1"use strict";(self.webpackChunkhackviser_website=self.webpackChunkhackviser_website||[]).push([[19196],{23692:(e,n,r)=>{r.r(n),r.d(n,{assets:()=>c,contentTitle:()=>l,default:()=>h,frontMatter:()=>a,metadata:()=>t,toc:()=>d});var s=r(17624),i=r(4552);const a={title:"Binwalk",sidebar_label:"Binwalk",description:"Binwalk tool guide; includes tool's purpose,primary uses,core features,data sources, common commands and example of command's usages.",tags:["Firmware","Forensics","Reverse Engineering","Embedded Security"]},l="Binwalk",t={id:"tools/binwalk",title:"Binwalk",description:"Binwalk tool guide; includes tool's purpose,primary uses,core features,data sources, common commands and example of command's usages.",source:"@site/tactics/tools/binwalk.md",sourceDirName:"tools",slug:"/tools/binwalk",permalink:"/tactics/tools/binwalk",draft:!1,unlisted:!1,tags:[{label:"Firmware",permalink:"/tactics/tags/firmware"},{label:"Forensics",permalink:"/tactics/tags/forensics"},{label:"Reverse Engineering",permalink:"/tactics/tags/reverse-engineering"},{label:"Embedded Security",permalink:"/tactics/tags/embedded-security"}],version:"current",frontMatter:{title:"Binwalk",sidebar_label:"Binwalk",description:"Binwalk tool guide; includes tool's purpose,primary uses,core features,data sources, common commands and example of command's usages.",tags:["Firmware","Forensics","Reverse Engineering","Embedded Security"]},sidebar:"toolsSidebar",previous:{title:"Bettercap",permalink:"/tactics/tools/bettercap"},next:{title:"BloodHound CE",permalink:"/tactics/tools/bloodhound-ce"}},c={},d=[{value:"What is the purpose of Binwalk?",id:"what-is-the-purpose-of-binwalk",level:2},{value:"Core Features",id:"core-features",level:2},{value:"Data sources",id:"data-sources",level:2},{value:"Common Binwalk Commands",id:"common-binwalk-commands",level:2},{value:"1. Install Binwalk with Cargo",id:"1-install-binwalk-with-cargo",level:3},{value:"2. Check Binwalk Version",id:"2-check-binwalk-version",level:3},{value:"3. Show Help",id:"3-show-help",level:3},{value:"4. Scan a Firmware Image",id:"4-scan-a-firmware-image",level:3},{value:"5. Scan a Vendor Update Package",id:"5-scan-a-vendor-update-package",level:3},{value:"6. Extract Known File Types",id:"6-extract-known-file-types",level:3},{value:"7. Extract with the Short Option",id:"7-extract-with-the-short-option",level:3},{value:"8. Recursively Extract Nested Content",id:"8-recursively-extract-nested-content",level:3},{value:"9. Recursively Extract with Short Options",id:"9-recursively-extract-with-short-options",level:3},{value:"10. Extract to a Custom Directory",id:"10-extract-to-a-custom-directory",level:3},{value:"11. Recursively Extract to a Custom Directory",id:"11-recursively-extract-to-a-custom-directory",level:3},{value:"12. Carve File Sections",id:"12-carve-file-sections",level:3},{value:"13. Carve to a Custom Directory",id:"13-carve-to-a-custom-directory",level:3},{value:"14. Extract and Carve Together",id:"14-extract-and-carve-together",level:3},{value:"15. Generate an Entropy Graph",id:"15-generate-an-entropy-graph",level:3},{value:"16. Save Entropy Graph to a Specific PNG",id:"16-save-entropy-graph-to-a-specific-png",level:3},{value:"17. Save Signature Results as JSON",id:"17-save-signature-results-as-json",level:3},{value:"18. Print JSON Results to Standard Output",id:"18-print-json-results-to-standard-output",level:3},{value:"19. List Supported Signatures and Extractors",id:"19-list-supported-signatures-and-extractors",level:3},{value:"20. Include Only SquashFS Results",id:"20-include-only-squashfs-results",level:3},{value:"21. Extract Only File System Signatures",id:"21-extract-only-file-system-signatures",level:3},{value:"22. Exclude Common Image Noise",id:"22-exclude-common-image-noise",level:3},{value:"23. Carve Only Compressed Streams",id:"23-carve-only-compressed-streams",level:3},{value:"24. Search for All Signatures at All Offsets",id:"24-search-for-all-signatures-at-all-offsets",level:3},{value:"25. Scan Data from Standard Input",id:"25-scan-data-from-standard-input",level:3}
1,{value:"26. Use More Worker Threads",id:"26-use-more-worker-threads",level:3},{value:"27. Run Quietly",id:"27-run-quietly",level:3},{value:"28. Show Verbose Recursive Results",id:"28-show-verbose-recursive-results",level:3},{value:"29. Create JSON While Extracting",id:"29-create-json-while-extracting",level:3},{value:"30. Create JSON for Recursive Extraction",id:"30-create-json-for-recursive-extraction",level:3},{value:"31. Generate Entropy and JSON Together",id:"31-generate-entropy-and-json-together",level:3},{value:"32. Save Entropy Graph and JSON Together",id:"32-save-entropy-graph-and-json-together",level:3},{value:"33. Scan a Raw Flash Dump",id:"33-scan-a-raw-flash-dump",level:3},{value:"34. Extract a Raw Flash Dump",id:"34-extract-a-raw-flash-dump",level:3},{value:"35. Focus on File Systems in a Flash Dump",id:"35-focus-on-file-systems-in-a-flash-dump",level:3},{value:"36. Carve Unknown Sections for Manual Review",id:"36-carve-unknown-sections-for-manual-review",level:3},{value:"37. Find the Extraction Directory Size",id:"37-find-the-extraction-directory-size",level:3},{value:"38. List Top-Level Extracted Files",id:"38-list-top-level-extracted-files",level:3},{value:"39. Search Extracted Files for Linux Password