Binwalk
Find files and file systems hidden inside firmware and blobs
binwalk Forensics and reversing About
Binwalk looks for signatures of other files hidden inside a binary. Compressed archives, kernels, file systems. Reach for it when taking apart firmware images or any opaque blob.
Install it
pkg install binwalk
Run this inside Termux. If the package is already present, pkg will say so and
do nothing.
Commands worth knowing
5 of the invocations you will actually reach for. Tap the copy button to put one on your clipboard.
binwalk firmware.bin Scan a file and list every embedded signature, each with an offset. binwalk -e firmware.bin Scan, then extract whatever embedded files are recognised. They land in a directory beside the original. binwalk -A firmware.bin Look only for signatures that usually mark executable code. A quick check for instructions in a blob. binwalk -E firmware.bin Calculate Shannon entropy across the file. Compressed or encrypted blocks then stand out from plain text. binwalk -l report.txt firmware.bin Save the signature scan to a text file instead of the terminal. Useful for keeping a record. Worked example
Run binwalk firmware.bin and this is what you should see.
$ binwalk firmware.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 TRX firmware header, little endian
28 0x1C LZMA compressed data
1048576 0x100000 Squashfs filesystem, little endian The offsets tell you where each embedded structure begins.
Developed by
ReFirmLabs .