Brunn: Created page with "== Binwalk CTF Quick Reference == === Introduction === Binwalk is a powerful tool primarily used for analyzing binary files to find embedded files and executable code within them. It scans for file signatures (magic bytes) that indicate the start of known file types. In CTFs, Binwalk is essential for: * Finding hidden files packed inside other files (e.g., images hidden in documents, archives hidden in executables, firmware analysis). * Carving out embedded data struct..."

2025-05-02T17:35:59Z

Created page with "== Binwalk CTF Quick Reference == === Introduction === Binwalk is a powerful tool primarily used for analyzing binary files to find embedded files and executable code within them. It scans for file signatures (magic bytes) that indicate the start of known file types. In CTFs, Binwalk is essential for: * Finding hidden files packed inside other files (e.g., images hidden in documents, archives hidden in executables, firmware analysis). * Carving out embedded data struct..."

New page

== Binwalk CTF Quick Reference ==

=== Introduction ===
Binwalk is a powerful tool primarily used for analyzing binary files to find embedded files and executable code within them. It scans for file signatures (magic bytes) that indicate the start of known file types.

In CTFs, Binwalk is essential for:
* Finding hidden files packed inside other files (e.g., images hidden in documents, archives hidden in executables, firmware analysis).
* Carving out embedded data structures.
* Identifying potential compression or encryption through entropy analysis.

It's a go-to tool in forensics challenges when you suspect a file contains more than meets the eye.

=== Basic Signature Scan ===
'''Goal:''' Scan a file for known file signatures (magic bytes).
<syntaxhighlight lang="bash">
binwalk <filename>
</syntaxhighlight>
* This is the most fundamental command.
* Output shows the decimal offset, hexadecimal offset, and description of found signatures.

=== Extraction ===
'''Goal:''' Scan for signatures and automatically extract recognized file types.
<syntaxhighlight lang="bash">
# Scan and extract known file types
binwalk -e <filename>
# OR (same command)
binwalk --extract <filename>
</syntaxhighlight>
* Creates a directory named <code>_<filename>.extracted</code> containing the carved files.
* '''Note:''' Extraction isn't perfect; it might miss files, create corrupted files, or extract overlapping data incorrectly. Always inspect results.

'''Goal:''' Recursively scan and extract files found within extracted files.
<syntaxhighlight lang="bash">
# Scan, Extract, and Scan/Extract recursively within extracted files
binwalk -eM <filename>
</syntaxhighlight>
* <code>-M</code> : Recursively scan extracted files. Powerful but can take time and disk space.
* Use <code>--matryoshka=<int></code> to limit recursion depth if needed.

'''Goal:''' Extract specific signature types only.
<syntaxhighlight lang="bash">
# Extract only files matching 'zip archive' description
binwalk -e --dd='zip archive.*' <filename>

# Extract only JPEGs
binwalk -e --dd='jpeg image.*' <filename>
</syntaxhighlight>
* <code>--dd='<type>.*'</code> : Dump (extract) only files whose description matches the regex pattern.

=== Entropy Analysis ===
'''Goal:''' Analyze file entropy to identify potential compression, encryption, or obfuscated data.
<syntaxhighlight lang="bash">
# Perform entropy analysis
binwalk -E <filename>

# Perform entropy analysis and attempt to plot it (requires library setup)
binwalk -E -J <filename>

# Perform entropy analysis and save plot data to files (if plotting libraries fail)
binwalk -E --save <filename>
</syntaxhighlight>
* High entropy regions often indicate compressed or encrypted data, which might warrant closer inspection.
* Low entropy often indicates null bytes, repetitive patterns, or uninitialized data.

=== Searching for Specific Signatures ===
'''Goal:''' Fine-tune the signature scan.
<syntaxhighlight lang="bash">
# Only show signatures matching 'zlib' (case-insensitive)
binwalk -I zlib <filename>
# OR
binwalk --include=zlib <filename>

# Exclude signatures matching 'png'
binwalk -X png <filename>
# OR
binwalk --exclude=png <filename>

# Use a custom magic signature file
binwalk -m /path/to/custom.magic <filename>
</syntaxhighlight>
* <code>-I / --include</code> : Only display results containing this string.
* <code>-X / --exclude</code> : Exclude results containing this string.

=== Other Useful Options ===
* <code>-r</code> : Attempt to clean up extraction artifacts (e.g., partially extracted files due to errors).
* <code>-l <int></code> : Limit scan depth to a certain number of bytes.
* <code>-o <int></code> : Start scan at a specific byte offset.
* <code>-A</code> : Scan for common executable opcodes for specified architectures (e.g., x86, ARM). Useful for finding embedded code.
* <code>-W</code> / <code>--hexdump</code> : Show hex dump around signature matches.

=== CTF Tips ===
* Start with <code>binwalk <filename></code> to get an overview.
* Use <code>binwalk -e <filename></code> for quick extraction, but '''always''' examine the <code>_*.extracted</code> directory carefully. Check file sizes and types.
* Use <code>binwalk -E <filename></code> to visually spot areas of high entropy (potential hidden data).
* If extraction fails or seems incomplete, manually carve data using tools like <code>dd</code> based on the offsets reported by Binwalk.
* Combine with other forensics tools like <code>strings</code>, <code>exiftool</code>, <code>foremost</code>, or <code>scalpel</code>.

[[Category:Tools]]
[[Category:Forensics]]

Binwalk - Revision history