Binwalk

What is Binwalk?

Binwalk is an open-source tool for analysing binary files and finding other files or data embedded inside them. Its classic use is firmware analysis (routers, IP cameras, IoT devices), but it is also essential in forensics and steganography CTFs: a seemingly normal image may have a ZIP appended to it, and Binwalk spots it in seconds. It works by scanning the whole file for signatures (the "magic numbers" that identify formats such as gzip, squashfs, JPEG or ELF) and reporting the offset where each one appears.

There are two generations worth knowing: v2, written in Python, which most older tutorials use, and v3, a complete and much faster rewrite in Rust maintained in the ReFirmLabs repository. The basic options are nearly identical, although some v2 features changed or were dropped.

What Binwalk is used for

• Extracting a firmware's filesystem to review binaries, boot scripts, hardcoded credentials or vulnerable services.
• Steganography and forensics CTF challenges: files hidden inside images, audio or PDFs.
• Detecting encrypted or compressed data through entropy analysis.
• A first look at an unknown binary before loading it into a disassembler such as Ghidra.

How to install Binwalk

On Kali Linux, Parrot and Debian/Ubuntu-based distributions it is in the repositories:

sudo apt update
sudo apt install binwalk

The packaged version depends on your distribution (it may still be v2). If you want the Rust v3, the most direct route is Cargo:

cargo install binwalk

To extract many formats, Binwalk relies on external utilities (squashfs unpackers, 7-Zip, etc.). If an extraction fails, check the repository documentation for the recommended dependencies. Check which version you have with binwalk --help.

Practical Binwalk examples

Basic signature scan

binwalk firmware.bin

Prints a table with the offset (decimal and hexadecimal) and a description of each signature found: uImage headers, LZMA-compressed kernels, squashfs filesystems and so on.

Extract what it finds: binwalk -e

binwalk -e firmware.bin

Automatically extracts the recognised data. In v2 a _firmware.bin.extracted folder is created; in v3 results go to an extractions directory by default. You can pick another folder with -C:

binwalk -e -C output/ firmware.bin

Recursive extraction: binwalk -Me

binwalk -Me firmware.bin

The -M ("matryoshka") option rescans whatever gets extracted, so if a gzip contains a tar holding a squashfs image, Binwalk peels it layer by layer. It is the easiest way to reach a firmware's root filesystem.

Entropy analysis: binwalk -E

binwalk -E firmware.bin

Calculates entropy across the file. Flat regions close to 1 indicate compressed or encrypted data; sharp drops usually mark headers or text. If a firmware shows no recognisable signatures and entropy is high throughout, it is probably encrypted and you will need another route (for example, finding the decryption routine in an older version).

Using it in a steganography challenge

file image.png
binwalk image.png
binwalk -e image.png

If a Zip archive data signature appears after the end of the PNG, a file has been appended. Extract it and, if it is password-protected, keep investigating the image (metadata, strings) for clues. To carve a specific range manually, use dd with the offset Binwalk gives you:

dd if=image.png of=hidden.zip bs=1 skip=12345

Remember: only analyse your own firmware and files, CTF material, or files you are authorised to examine.

Pro tips

• Beware of false positives: short signatures can appear by chance in random data. Check size and context.
• Combine Binwalk with strings, hexdump -C and file. Binwalk tells you where to look; those tools tell you what is there.
• Run extractions in a VM or isolated directory: firmware may contain odd symlinks or paths.
• For network traffic and captures, use NetworkMiner; to decode loose chunks of data, CyberChef.

Pros and cons

Pros	Cons
Free and open source	Older tutorials cover v2 and do not always apply to v3
Very convenient recursive extraction	Relies on external tools for some formats
v3 is very fast on large files	No help with encrypted firmware

Alternatives and complementary tools

• Ghidra: to analyse the extracted binaries.
• CyberChef: in-browser data decoding and manipulation.
• NetworkMiner: network forensics and file extraction from PCAP captures.
• Foremost or Scalpel: classic file carving, handy as a second opinion.

Frequently asked questions

Is Binwalk free?

Yes, it is free software available from its GitHub repository or your distribution's repositories.

What does binwalk -e do?

It automatically extracts the files and filesystems it recognises inside the binary. With -Me it does so recursively.

What is the difference between Binwalk v2 and v3?

v2 is written in Python and v3 is a faster Rust rewrite. The main options (-e, -M, -E, -C) remain, but some v2 features do not exist in v3.

Can Binwalk be used for steganography?

It detects embedded or concatenated files. For techniques such as LSB in images you will need dedicated tools like zsteg or steghide.

If you want to practise forensics and file analysis with guided challenges, you can do so at the Hackers en Acción Academy.