binwalk: A tool for analyzing and extracting data from firmware images

Binwalk is a fast, open-source tool for analyzing, reverse engineering, and extracting firmware images and arbitrary binary files. It is widely used in IoT security research and firmware forensics to identify embedded file systems, compressed data, executable code, and other structured content hidden inside a binary blob — such as router firmware, IoT device dumps, or unknown binary files recovered during an investigation.

Binwalk works by scanning a target file for “magic byte” signatures (similar to the Unix file command’s magic database, but far more extensive) that indicate the start of known file types or file system headers (e.g., SquashFS, JFFS2, CramFS, gzip, LZMA, ZIP, PNG, JPEG). Once signatures are located, Binwalk can automatically carve out and, in many cases, fully extract and decompress the embedded content — including recursively extracting file systems nested within file systems, which is extremely common in embedded firmware.

Key capabilities:

• Signature-based scanning of arbitrary binary files
• Automatic recursive extraction of embedded files and file systems
• Entropy analysis to visually detect compressed/encrypted regions
• Opcode scanning for architecture identification (ARM, MIPS, PowerPC, etc.)
• Firmware file system extraction (SquashFS, CramFS, JFFS2, YAFFS2, UBI)
• Diffing two binaries to spot differences
• Custom signature file support for specialized formats

Installation

Kali Linux (pre-installed or via APT):

sudo apt update
sudo apt install binwalk -y

Verify installation:

binwalk --version

Expected output:

Binwalk v2.3.4

Installing with full extraction utilities (recommended for full functionality):

sudo apt install squashfs-tools cramfsswap zlib1g-dev liblzma-dev libbz2-dev p7zip-full sasquatch -y

Manual installation via pip (latest version):

pip3 install binwalk --break-system-packages

Build from source (for full feature set with all extraction plugins):

git clone https://github.com/ReFirmLabs/binwalk.git
cd binwalk
sudo python3 setup.py install

Syntax

binwalk [options] <target_file>

Command-Line Options

Basic Usage

Step 1 — Basic signature scan:

binwalk firmware.bin

Expected output:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x1A2B3C4D
64            0x40            LZMA compressed data
131136        0x20040         SquashFS filesystem, little endian, version 4.0

Step 2 — Extract identified content automatically:

binwalk -e firmware.bin

Expected output:

Extracting 131136 (SquashFS)
Extracted to _firmware.bin.extracted/

Step 3 — Recursively extract nested file systems:

binwalk -Me firmware.bin

Practical Examples with Output

Example 1: Basic signature scan of router firmware

binwalk router_firmware.bin

Output:

0        0x0      uImage header
64       0x40     gzip compressed data
524352   0x80040  SquashFS filesystem, little endian, version 4.0, size 5242880 bytes

Example 2: Automatic extraction

binwalk -e router_firmware.bin
ls _router_firmware.bin.extracted/

Output:

0        40       80040.squashfs
squashfs-root/

Example 3: Recursive (matryoshka) extraction

binwalk -Me router_firmware.bin
tree _router_firmware.bin.extracted/ -L 2

Output:

_router_firmware.bin.extracted/
├── squashfs-root
│   ├── bin
│   ├── etc
│   └── www

Example 4: Entropy analysis to detect encrypted/compressed regions

binwalk -E firmware.bin

Output:

DECIMAL   HEXADECIMAL   ENTROPY
0         0x0           Falling entropy edge (0.32)
524352    0x80040       Rising entropy edge (0.98) - possible compressed/encrypted data

Example 5: Opcode scanning for CPU architecture detection

binwalk -A firmware.bin

Output:

1024      0x400    MIPS instruction detected
2048      0x800    ARM instruction detected

Example 6: Limiting extraction depth

binwalk -Me -d 2 firmware.bin

Output:

Extraction depth limit set to: 2
Extraction complete. 2 levels processed.

