ospg / binwalk

Firmware Analysis Tool

Binwalk

Binwalk is a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images.

Important notice

This is a fork of the original code from ReFirmLabs. This fork is maintained by the community and there is no relation between the maintainers of this fork and the original authors or the original company (though we greatly appreciate their work).

If you want to contribute feel free to open issues, pull requests, or even ask to be added to the repository to help with reviewing and merging PR.

Alternative software

There seems to exist a well-maintained alternative called unblob. According to some reports it has better extraction capabilities (are able to extract more data and faster). The downside is that it doesn't detect as much filetypes as binwalk. Another important difference is the number of dependencies: while binwalk doesn't require any dependency (they are optional), unblob depends on almost 20 packages.

*** Extraction Security Notice ***

Prior to Binwalk v2.3.3, extracted archives could create symlinks which point anywhere on the file system, potentially resulting in a directory traversal attack if subsequent extraction utilties blindly follow these symlinks. More generically, Binwalk makes use of many third-party extraction utilties which may have unpatched security issues; Binwalk v2.3.3 and later allows external extraction tools to be run as an unprivileged user using the run-as command line option (this requires Binwalk itself to be run with root privileges). Additionally, Binwalk v2.3.3 and later will refuse to perform extraction as root unless --run-as=root is specified.

Installation and Usage

• Installation
• API
• Supported Platforms
• Getting Started
• Binwalk Command Line Usage
• Binwalk IDA Plugin Usage

More information on Wiki

binwalk's Issues

FDT uboot image fails to extract

File and log attached.

uboot_b.zip
error.log

Preservation of file timestamps

Hello, thanks for accepting the job of maintaining the project

As you probably know, cpio files are handled as "special", using the plugins.cpio module rather than the configuration file:

binwalk/src/binwalk/plugins/cpio.py

Line 47 in 3dd13d7

result = subprocess.call(['cpio', '-d', '-i', '--no-absolute-filenames'],

The extraction command is straightforward, but I've found the need to make a slight modification, specifically adding -m/--preserve-modification-time

I use that because it makes it easier to quickly get an idea of how old the files in the archive are

It's often especially helpful if you have, for example, a bundle of blobs with non-descriptive names, and you would like to identify the most recent

I don't think the current behavior is a bug and am therefore not sending a PR with this, unless there's some consensus about whether it's desirable or not

A couple of downsides of making this change that I can think of:

• It may break someone's automated workflow, if said workflow depends on the mtimes being set to the time of unpacking (current behavior) rather than a time closer to the time of packing
• The modification times in an archive may not always be correct or meaningful anyway, which could cause confusion

In my case, it's proven really useful, though

Thoughts on making this change (or accepting a very small PR for it)?

Thx

EDIT: I considered at one time having a runtime option in binwalk cli to influence this behavior for all archive types that supported timestamps, but ultimately decided it wasn't worth the effort for my one-off use-case, where I only needed it for cpio

Change url and deps.sh of the jefferson

Hi. Thank you for the nice maintenance!

jefferson's description as follows
https://github.com/sviehb/jefferson

Jefferson is now maintained and released from https://github.com/onekey-sec/jefferson/.

This repository should not be relied upon to install Jefferson. We recommend you either clone from https://github.com/onekey-sec/jefferson/ or install from pip using pip install --user jefferson.

binwalk -BE crash

Hello,
when executin binwalk -BE with certain files, we get exceptions.
echo '/sys/class/net/wifi0 -o "${dirs#ath}" = "${dirs}" ];then' > t && binwalk -BE t

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Unix path: /sys/class/net/wifi0 -o "${dirs#ath}" = "${dirs}" ];then

