Reverse Engineering

binwalk

binwalk is the firmware analyst’s first tool. Firmware images are usually a blob with several things packed inside — a bootloader, a compressed kernel, a filesystem, certificates, config — and binwalk scans the blob for the signatures of all of them, tells you what’s where, and extracts them for you. Point it at a router or IoT firmware dump and it’ll often carve out a whole Linux filesystem you can then browse for hardcoded credentials, private keys, and vulnerable binaries.

Official-repo package; Security → Reverse Engineering → binwalk.

The help it prints

Analyzes data for embedded file types

Usage: binwalk [OPTIONS] [FILE_NAME]

Arguments:
  [FILE_NAME]  Path to the file to analyze

Options:
  -L, --list                   List supported signatures and extractors
  -q, --quiet                  Supress output to stdout
  -v, --verbose                During recursive extraction display *all* results
  -e, --extract                Automatically extract known file types
  -M, --matryoshka             Recursively scan extracted files
  -a, --search-all             Search for all signatures at all offsets
  -E, --entropy                Plot the entropy of the specified file
  -l, --log <LOG>              Log JSON results to a file
  -t, --threads <THREADS>      Manually specify the number of threads to use
  -x, --exclude <EXCLUDE>...   Do no scan for these signatures
  -y, --include <INCLUDE>...   Only scan for these signatures
  -C, --directory <DIRECTORY>  Extract files/folders to a custom directory [default: extractions]
  -h, --help                   Print help
  -V, --version                Print version

Examples

# Scan an image and list what's inside it
binwalk firmware.bin

# Extract everything it recognizes, recursively
binwalk -eM firmware.bin

# Show an entropy graph — spot compressed/encrypted regions
binwalk -E firmware.bin

# Search for a specific signature or string offset
binwalk -R "\x1f\x8b" firmware.bin

After extraction, browse the carved filesystem for interesting files, and take any extracted executables into ghidra or radare2.