binwalk (1)

Contents

NAME
SYNOPSIS
DESCRIPTION
OPTIONS

NAME

binwalk - binary image search tool

SYNOPSIS

binwalk [OPTIONS] [FILE1] [FILE2] [FILE3] ...

DESCRIPTION

Binwalk is a tool for searching a given binary image for embedded files and executable code. Specifically, it is designed for identifying files and code embedded inside of firmware images. Binwalk uses the libmagic library, so it is compatible with magic signatures created for the Unix file utility.

OPTIONS

-o, --offset=<int>
File offset to start searching at
-l, --length=<int>
Number of bytes to search
-b, --align=<int>
Set byte alignment
-f, --file=<file>
Log results to file
-m, --magic=<file>
Magic file to use [/etc/binwalk/magic.binwalk]
-g, --grep=<string>
Only display results that contain the text <string>
-r, --raw-bytes=<string>
Search for a sequence of raw bytes inside the target file (implies -a, -d, -I)
-y, --search=<filter>
Only search for matches that have <filter> in their description (implies -t, -d, -k)
-x, --exclude=<filter>
Exclude matches that have <filter> in their description
-i, --include=<filter>
Include matches that are normally excluded and that have <filter> in their description *
-a, --all
Search for all matches, including those that are normally excluded *
-d, --defaults
Speed up scan by disabling default filters **
-I, --show-invalid
Show results marked as invalid ***
-t, --fast
Speed up scan by only loading signatures specified by -i or -y
-u, --update
Update magic signature files
-v, --verbose
Enable verbose mode
-s, --smart
Disable smart matching (implies -a)
-k, --keep-going
Don't stop at the first match (implies -I)
-c, --validate
Validate magic file
-q, --quiet
Supress output to stdout
-A, --opcodes
Scan for executable code (implies -a)
-C, --cast
Cast file contents as various data types (implies -k)

* Signatures of two bytes or less are excluded by default. Use -i or -a to include them in the search.

** Default filters include 'gzip', 'lzma' and 'jffs2' results.

Disabling the default filters (-d) will speed up scan time, but may miss these file types.

*** By default, all results that contain the text 'invalid' will not be shown. Use -I to display them.