binwalk Cheat Sheet

Firmware and file analysis tool that scans for embedded files and extracts hidden archives.

Exploitation & PayloadscarvingfirmwaresteganographyUpdated 2026-06-02

Overview

binwalk identifies embedded files, compression, and filesystems inside firmware images, disk dumps, and polyglot files. Common in IoT CTFs and firmware RE before manual extraction.

Authorized testing only. Use only on systems, networks, and accounts you own or have explicit written permission to test. Unauthorized access is illegal.

Install

sudo apt install -y binwalk

Python module (latest signatures)

pip install binwalk

Essential commands

Signature scan

binwalk firmware.bin

Extract known types automatically

binwalk -e firmware.bin

Verbose / entropy

binwalk -v firmware.bin

binwalk -E firmware.bin

Common workflows

Firmware extraction —

binwalk firmware.bin

binwalk -e --run-as=root firmware.bin

cd _firmware.bin.extracted/

ls -la

file squashfs-root/*

Recursive extraction —

binwalk -Me firmware.bin

Matryoshka / nested archives —

binwalk -e image.png

binwalk -e _image.png.extracted/DEADBEEF.zip

strings -n 8 _image.png.extracted/*

Entropy analysis (packing / encryption) —

binwalk -E -J firmware.bin

Manual carve at offset —

binwalk firmware.bin

dd if=firmware.bin bs=1 skip=123456 of=carved.squashfs

unsquashfs carved.squashfs

Flags reference

`-e`	Extract files to _<input>.extracted/
`-M`	Recursive scan of extracted content
`-r`	Include raw compression scans
`-A`	Scan for architecture-specific code
`-E`	Plot entropy
`-W`	Save entropy as PNG
`--dd='type:ext'`	Custom extraction rule
`-y`	Auto-answer yes to prompts

Tips

Install squashfs-tools, jefferson (JFFS2), ubi_reader for common embedded FS types.
If extraction fails, note decimal offset from binwalk and dd manually.
Compare binwalk vs foremost — binwalk is signature-smart; foremost is blind carving.
Run strings and file on carved segments after extraction.