Skip to content
Get packs

Guide · Open source

How to use binwalk: scan and extract firmware images

Updated · written with AI from the project's own documentation and checked against our catalogue data

Binwalk is an open-source firmware analysis tool, written in Rust, that scans a file such as a router or device firmware image and identifies other files and data embedded inside it. It can optionally extract those pieces. This guide shows you how to get it running, scan a file, and understand what its output and entropy analysis tell you.

BinwalkReFirmLabs/binwalk · ★ 14.6k · MIT

Quick start

  1. 1Choose an install method. The README recommends building a Docker image, which installs binwalk and its dependencies together. Cargo is the alternative.
  2. 2Clone the repository. Run git clone on the ReFirmLabs/binwalk repository to get the project files.
  3. 3Build or install binwalk. Follow the wiki page for Docker, Cargo or compiling from source to finish the installation.
  4. 4Scan a firmware file. Run binwalk followed by the firmware file name to list the embedded files and data it finds.
  5. 5Check the options. Run binwalk --help to see the options available in your version.
  6. 6Try entropy analysis. When a section is unidentified, use the entropy analysis feature described in the wiki to check whether it looks compressed or encrypted.

What binwalk does

Binwalk can identify, and optionally extract, files and data that have been embedded inside other files. Its primary focus is firmware analysis, but it supports a wide variety of file and data types.

Binwalk also offers entropy analysis. This can help you identify unknown compression or encryption, because compressed or encrypted sections look different from ordinary data when graphed.

Install binwalk with Docker

The README says the easiest way to install Binwalk and all its dependencies is to build a Docker image. The project wiki has a page on building the Docker image.

Start by cloning the repository with the command below, then follow the Docker build instructions in the wiki.

  • Docker is the method the README recommends.
  • The alternative is the Rust package manager (Cargo), which the README also mentions via the wiki's Cargo installation page.
  • You can also compile from source, following the wiki's compile instructions.
git clone https://github.com/ReFirmLabs/binwalk

Run your first scan

Usage is run from a terminal. To analyse a firmware image, pass its file name to binwalk. The README uses a D-Link router firmware file as its example.

Results list the files and data found inside the input. Use the README example output as a reference for what a scan looks like.

binwalk DIR-890L_AxFW110b07.bin

Get help and advanced options

Run the help flag to see the options your installed version supports. The README points to the project wiki's usage section for more advanced options.

The README does not list extraction flags or other options itself, so check the help output or wiki for the exact syntax before you rely on a flag.

  • Use --help to list available options.
  • Read the Wiki usage section for advanced options.
binwalk --help

Use entropy analysis to spot compression or encryption

Entropy analysis measures how random the bytes in a file are. The project wiki has a page on generating entropy graphs. Use it when a section of a file is unidentified and you suspect it is compressed or encrypted.

The README does not describe how to read entropy graphs in detail, so consult the wiki page for interpretation.

Use binwalk as a Rust library

If you want to script firmware analysis, binwalk can be customized and integrated into your own Rust projects. The wiki has a page on using it as a Rust library.

What people use it for

  • Examining device firmware images from routers or other devices for embedded file systems.
  • Finding compressed sections inside a firmware file and identifying their type.
  • Using entropy graphs to judge whether an unknown section is compressed or encrypted.
  • Scripting firmware analysis in Rust by integrating binwalk into your own project.

Frequently asked questions

Is binwalk free to use?

Yes. Binwalk is released under the MIT licence, as listed for this project. You can use, modify and distribute it under that licence's terms.

How do I install binwalk?

The README recommends building a Docker image, which installs binwalk and all dependencies. You can also install it with the Rust package manager (Cargo) or compile from source, with instructions on the project wiki.

What do I need to run binwalk?

The README lists Docker as the recommended route, or the Rust package manager (Cargo) as an alternative. You also need basic command-line experience, since binwalk runs from a terminal.

What does binwalk actually do?

It scans a file, such as a firmware image, and identifies other files and data embedded inside it. It can optionally extract those pieces.

Does binwalk have a graphical interface?

The README shows only command-line usage and does not describe a graphical interface. Plan to work from a terminal.

How does binwalk compare to unblob or Ghidra?

The project lists unblob, firmware-mod-kit and Ghidra as comparable projects. This guide does not compare their features, so check each project's documentation to choose between them for your task.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Binwalk suits security researchers, reverse engineers and Rust developers who are comfortable in a terminal and need to find embedded files or compressed sections in firmware. If you want a graphical tool or a general file converter, pick something else, since binwalk is command-line focused and built for firmware analysis.

Install options & downloads