binwalk — Security analysis and diagnostics

An analysis tool that identifies filesystems and files contained within firmware and disk images.

Basic Information

What is this program?

binwalk is a tool that uses signature scanning to find filesystems, compressed blocks, certificates, and more inside router and IoT device firmware or disk image binaries.

It is widely used as a first step when trying to understand what is inside a firmware file. Version 3, released in 2024, was completely rewritten in Rust with improvements in speed and reduced false positives.

What problems does it solve?

• When you need to understand the internal structure of IoT and network device firmware.
• When you need to check which partitions and filesystems are used in a disk image.
• When you need to find hidden compressed blocks, certificates, scripts, etc. inside files.
• When you need to verify during a security review that distributed binaries do not contain unexpected files.

Key features

Signature scanning

Marks potential file boundaries by comparing known magic bytes and signatures within the binary.

• Use case: Scans the entire firmware image.
• Result: Produces a list showing what type (compression, filesystem, etc.) may be present at each offset.
• Limitations: Because it is signature-based, false positives can occur, and v2 and v3 output formats differ.

File extraction

Extracts and decompresses identified blocks into actual files (expanded in v3).

• Use case: Used to analyze extracted root filesystem strings and configuration files.
• Result: Obtains contained busybox, configuration files, etc.
• Limitations: Damaged blocks may fail to decompress.

Entropy analysis

Calculates the information entropy of binary regions to visually distinguish compressed and encrypted sections.

• Use case: See where plaintext and encrypted blocks begin.
• Result: Estimates section boundaries from the entropy curve.
• Limitations: Entropy alone cannot determine exact file types.

Docker and cross-platform support

v3 officially provides a Dockerfile and Windows builds.

• Use case: Used by teams that need to keep analysis environments consistent.
• Result: Creates a reproducible analysis environment with containers.
• Limitations: No GUI, so post-processing of extracted results requires separate tools.

Installation and execution

pip (v3)

Rust-based v3 builds from source from the repository. Requires cargo.

git clone https://github.com/ReFirmLabs/binwalk
cd binwalk
cargo install --path .

Ubuntu / Debian (v2 repository version)

The distribution repository version may be from the v2 series.

sudo apt update
sudo apt install binwalk

Docker

Create a container environment using the Dockerfile from the official repository.

# Refer to the repository Dockerfile: https://github.com/ReFirmLabs/binwalk

Practical usage examples

Basic scan

Scans a firmware file and lists structures that may be contained in it.

binwalk firmware.bin

File extraction

Extracts identified items into an extraction directory. (v3 as reference, output is an example)

binwalk -e firmware.bin

Entropy analysis

Draws an entropy curve to estimate compression and encryption.

binwalk -E firmware.bin

Pros and cons

Advantages

• Allows the fastest overall structure assessment during initial firmware and image investigation.
• MIT license allows free commercial use.
• v3 is Rust-based, faster than before, and has fewer false positives.
• CLI makes it easy to integrate into scripts and automation pipelines.

Considerations before use

• Because it is signature-based, the results must not be fully trusted and require follow-up verification.
• Compared to GUI reversing tools, its in-depth analysis capabilities are limited.
• Distribution repository versions may still be v2, so checking the official repository is necessary.
• Security validation of extracted files is the user's responsibility (beware of malicious images).

Comparison with similar programs

Official resources and further learning

• Official homepage — https://github.com/ReFirmLabs/binwalk
• Official documentation / knowledge base — https://github.com/ReFirmLabs/binwalk#readme
• Official download — https://github.com/ReFirmLabs/binwalk/releases
• Release notes — https://github.com/ReFirmLabs/binwalk/releases
• Source / development resources — https://github.com/ReFirmLabs/binwalk

Version and supported environment information is based on values confirmed on the official site as of 2026-10-18. Installation commands may vary depending on your distribution and version, so please also check the official installation documentation.

Actual execution screen

This is a synthetic example of a binwalk signature scan result recreated in a server-like style. The screen is a composite example and not actual execution output.

!binwalk firmware scan result: screen showing uImage header, LZMA compression, and Squashfs filesystem offsets

Actual production server

Source (HTML): https://games.aidebatehub.com/programs/apps/security/binwalk.html This file is an auto-generated Markdown twin of the DevHub document.