binwalk

binwalk scans binary files for embedded file signatures, compressed data, and filesystem images. It's one of the first tools to run on any unknown file in CTF forensics and steganography challenges.

Analysis Decision Tree

Installation

sudo apt install binwalk
# Or latest:
pip3 install binwalk

Core Operations

binwalk file.bin          # Scan for signatures
binwalk -B file.bin       # Explicit signature scan (same as default)
binwalk *.bin             # Scan multiple files

# Example output:
# DECIMAL   HEXADECIMAL   DESCRIPTION
# 0         0x0           PNG image, 512 x 512
# 1234      0x4D2         Zip archive data, "flag.txt"
# 5678      0x162E        gzip compressed data

Binwalk Workflow Visualization

Binwalk helps identify file signatures and nested archives within binary data.

Systematic Analysis Workflow

file suspicious.*       # check actual file type
xxd suspicious.* | head -20  # inspect magic bytes
strings suspicious.* | head -50  # quick string check

binwalk suspicious.*

binwalk -Me suspicious.*
ls -la _suspicious.*/
find _suspicious.*/ -type f | sort

binwalk -E suspicious.*

# Extract bytes from offset 1234 to end:
dd if=suspicious.bin of=carved.zip bs=1 skip=1234
unzip carved.zip

Format-Specific Notes

Checklist

• binwalk file - scan before anything else
• binwalk -Me file - recursive extract if anything found
• binwalk -E file - entropy graph for hidden/encrypted regions
• Check _file.extracted/ for nested archives
• strings file | grep -i flag - quick win
• For images: also run zsteg (PNG) or steghide (JPEG)
• Manual dd carve when binwalk misses known magic bytes

Last updated on Aug 1, 2025