Databases",id:"39-search-extracted-files-for-linux-password-databases",level:3},{value:"40. Search Extracted Files for Secrets",id:"40-search-extracted-files-for-secrets",level:3},{value:"41. Find Executable Files After Extraction",id:"41-find-executable-files-after-extraction",level:3},{value:"42. Find Symbolic Links After Extraction",id:"42-find-symbolic-links-after-extraction",level:3},{value:"43. Identify Extracted File Types",id:"43-identify-extracted-file-types",level:3},{value:"44. Batch Scan Firmware Files",id:"44-batch-scan-firmware-files",level:3},{value:"45. Batch Extract Firmware Files",id:"45-batch-extract-firmware-files",level:3},{value:"Output Examples of Binwalk Commands",id:"output-examples-of-binwalk-commands",level:2},{value:"Practical Tips",id:"practical-tips",level:2}];function o(e){const n={code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,i.M)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"binwalk",children:"Binwalk"}),"\n",(0,s.jsx)(n.h2,{id:"what-is-the-purpose-of-binwalk",children:"What is the purpose of Binwalk?"}),"\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Binwalk"})," is an open-source command-line tool for analyzing firmware images and other binary blobs. It scans files for embedded signatures, identifies compressed data, file systems, bootloader structures, certificates, archives, images, and other embedded content, then optionally extracts or carves those objects to disk."]}),"\n",(0,s.jsx)(n.p,{children:"Binwalk is especially useful in embedded security, IoT firmware review, malware triage, CTF challenges, digital forensics, and incident response because firmware files often contain several nested layers. A single vendor update image can include boot headers, compressed kernels, SquashFS or UBIFS file systems, configuration files, web interfaces, certificates, scripts, and proprietary binary sections."}),"\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Version note:"})," This guide uses the current Binwalk v3 command style. Binwalk v3 is a Rust rewrite with a smaller and cleaner CLI than older v2 examples found online. Prefer ",(0,s.jsx)(n.code,{children:"--extract"}),", ",(0,s.jsx)(n.code,{children:"--carve"}),", ",(0,s.jsx)(n.code,{children:"--matryoshka"}),", ",(0,s.jsx)(n.code,{children:"--entropy"}),", ",(0,s.jsx)(n.code,{children:"--log"}),", ",(0,s.jsx)(n.code,{children:"--include"}),", and ",(0,s.jsx)(n.code,{children:"--exclude"}),". Do not assume older v2 flags such as ",(0,s.jsx)(n.code,{children:"--dd"}),", ",(0,s.jsx)(n.code,{children:"-B"}),", or ",(0,s.jsx)(n.code,{children:"-A"})," are available."]}),"\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"Here are the primary uses of Binwalk:"})}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Firmware Triage:"}),"\nBinwalk quickly identifies the structure of a firmware image and shows offsets, signature names, confidence levels, and descriptions for embedded objects."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Embedded File System Discovery:"}
1),"\nThe tool helps find file systems such as SquashFS, CramFS, JFFS2, UBIFS, ext, and FAT inside router, camera, appliance, or IoT firmware."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Automatic Extraction:"}),"\nBinwalk can extract known file types and file systems into an output directory for deeper analysis with standard Linux tools."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Recursive Extraction:"}),"\nThe matryoshka mode recursively scans extracted files, which is useful when firmware contains nested archives, compressed payloads, or multi-stage update packages."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Data Carving:"}),"\nThe tool can carve known and unknown file sections to disk when automatic extraction is not enough or when analysts want offset-based artifacts."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Entropy Analysis:"}),"\nBinwalk can generate entropy graphs to highlight compressed, encrypted, packed, or random-looking regions inside a binary file."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Signature Filtering:"}),"\nAnalysts can include or exclude specific signatures to reduce noise, focus on file systems, or avoid carving irrelevant media files."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Automation and Reporting:"}),"\nBinwalk can write JSON logs for signature and entropy results, making it suitable for CI checks, firmware pipelines, and repeatable lab workflows."]}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"core-features",children:"Core Features"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Firmware and binary signature scanning"}),"\n",(0,s.jsx)(n.li,{children:"Automatic extraction and recursive extraction"}),"\n",(0,s.jsx)(n.li,{children:"Raw section carving for manual review"}),"\n",(0,s.jsx)(n.li,{children:"Entropy analysis and PNG graph output"}),"\n",(0,s.jsx)(n.li,{children:"JSON logging for automation"}),"\n",(0,s.jsx)(n.li,{children:"Include and exclude filters for signatures"}),"\n",(0,s.jsx)(n.li,{children:"Custom output directories, stdin scanning, and thread control"}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"data-sources",children:"Data sources"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Firmware images and vendor update