Example 7: JSON output for automated processing

binwalk -B -J firmware.bin

Output:

[{"Offset": 0, "Description": "uImage header, header size: 64 bytes"},
 {"Offset": 524352, "Description": "SquashFS filesystem, little endian"}]

Example 8: Filtering results to only show file system signatures

binwalk -y "squashfs|jffs2|cramfs" firmware.bin

Output:

524352   0x80040   SquashFS filesystem, little endian, version 4.0

Example 9: Excluding certain noisy signature types

binwalk -x "certificate" firmware.bin

Output:

0        0x0       uImage header
524352   0x80040   SquashFS filesystem

Example 10: Diffing two firmware versions

binwalk -2 firmware_v1.bin firmware_v2.bin

Output:

DECIMAL     HEXADECIMAL   FIRMWARE_V1.BIN   FIRMWARE_V2.BIN
1024        0x400         0x1A                0x2B
5000        0x1388        0xFF                0x00

Example 11: Extracting with custom output directory

binwalk -e -C /home/claude/extracted_fw firmware.bin
ls /home/claude/extracted_fw

Output:

_firmware.bin.extracted/

Example 12: Searching for raw byte sequence (e.g., custom magic bytes)

binwalk -R "\x7fELF" firmware.bin

Output:

131200    0x20080   Raw signature match: \x7fELF

Common Use Cases

• IoT firmware forensics: Extracting the root file system from router, camera, or smart device firmware to inspect configuration files, credentials, and startup scripts.
• Malware analysis: Identifying embedded payloads, droppers, or secondary stages hidden within a larger binary.
• Digital forensics file carving: Locating embedded images, archives, or documents inside memory dumps or unallocated disk space.
• CTF challenges: Extracting hidden flags embedded in image/binary files using steganography-adjacent techniques.
• Firmware vulnerability research: Extracting binaries for further reverse engineering in Ghidra/IDA.
• Firmware version comparison: Using --diff mode to identify what changed between two firmware releases (patch analysis).

Automation with Bash

#!/bin/bash
# binwalk_batch.sh - Batch firmware extraction and reporting

FW_DIR="$1"
OUT_DIR="binwalk_results_$(date +%Y%m%d_%H%M%S)"

if [ -z "$FW_DIR" ]; then
    echo "Usage: $0 <firmware_directory>"
    exit 1
fi

mkdir -p "$OUT_DIR"

for fw in "$FW_DIR"/*.bin; do
    [ -e "$fw" ] || continue
    name=$(basename "$fw" .bin)
    echo "[*] Scanning $name..."
    binwalk "$fw" > "$OUT_DIR/${name}_scan.txt"

    echo "[*] Extracting $name..."
    binwalk -Me -C "$OUT_DIR/${name}_extracted" "$fw" > "$OUT_DIR/${name}_extract.log"

    echo "[*] Running entropy analysis for $name..."
    binwalk -E "$fw" > "$OUT_DIR/${name}_entropy.txt"
done

echo "[*] Batch complete. Results in $OUT_DIR/"

Run:

chmod +x binwalk_batch.sh
./binwalk_batch.sh ./firmware_samples/

Tips and Best Practices

1. Always run a plain signature scan (binwalk file) before extraction to understand the file’s structure first.
2. Use -M (matryoshka) whenever analyzing complex, nested firmware images — a single extraction pass often misses inner file systems.
3. Combine entropy analysis (-E) with signature scanning to spot encrypted or packed sections that signatures alone can’t detect.
4. Install sasquatch for improved SquashFS extraction compatibility, since vendors often use modified SquashFS variants.
5. Limit extraction depth (-d) on very large or deeply nested firmware to avoid excessive disk usage and runtime.
6. Use -y/-x filters when scanning noisy binaries to focus on relevant signatures only.
7. Always hash the original firmware file before analysis for evidentiary integrity.
8. Cross-check extracted file systems in a separate tool (e.g., mount with squashfs-tools or inspect with Autopsy) for deeper analysis.

Troubleshooting

References

• Official GitHub repository: https://github.com/ReFirmLabs/binwalk
• Binwalk documentation/wiki: https://github.com/ReFirmLabs/binwalk/wiki
• Kali Linux Binwalk tool page: https://www.kali.org/tools/binwalk/
• Sasquatch (modified SquashFS extractor): https://github.com/devttys0/sasquatch
• ReFirm Labs blog on firmware analysis: https://www.refirmlabs.com/blog