Binwalk

What Binwalk is

Binwalk is a free firmware analysis tool that identifies and can extract files or data embedded inside other files. Its scanner looks for known signatures; the project documents 111 supported signatures, 72 of which are extractable, so results depend on patterns it recognizes. Binwalk can generate entropy graphs to help identify sections that may be compressed or encrypted. The quick start guide demonstrates extraction with the `-e` option and recursive scanning with `-M`. Version 3 is rewritten in Rust, and the project includes a library for integration into other Rust projects. Listed installation methods are Docker, the Rust package manager and compiling from source. The project officially supports 64-bit Linux, preferably Ubuntu or an Ubuntu-based system; Windows and macOS are largely untested. Analysis requires at least as much free memory as the files being examined. Binwalk is distributed under the MIT License, which permits use, modification and distribution subject to its terms. The license provides the software as-is and disclaims warranties.

Who it suits

It suits people analyzing firmware who need to locate or extract embedded data and can work with officially supported 64-bit Linux systems.

Limits

Binwalk’s free analysis depends on known signatures and requires at least as much free memory as the analyzed files’ size. Official support is for 64-bit Linux; Windows and macOS are largely untested.

Getting started

1. Open https://github.com/ReFirmLabs/binwalk.
2. Install using Docker, Rust’s package manager, or compile from source.
3. Run it on 64-bit Linux; Ubuntu or an Ubuntu-based system is preferred.
4. Use `-e` for extraction or `-M` for recursive scanning.

Verdict

Binwalk provides signature scanning, extraction and entropy analysis for firmware work at no cost. Its official support is focused on 64-bit Linux, and findings depend on known signatures.