packages"}),"\n",(0,s.jsx)(n.li,{children:"Raw SPI, NAND, NOR, and flash dumps"}),"\n",(0,s.jsx)(n.li,{children:"Embedded Linux file systems such as SquashFS, JFFS2, and UBIFS"}),"\n",(0,s.jsx)(n.li,{children:"Compressed streams and archive formats"}),"\n",(0,s.jsx)(n.li,{children:"Boot images, kernels, U-Boot images, and ELF binaries"}),"\n",(0,s.jsx)(n.li,{children:"Certificates, keys, configs, and embedded web assets"}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"common-binwalk-commands",children:"Common Binwalk Commands"}),"\n",(0,s.jsx)(n.h3,{id:"1-install-binwalk-with-cargo",children:"1. Install Binwalk with Cargo"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command installs the latest Binwalk release from crates.io when Rust and required external dependencies are available."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"cargo install binwalk\n"})}),"\n",(0,s.jsx)(n.h3,{id:"2-check-binwalk-version",children:"2. Check Binwalk Version"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command prints the installed Binwalk version."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --version\n"})}),"\n",(0,s.jsx)(n.h3,{id:"3-show-help",children:"3. Show Help"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command displays the available Binwalk options."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --help\n"})}),"\n",(0,s.jsx)(n.h3,{id:"4-scan-a-firmware-image",children:"4. Scan a Firmware Image"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command scans a firmware file and prints detected embedded signatures."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"5-scan-a-vendor-update-package",children:"5. Scan a Vendor Update Package"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command performs a normal signature scan against a vendor update image."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk DIR-890L_AxFW110b07.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"6-extract-known-file-types",children:"6. Extract Known File Types"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command scans the firmware and automatically extracts supported embedded content."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --extract firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"7-extract-with-the-short-option",children:"7. Extract with the Short Option"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command uses the short form of automatic extraction."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk -e firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"8-recursively-extract-nested-content",children:"8. Recursively Extract Nested Content"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command extracts known content and recursively scans extracted files."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --matryoshka --extract firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"9-recursively-extract-with-short-options",children:"9. Recursively Extract with Short Options"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command uses the common short form for recursive extraction."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk -Me firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"10-extract-to-a-custom-directory",children:"10. Extract to a Custom Directory"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command writes extracted files and folders into a selected directory."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --extract --directory ./binwalk-output firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"11-recursively-extract-to-a-custom-directory",children:"11. Recursively Extract to a Custom Directory"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command keeps recursive extraction output in a predictable working directory."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk -Me --directory ./firmware-root firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"12-carve-file-sections",children:"12. Carve File Sections"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command carves known and unknown file sections from the input file to disk."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --carve firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"13-carve-to-a-custom-directory",children:"13. C
1arve to a Custom Directory"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command stores carved sections in a custom output directory."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --carve --directory ./carved firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"14-extract-and-carve-together",children:"14. Extract and Carve Together"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command performs automatic extraction and also carves file sections."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --extract --carve firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"15-generate-an-entropy-graph",children:"15. Generate an Entropy Graph"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command analyzes data randomness and saves an entropy graph to the current directory."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --entropy firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"16-save-entropy-graph-to-a-specific-png",children:"16. Save Entropy Graph to a Specific PNG"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command writes the entropy graph to a chosen PNG file."