Binwalk

What is Binwalk?

Binwalk is a fast, easy-to-use tool for analyzing, reverse engineering, and extracting firmware images. It scans a binary file for embedded file signatures — compressed archives, filesystems, bootloaders, kernel images, certificates, and more — using a library of magic byte signatures similar to the Unix file command, but purpose-built for firmware blobs. It is an essential tool for IoT security research, embedded device auditing, and CTF forensics challenges.

Binwalk can not only identify what's inside a binary but also automatically extract all detected components into an output directory for further analysis.

Installation

# Update packages
sudo apt update

# Install Binwalk (pre-installed on Kali)
sudo apt install binwalk -y

# Install with full extraction support (recommended)
sudo apt install binwalk squashfs-tools gzip bzip2 tar arj lhasa p7zip mtd-utils -y

# Verify
binwalk --version

Basic Usage

# Scan a firmware image for embedded file signatures
binwalk firmware.bin

# Extract all detected files and filesystems automatically
binwalk -e firmware.bin

# Extract and run deeper recursive extraction on results
binwalk -Me firmware.bin

# Scan for entropy (high entropy = compressed/encrypted regions)
binwalk -E firmware.bin

# Search for specific signatures (e.g. only JPEG images)
binwalk -y jpeg firmware.bin

# Scan raw binary for string patterns
binwalk -R "\x00\x50\x4b\x03\x04" firmware.bin

# List all supported signature types
binwalk --list

Common Flags

• -e — Extract detected files to a _firmware.bin.extracted/ directory
• -M — Recursively scan extracted files (Matryoshka mode)
• -E — Calculate and plot file entropy to identify encrypted/compressed sections
• -y — Only scan for a specific file type (e.g. -y gzip)
• -x — Exclude a specific file type from results
• -l — Limit the number of results shown
• -C — Specify a custom output directory for extracted files
• --csv — Output results in CSV format for reporting

Common Use Cases

• IoT firmware analysis and reverse engineering
• CTF (Capture The Flag) forensics and steganography challenges
• Embedded device security audits
• Malware analysis — unpacking packed or nested binaries

Tips & Best Practices

Always use -Me (recursive extraction) as your default — nested archives inside firmware are common and a single -e pass will miss them. After extraction, use grep -r on the output directory to hunt for hardcoded credentials, private keys, and API tokens. Pair Binwalk with strings, file, and hexdump to build a complete picture of an unknown binary.

Practice on legal targets like TryHackMe, HackTheBox, or hackzia.site labs before using in live engagements.