Traceback (most recent call last):
  File "/usr/lib/python3.11/site-packages/matplotlib/backends/backend_qt.py", line 459, in _draw_idle
    self.draw()
  File "/usr/lib/python3.11/site-packages/matplotlib/backends/backend_agg.py", line 388, in draw
    self.figure.draw(self.renderer)
  File "/usr/lib/python3.11/site-packages/matplotlib/artist.py", line 95, in draw_wrapper
    result = draw(artist, renderer, *args, **kwargs)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/artist.py", line 72, in draw_wrapper
    return draw(artist, renderer)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/figure.py", line 3154, in draw
    mimage._draw_list_compositing_images(
  File "/usr/lib/python3.11/site-packages/matplotlib/image.py", line 132, in _draw_list_compositing_images
    a.draw(renderer)
  File "/usr/lib/python3.11/site-packages/matplotlib/artist.py", line 72, in draw_wrapper
    return draw(artist, renderer)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/axes/_base.py", line 3070, in draw
    mimage._draw_list_compositing_images(
  File "/usr/lib/python3.11/site-packages/matplotlib/image.py", line 132, in _draw_list_compositing_images
    a.draw(renderer)
  File "/usr/lib/python3.11/site-packages/matplotlib/artist.py", line 72, in draw_wrapper
    return draw(artist, renderer)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/legend.py", line 769, in draw
    bbox = self._legend_box.get_window_extent(renderer)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/offsetbox.py", line 399, in get_window_extent
    bbox = self.get_bbox(renderer)
           ^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/offsetbox.py", line 366, in get_bbox
    bbox, offsets = self._get_bbox_and_child_offsets(renderer)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/offsetbox.py", line 484, in _get_bbox_and_child_offsets
    bboxes = [c.get_bbox(renderer) for c in self.get_visible_children()]
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/offsetbox.py", line 484, in <listcomp>
    bboxes = [c.get_bbox(renderer) for c in self.get_visible_children()]
              ^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/offsetbox.py", line 366, in get_bbox
    bbox, offsets = self._get_bbox_and_child_offsets(renderer)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/offsetbox.py", line 511, in _get_bbox_and_child_offsets
    bboxes = [c.get_bbox(renderer) for c in self.get_visible_children()]
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/offsetbox.py", line 511, in <listcomp>
    bboxes = [c.get_bbox(renderer) for c in self.get_visible_children()]
              ^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/offsetbox.py", line 366, in get_bbox
    bbox, offsets = self._get_bbox_and_child_offsets(renderer)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/offsetbox.py", line 484, in _get_bbox_and_child_offsets
    bboxes = [c.get_bbox(renderer) for c in self.get_visible_children()]
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/offsetbox.py", line 484, in <listcomp>
    bboxes = [c.get_bbox(renderer) for c in self.get_visible_children()]
              ^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/offsetbox.py", line 366, in get_bbox
    bbox, offsets = self._get_bbox_and_child_offsets(renderer)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/offsetbox.py", line 511, in _get_bbox_and_child_offsets
    bboxes = [c.get_bbox(renderer) for c in self.get_visible_children()]
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/offsetbox.py", line 511, in <listcomp>
    bboxes = [c.get_bbox(renderer) for c in self.get_visible_children()]
              ^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/offsetbox.py", line 799, in get_bbox
    bbox, info, yd = self._text._get_layout(renderer)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/text.py", line 381, in _get_layout
    w, h, d = _get_text_metrics_with_cache(
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/text.py", line 69, in _get_text_metrics_with_cache
    return _get_text_metrics_with_cache_impl(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/text.py", line 77, in _get_text_metrics_with_cache_impl
    return renderer_ref().get_text_width_height_descent(text, fontprop, ismath)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/backends/backend_agg.py", line 217, in get_text_width_height_descent
    self.mathtext_parser.parse(s, self.dpi, prop)
  File "/usr/lib/python3.11/site-packages/matplotlib/mathtext.py", line 79, in parse
    return self._parse_cached(s, dpi, prop, antialiased)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/mathtext.py", line 100, in _parse_cached
    box = self._parser.parse(s, fontset, fontsize, dpi)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/matplotlib/_mathtext.py", line 2165, in parse
    raise ValueError("\n" + ParseException.explain(err, 0)) from None
ValueError: 
Unix path: /sys/class/net/wifi0 -o "${dirs#ath}" = "${dirs}" ];then
                                    ^
ParseException: Expected end of text, found '$'  (at char 36), (line:1, col:37)

matplotlib tries to parse it as latex maybe?

NotADirectoryError for /binwalk/magic

I am running binwalk in a docker container which runs Debian 12 and python 3.10.12. I installed from this repository in the dockerfile (as root) as follows:

RUN wget --progress=dot:giga https://github.com/OSPG/binwalk/archive/master.zip &&\
  unzip master.zip
WORKDIR ${homedir}/binwalk-master
RUN python setup.py uninstall && python setup.py install
RUN chmod +x ./deps.sh && ./deps.sh --yes

Subsequently running binwalk in the container through bash gives no output, Running the following minimal example in the container

import binwalk

binwalk.scan()

gives the output:

Traceback (most recent call last):
  File "/home/path/to/minimal_test.py", line 3, in <module>
    binwalk.scan()
  File "/usr/local/lib/python3.10/site-packages/binwalk-2.4.1-py3.10.egg/binwalk/__init__.py", line 14, in scan
  File "/usr/local/lib/python3.10/site-packages/binwalk-2.4.1-py3.10.egg/binwalk/core/module.py", line 795, in execute
  File "/usr/local/lib/python3.10/site-packages/binwalk-2.4.1-py3.10.egg/binwalk/core/module.py", line 720, in list
  File "/usr/local/lib/python3.10/site-packages/binwalk-2.4.1-py3.10.egg/binwalk/core/settings.py", line 51, in __init__
  File "/usr/local/lib/python3.10/site-packages/binwalk-2.4.1-py3.10.egg/binwalk/core/settings.py", line 77, in _magic_signature_files
  File "/usr/local/lib/python3.10/site-packages/binwalk-2.4.1-py3.10.egg/binwalk/core/settings.py", line 70, in list_files
NotADirectoryError: [Errno 20] Not a directory: '/usr/local/lib/python3.10/site-packages/binwalk-2.4.1-py3.10.egg/binwalk/magic'

Is there a way I can fix this installation?

Request: add a code example to "Signature File Format" of wiki

Could you please add the code example below?
This is a request from me who lacks understanding. :D

• adjust and many and location of Tagging Metadata

https://github.com/OSPG/binwalk/wiki/Signature-File-Format