Binwalk
Definition
An open-source firmware analysis tool that scans a binary blob for known file signatures (squashfs, JFFS2, gzip, LZMA, certificates) and extracts the embedded file system. The de facto first step on any unknown firmware image.
- Type
- Open-source firmware analysis tool
- Method
- File signature scanning
- Detects
- squashfs, JFFS2, gzip, LZMA, certificates
- Role
- Typical first step on unknown firmware images
Common questions
What does binwalk actually produce for an investigator?+
It identifies embedded file system and compression signatures within the binary blob and can extract them, yielding a browsable file system that reveals configuration files, credentials, and executable code inside the firmware.
Does binwalk replace manual firmware reverse engineering?+
No, it automates the initial identification-and-extraction pass, but interpreting the extracted file system, disassembling binaries, and understanding device-specific logic still require further manual analysis.
Related terms
- CoAP
- Constrained Application Protocol (RFC 7252). A RESTful protocol over UDP on port 5683 (or 5684 with DTLS), designed for constrained devices that...
- DPDP Act 2023
- Digital Personal Data Protection Act 2023. India's general data protection statute, in force in phases from 2024. Applies to IoT-collected personal data...
- eMMC Dump
- Embedded Multi-Media Card flash chip extraction. The chip is desoldered (chip-off) or read in-circuit with an ISP adapter; the raw NAND or...
- JTAG
- Joint Test Action Group standard (IEEE 1149.1) for chip-level debugging. The test access port left on a phone's PCB lets a forensic...
- MQTT
- Message Queuing Telemetry Transport. A publish/subscribe protocol on TCP port 1883 (plain) or 8883 (TLS) with a central broker. Designed for low-bandwidth...
- UART
- Universal Asynchronous Receiver/Transmitter. A two-wire serial interface (TX, RX, GND, optional VCC) exposed on most IoT device boards as debug pads or...