Description

Binwalk is a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images.

Installation

$ sudo apt install binwalk

Usage: binwalk [OPTIONS] [FILE1] [FILE2] [FILE3] ...

-e, --extract: Automatically extract known file types
-D, --dd=<type: ext:cmd>; Extract <type> signatures, give the files an extension of <ext>, and execute <cmd>
-M, --matryoshka: Recursively scan extracted files
-d, --depth=<int>: Limit matryoshka recursion depth (default: 8 levels deep)
-C, --directory=<str>: Extract files/folders to a custom directory (default: current working directory)
-j, --size=<int>: Limit the size of each extracted file
-n, --count=<int>: Limit the number of extracted files
-r, --rm: Delete carved files after extraction
-z, --carve: Carve data from files, but don't execute extraction utilities
-V, --subdirs: Extract into sub-directories named by the offset

-E, --entropy: Calculate file entropy
-F, --fast: Use faster, but less detailed, entropy analysis
-J, --save: Save plot as a PNG
-Q, --nlegend: Omit the legend from the entropy plot graph
-N, --nplot: Do not generate an entropy plot graph
-H, --high=<float>: Set the rising edge entropy trigger threshold (default: 0.95)
-L, --low=<float>: Set the falling edge entropy trigger threshold (default: 0.85)

-W, --hexdump: Perform a hexdump / diff of a file or files
-G, --green: Only show lines containing bytes that are the same among all files
-i, --red: Only show lines containing bytes that are different among all files
-U, --blue: Only show lines containing bytes that are different among some files
-u, --similar: Only display lines that are the same between all files
-w, --terse: Diff all files, but only display a hex dump of the first file