binwalk is a command-line tool in Linux that is used to analyze and extract the contents of binary files. It is commonly used to reverse engineer firmware images or other types of binary files to discover hidden or encoded data, such as bootloaders, kernel images, or filesystems.
If you encounter the below error while running the binwalk command:
binwalk: command not found
you may try installing the below package as per your choice of distribution:
Distribution | Command |
---|---|
OS X | brew install binwalk |
Debian | apt-get install binwalk |
Ubuntu | apt-get install binwalk |
Arch Linux | pacman -S binwalk |
Kali Linux | apt-get install binwalk |
Fedora | dnf install binwalk |
Raspbian | apt-get install binwalk |
Once binwalk is installed, you can use it to analyze a binary file by running the binwalk command followed by the name of the file. binwalk will scan the file and attempt to identify any known data structures or patterns that it contains.
binwalk supports a variety of command-line options that allow you to customize the analysis and extraction process, such as the signature database to use, the output format, or the extraction options. You can use these options to fine-tune the analysis and extraction to suit your needs.
For more information on using binwalk, you can consult the binwalk documentation or use the binwalk –help command to view a list of available options and usage examples.
binwalk Command Examples
1. Scan a binary file:
# binwalk path/to/binary
2. Extract files from a binary, specifying the output directory:
# binwalk --extract --directory output_directory path/to/binary
3. Recursively extract files from a binary limiting the recursion depth to 2:
# binwalk --extract --matryoshka --depth 2 path/to/binary
4. Extract files from a binary with the specified file signature:
# binwalk --dd 'png image:png' path/to/binary
5. Analyze the entropy of a binary, saving the plot with the same name as the binary and `.png` extension appended:
# binwalk --entropy --save path/to/binary
6. Combine entropy, signature and opcodes analysis in a single command:
# binwalk --entropy --signature --opcodes path/to/binary