binwalk - tool for searching binary images for embedded files and
executable code
binwalk [OPTIONS] [FILE1] [FILE2]
[FILE3] ...
Binwalk v2.3.2+dcb1403 Craig Heffner, ReFirmLabs
https://github.com/ReFirmLabs/binwalk
- -e, --extract
- Automatically extract known file types
- -D,
--dd=<type[:ext[:cmd]]>
- Extract <type> signatures (regular expression), give the files an
extension of <ext>, and execute <cmd>
- -M,
--matryoshka
- Recursively scan extracted files
- -d,
--depth=<int>
- Limit matryoshka recursion depth (default: 8 levels deep)
- -C,
--directory=<str>
- Extract files/folders to a custom directory (default: current working
directory)
- -j,
--size=<int>
- Limit the size of each extracted file
- -n,
--count=<int>
- Limit the number of extracted files
- -r, --rm
- Delete carved files after extraction
- -z, --carve
- Carve data from files, but don't execute extraction utilities
- -V, --subdirs
- Extract into sub-directories named by the offset
- -W, --hexdump
- Perform a hexdump / diff of a file or files
- -G, --green
- Only show lines containing bytes that are the same among all files
- -i, --red
- Only show lines containing bytes that are different among all files
- -U, --blue
- Only show lines containing bytes that are different among some files
- -u, --similar
- Only display lines that are the same between all files
- -w, --terse
- Diff all files, but only display a hex dump of the first file
- -l,
--length=<int>
- Number of bytes to scan
- -o,
--offset=<int>
- Start scan at this file offset
- -O,
--base=<int>
- Add a base address to all printed offsets
- -K,
--block=<int>
- Set file block size
- -g,
--swap=<int>
- Reverse every n bytes before scanning
- -f,
--log=<file>
- Log results to file
- -c, --csv
- Log results to file in CSV format
- -t, --term
- Format output to fit the terminal window
- -q, --quiet
- Suppress output to stdout
- -v, --verbose
- Enable verbose output
- -h, --help
- Show help output
- -a,
--finclude=<str>
- Only scan files whose names match this regex
- -p,
--fexclude=<str>
- Do not scan files whose names match this regex
- -s,
--status=<int>
- Enable the status server on the specified port