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --entropy --png firmware-entropy.png firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"17-save-signature-results-as-json",children:"17. Save Signature Results as JSON"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command writes Binwalk results to a JSON file for later parsing."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --log scan-results.json firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"18-print-json-results-to-standard-output",children:"18. Print JSON Results to Standard Output"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command writes JSON output to stdout, which is useful for automation."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --log - firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"19-list-supported-signatures-and-extractors",children:"19. List Supported Signatures and Extractors"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command lists the signature names that can be used with include and exclude filters."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --list\n"})}),"\n",(0,s.jsx)(n.h3,{id:"20-include-only-squashfs-results",children:"20. Include Only SquashFS Results"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command focuses the scan on the SquashFS signature name."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --include=squashfs firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"21-extract-only-file-system-signatures",children:"21. Extract Only File System Signatures"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command extracts only selected embedded Linux file system types."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --extract --include=squashfs,ubifs,jffs2 firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"22-exclude-common-image-noise",children:"22. Exclude Common Image Noise"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command suppresses common media signatures when they are not relevant to the investigation."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --exclude=jpeg,png,gif firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"23-carve-only-compressed-streams",children:"23. Carve Only Compressed Streams"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command focuses carving on common compressed data signatures."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --carve --include=gzip,xz,lzma,zstd firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"24-search-for-all-signatures-at-all-offsets",children:"24. Search for All Signatures at All Offsets"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command enables a deeper search that can find overlapping or less obvious embedded signatures."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --search-all firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"25-scan-data-from-standard-input",children:"25. Scan Data from Standard Input"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command reads firmware bytes from stdin instead of a file path."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"cat firmware.bin | binwalk --stdin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"26-use-more-worker-threads",children:"26. Use More Worker Threads"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command manually sets the number of threads for scanning."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --threads 8 firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"27-run-quietly",children:"27. Run Quietly"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command suppresses normal stdout output, useful when only files or logs matter."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --quiet --extract firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"28-show-verbose-recursive-results",children:"28. Show Verbose Recursive Results"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command displays all results during recursive extraction."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --verbose --matryoshka --extract firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"29-create-json-while-extracting",children:"29. Create JSON While Extracting"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command records signature and extraction results in JSON while extracting files."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --extract --log extraction-results.json firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"30-create-json-for-recursive-extraction",children:"30. Create JSON for Recursive E
