security enabled verified low v1.0.0

binwalk

Firmware analysis tool for extracting filesystems, identifying embedded files, and scanning binary blobs for signatures.

📋 Live Preview

binwalk -e {firmware-file}

🌍 firmware-file →

binwalk -e {firmware-file}

Sandbox: execFile · Timeout: 600s

Capabilities

firmware.analysis

file.extraction

signature.scanning

binary.forensics

Parameters

Name	Type	Required	Default	Description	Aliases
`extract`	boolean	No	-	Extract files automatically	`-e`
`matryoshka`	boolean	No	-	Recursively extract embedded filesystems	`-M`
`remove`	boolean	No	-	Remove extracted file after scanning	`-r`
`depth`	integer	No	-	Maximum recursion depth	`-d`
`include`	string	No	-	Only scan for matching signatures	`-y`
`exclude`	string	No	-	Exclude matching signatures	`-x`
`signature`	boolean	No	-	Perform signature scanning	`-S`, `--signature`
`entropy`	boolean	No	-	Calculate file entropy	`--entropy`
`opcodes`	boolean	No	-	Identify CPU opcodes in firmware	`--opcodes`
`dd`	string	No	-	Dump region to file (type:offset:size)	`--dd`
`csv`	boolean	No	-	Output in CSV format	`-c`
`json`	boolean	No	-	Output in JSON format	`-j`
`I`	boolean	No	-	show invalid/partial results	`-I`, `--invalid`
`T`	boolean	No	-	only show results of given type	`-T`
`W`	boolean	No	-	warn about suspicious signatures	`-W`, `--warn`
`l`	boolean	No	-	limit scanning to length bytes	`-l`
`q`	boolean	No	-	suppress banner	`-q`, `--quiet`
`v`	boolean	No	-	verbose output	`-v`, `--verbose`

Contract

Inputs

file.binary

Firmware or binary blob to analyze

Outputs

file.extracted

Extracted files and filesystems

report.signature

Signature scan report

Side effects: filesystem_write

Workflow Edges

Produces

file.extractedreport.signature

Consumes

file.binary

Resource Profile

Resource	Value
CPU	medium
Memory	512 MB
Network	low
Disk I/O	high

Examples

Extract firmware filesystems

binwalk -e firmware.bin

Recursive extraction with all nested filesystems

binwalk -Me firmware.bin

Signature scan only, no extraction

binwalk firmware.bin

Entropy analysis of firmware blob

binwalk --entropy firmware.bin

Scan with opcode identification

binwalk --opcodes firmware.bin

JSON output with entropy calculation

binwalk -j --entropy firmware.bin

Documentation

Binwalk — Firmware Analysis Tool

Binwalk is a firmware analysis tool that scans binary files for embedded files and filesystems using signature matching. It can extract filesystems (Squashfs, JFFS2, etc.), identify compression types, and perform entropy analysis.

Key Features

Signature scanning: Detects hundreds of file signatures
Filesystem extraction: Automatically extracts Squashfs, Cramfs, JFFS2, and more
Entropy analysis: Identifies encrypted or compressed regions
Opcode detection: Identifies CPU architecture of embedded code

Typical Workflow

# Step 1: Scan for signatures
binwalk firmware.bin

# Step 2: Extract discovered filesystems
binwalk -Me firmware.bin

# Step 3: Analyze entropy for hidden regions
binwalk --entropy firmware.bin

Related Tools

foremostvolatilitystringshexdump