<int>             Number of bytes to display per line (default: 16)
    -G, --green                   Only show hex dump lines that contain bytes which were the same in all files
    -i, --red                     Only show hex dump lines that contain bytes which were different in all files
    -U, --blue                    Only show hex dump lines that contain bytes which were different in some files
    -w, --terse                   Diff all files, but only display a hex dump of the first file

Extraction Options:
    -D, --dd=<type:ext[:cmd]>     Extract <type> signatures, give the files an extension of <ext>, and execute <cmd>
    -e, --extract=[file]          Automatically extract known file types; load rules from file, if specified
    -M, --matryoshka              Recursively scan extracted files, up to 8 levels deep
    -r, --rm                      Cleanup extracted files and zero-size files
    -d, --delay                   Delay file extraction for files with known footers

Plugin Options:
    -X, --disable-plugin=<name>   Disable a plugin by name
    -Y, --enable-plugin=<name>    Enable a plugin by name
    -p, --disable-plugins         Do not load any binwalk plugins
    -L, --list-plugins            List all user and system plugins by name

General Options:
    -o, --offset=<int>            Start scan at this file offset
    -l, --length=<int>            Number of bytes to scan
    -g, --grep=<text>             Grep results for the specified text
    -f, --file=<file>             Log results to file
    -c, --csv                     Log results to file in csv format
    -O, --skip-unopened           Ignore file open errors and process only the files that can be opened
    -t, --term                    Format output to fit the terminal window
    -q, --quiet                   Supress output to stdout
    -v, --verbose                 Be verbose (specify twice for very verbose)
    -u, --update                  Update magic signature files
    -?, --examples                Show example usage
    -h, --help                    Show help output

binwalk Usage Example

Run a file signature scan (-B) on the given firmware file (dd-wrt.v24-13064_VINT_mini.bin):

[email protected]:~# binwalk -B dd-wrt.v24-13064_VINT_mini.bin

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
0           0x0         TRX firmware header, little endian, header size: 28 bytes, image size: 2945024 bytes, CRC32: 0x4D27FDC4 flags: 0x0, version: 1
28          0x1C        gzip compressed data, from Unix, NULL date: Wed Dec 31 19:00:00 1969, max compression
2472        0x9A8       LZMA compressed data, properties: 0x6E, dictionary size: 2097152 bytes, uncompressed size: 2084864 bytes
622592      0x98000     Squashfs filesystem, little endian, DD-WRT signature, version 3.0, size: 2320835 bytes,  547 inodes, blocksize: 131072 bytes, created: Mon Nov  2 07:24:06 2009