1xtraction"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command records recursive extraction findings in a JSON report."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk -Me --log recursive-results.json firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"31-generate-entropy-and-json-together",children:"31. Generate Entropy and JSON Together"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command saves entropy analysis results in JSON and creates an entropy graph."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --entropy --log entropy-results.json firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"32-save-entropy-graph-and-json-together",children:"32. Save Entropy Graph and JSON Together"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command writes both a PNG graph and JSON entropy results."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --entropy --png entropy.png --log entropy-results.json firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"33-scan-a-raw-flash-dump",children:"33. Scan a Raw Flash Dump"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command analyzes a raw flash dump collected from an embedded device."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk flash-dump.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"34-extract-a-raw-flash-dump",children:"34. Extract a Raw Flash Dump"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command extracts known objects from a flash dump into a working directory."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --extract --directory ./flash-extract flash-dump.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"35-focus-on-file-systems-in-a-flash-dump",children:"35. Focus on File Systems in a Flash Dump"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command looks for common embedded file system signatures in a flash image."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --include=squashfs,cramfs,jffs2,ubifs,ext,fat flash-dump.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"36-carve-unknown-sections-for-manual-review",children:"36. Carve Unknown Sections for Manual Review"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command carves the full binary into known and unknown regions for offset-based inspection."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"binwalk --carve --search-all --directory ./manual-review firmware.bin\n"})}),"\n",(0,s.jsx)(n.h3,{id:"37-find-the-extraction-directory-size",children:"37. Find the Extraction Directory Size"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command estimates how much data Binwalk extracted."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"du -sh ./firmware-root\n"})}),"\n",(0,s.jsx)(n.h3,{id:"38-list-top-level-extracted-files",children:"38. List Top-Level Extracted Files"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command gives a quick view of the extracted firmware layout."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"find ./firmware-root -maxdepth 2 -type f | head\n"})}),"\n",(0,s.jsx)(n.h3,{id:"39-search-extracted-files-for-linux-password-databases",children:"39. Search Extracted Files for Linux Password Databases"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command looks for account database files inside extracted firmware."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"find ./firmware-root -type f \\( -name passwd -o -name shadow \\)\n"})}),"\n",(0,s.jsx)(n.h3,{id:"40-search-extracted-files-for-secrets",children:"40. Search Extracted Files for Secrets"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command looks for common secret-related strings in extracted firmware content."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:'grep -RIn "password\\|passwd\\|token\\|secret\\|private_key" ./firmware-root\n'})}),"\n",(0,s.jsx)(n.h3,{id:"41-find-executable-files-after-extraction",children:"41. Find Executable Files After Extraction"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command lists extracted files that are marked executable."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"find ./firmware-root -type f -perm -111\n"})}),"\n",(0,s.jsx)(n.h3,{id:"42-find-symbolic-links-after-extraction",children:"42. Find Symbolic Links After Extraction"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command lists symbolic links that may reveal firmware layout assumptions."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"find ./firmware-root -type l -ls\n"})}),"\n",(0,s.jsx)(n.h3,{id:"43-identify-extracted-file-types",children:"43. Identify Extracted File Types"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command summarizes file types from a recursive extraction directory."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"find ./firmware-root -type f -exec file {} \\;\n"})}),"\n",(0,s.jsx)(n.h3,{id:"44-batch-scan-firmware-files",children:"44. Batch Scan Firmware Files"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command scans each firmware image in a directory and writes one JSON report per file."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:'mkdir -p binwalk-logs\nfor fw in firmware-samples/*.bin; do\n name=$(basename "$fw")\n binwalk --log "binwalk-logs/$name.json" "$fw"\ndone\n'})}),"\n",(0,s.jsx)(n.h3,{id:"45-batch-extract-firmware-files",children:"45. Batch Extract Firmware Files"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"This command extracts each firmware image into its own output directory."}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:'for fw in firmware-samples/*.bin; do\n name=$(basename "$fw" .bin)\n binwalk --extract --directory "extract-$name" "$fw"\ndone\n'})}),"\n",(0,s.jsx)(n.h2,{id:"output-examples-of-binwalk-commands",children:"Output Examples of Binwalk Commands"}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Command"}),(0,s.jsx)(n.th,{children:"Example Usage"}),(0,s.jsx)(n.th,{children:"Function"}),(0,s.jsx)(n.th,{children:"Output Example"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"Basic Scan"}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"binwalk firmware.bin"})}),(0,s.jsx)(n.td,{children:"Detects embedded signatures."