Binwalk

Binwalk is a specialized tool library for analyzing binary blobs and executable code, with a focus on identifying embedded files within firmware images. It leverages the libmagic library used by the Unix file utility and extends it with custom magic signatures optimized for firmware analysis, covering compressed/archived files, firmware headers, Linux kernels, bootloaders, filesystems, and more.

The tool supports multiple analysis modes including signature scanning, disassembly, entropy analysis, and automatic extraction of embedded content. It's particularly valuable for reverse engineering firmware from IoT devices, routers, and embedded systems where multiple file types and compressed data are layered within a single binary image.

Binwalk provides both command-line and Python library interfaces, making it suitable for both manual analysis and automated scripts. The package includes an empty binary wrapper since the core functionality is delivered through the python3-binwalk library dependency.

Binwalk scans binary files using magic signatures from libmagic and its custom firmware-specific signature file to identify embedded files, headers, and code patterns. It supports signature-based detection (-B), raw byte sequence matching (-R), opcode scanning (-A), and disassembly with capstone (-Y). For extraction, it automatically recognizes and decompresses known file types, supports recursive matryoshka extraction (-M), and can execute custom commands for specific signature types (-D). Entropy analysis (-E) helps identify compressed or encrypted regions, while binary diffing (-W) compares multiple files.