}),(0,s.jsxs)(n.td,{children:[(0,s.jsx)(n.code,{children:"DECIMAL HEXADECIMAL DESCRIPTION"})," ",(0,s.jsx)("br",{})," ",(0,s.jsx)(n.code,{children:"0 0x0 Firmware header"})," ",(0,s.jsx)("br",{})," ",(0,s.jsx)(n.code,{children:"131072 0x20000 SquashFS filesystem"})]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"Extract"}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"binwalk -e firmware.bin"})}),(0,s.jsx)(n.td,{children:"Extracts supported embedded content."}),(0,s.jsxs)(n.td,{children:[(0,s.jsx)(n.code,{children:"Extracted 1 file system"})," ",(0,s.jsx)("br",{})," ",(0,s.jsx)(n.code,{children:"Output: extractions/firmware.bin.extracted/"})]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"Recursive E
1xtract"}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"binwalk -Me firmware.bin"})}),(0,s.jsx)(n.td,{children:"Extracts nested payloads."}),(0,s.jsxs)(n.td,{children:[(0,s.jsx)(n.code,{children:"Recursively scanning extracted files"})," ",(0,s.jsx)("br",{})," ",(0,s.jsx)(n.code,{children:"Found gzip compressed data"})]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"Carve"}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"binwalk --carve firmware.bin"})}),(0,s.jsx)(n.td,{children:"Carves known and unknown sections."}),(0,s.jsxs)(n.td,{children:[(0,s.jsx)(n.code,{children:"Carved section at offset 0x20000"})," ",(0,s.jsx)("br",{})," ",(0,s.jsx)(n.code,{children:"Wrote output to extractions/"})]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"Entropy"}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"binwalk --entropy firmware.bin"})}),(0,s.jsx)(n.td,{children:"Generates an entropy graph."}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"Entropy graph saved to firmware.bin.png"})})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"JSON Log"}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"binwalk --log scan.json firmware.bin"})}),(0,s.jsx)(n.td,{children:"Writes machine-readable results."}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"Results saved to scan.json"})})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"Include Filter"}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"binwalk --include=squashfs firmware.bin"})}),(0,s.jsx)(n.td,{children:"Shows only selected signatures."}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"0x20000 SquashFS filesystem"})})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"Exclude Filter"}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"binwalk --exclude=jpeg,png,gif firmware.bin"})}),(0,s.jsx)(n.td,{children:"Suppresses noisy signatures."}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"Media signatures excluded from results"})})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"Search All"}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"binwalk --search-all firmware.bin"})}),(0,s.jsx)(n.td,{children:"Searches all offsets for all signatures."}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"Additional candidate signatures found"})})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"Signature List"}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"binwalk --list"})}),(0,s.jsx)(n.td,{children:"Lists supported signatures and extractors."}),(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"Signature Name Description Extractor"})})]})]})]}),"\n",(0,s.jsx)(n.h2,{id:"practical-tips",children:"Practical Tips"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Start with a normal scan before extraction so you understand the firmware layout and offsets."}),"\n",(0,s.jsxs)(n.li,{children:["Use ",(0,s.jsx)(n.code,{children:"--list"})," to confirm exact signature names before writing ",(0,s.jsx)(n.code,{children:"--include"})," or ",(0,s.jsx)(n.code,{children:"--exclude"})," filters."]}),"\n",(0,s.jsxs)(n.li,{children:["Use ",(0,s.jsx)(n.code,{children:"--matryoshka --extract"})," when the firmware contains nested archives or compressed file systems."]}),"\n",(0,s.jsxs)(n.li,{children:["Use ",(0,s.jsx)(n.code,{children:"--carve"})," when extraction fails or when you need raw sections for manual inspection."]}),"\n",(0,s.jsxs)(n.li,{children:["Use ",(0,s.jsx)(n.code,{children:"--entropy"})," to identify compressed or encrypted-looking regions before spending time on manual reverse engineering."]}),"\n",(0,s.jsxs)(n.li,{children:["Store results with ",(0,s.jsx)(n.code,{children:"--log"})," when comparing firmware versions or building repeatable analysis pipelines."]}),"\n",(0,s.jsx)(n.li,{children:"Treat extracted firmware as untrusted input. Analyze scripts, binaries, and file systems in a controlled environment."}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,i.M)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(o,{...e})}):o(e)}},4552:(e,n,r)=>{r.d(n,{I:()=>t,M:()=>l});var s=r(11504);const i={},a=s.createContext(i);function l(e){const n=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function t(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:l(e.components),s.createElement(a.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.