Binwalk

Binwalk CTF Quick Reference

Introduction

Binwalk is a powerful tool primarily used for analyzing binary files to find embedded files and executable code within them. It scans for file signatures (magic bytes) that indicate the start of known file types.

In CTFs, Binwalk is essential for:

• Finding hidden files packed inside other files (e.g., images hidden in documents, archives hidden in executables, firmware analysis).
• Carving out embedded data structures.
• Identifying potential compression or encryption through entropy analysis.

It's a go-to tool in forensics challenges when you suspect a file contains more than meets the eye.

Basic Signature Scan

Goal: Scan a file for known file signatures (magic bytes).

binwalk <filename>

• This is the most fundamental command.
• Output shows the decimal offset, hexadecimal offset, and description of found signatures.

Extraction

Goal: Scan for signatures and automatically extract recognized file types.

# Scan and extract known file types
binwalk -e <filename>
# OR (same command)
binwalk --extract <filename>

• Creates a directory named _<filename>.extracted containing the carved files.
• Note: Extraction isn't perfect; it might miss files, create corrupted files, or extract overlapping data incorrectly. Always inspect results.

Goal: Recursively scan and extract files found within extracted files.

# Scan, Extract, and Scan/Extract recursively within extracted files
binwalk -eM <filename>

• -M : Recursively scan extracted files. Powerful but can take time and disk space.
• Use --matryoshka=<int> to limit recursion depth if needed.

Goal: Extract specific signature types only.

# Extract only files matching 'zip archive' description
binwalk -e --dd='zip archive.*' <filename>

# Extract only JPEGs
binwalk -e --dd='jpeg image.*' <filename>

• --dd='<type>.*' : Dump (extract) only files whose description matches the regex pattern.

Entropy Analysis

Goal: Analyze file entropy to identify potential compression, encryption, or obfuscated data.

# Perform entropy analysis
binwalk -E <filename>

# Perform entropy analysis and attempt to plot it (requires library setup)
binwalk -E -J <filename>

# Perform entropy analysis and save plot data to files (if plotting libraries fail)
binwalk -E --save <filename>

• High entropy regions often indicate compressed or encrypted data, which might warrant closer inspection.
• Low entropy often indicates null bytes, repetitive patterns, or uninitialized data.

Searching for Specific Signatures

Goal: Fine-tune the signature scan.

# Only show signatures matching 'zlib' (case-insensitive)
binwalk -I zlib <filename>
# OR
binwalk --include=zlib <filename>

# Exclude signatures matching 'png'
binwalk -X png <filename>
# OR
binwalk --exclude=png <filename>

# Use a custom magic signature file
binwalk -m /path/to/custom.magic <filename>

• -I / --include : Only display results containing this string.
• -X / --exclude : Exclude results containing this string.

Other Useful Options

• -r : Attempt to clean up extraction artifacts (e.g., partially extracted files due to errors).
• -l <int> : Limit scan depth to a certain number of bytes.
• -o <int> : Start scan at a specific byte offset.
• -A : Scan for common executable opcodes for specified architectures (e.g., x86, ARM). Useful for finding embedded code.
• -W / --hexdump : Show hex dump around signature matches.

CTF Tips

• Start with binwalk <filename> to get an overview.
• Use binwalk -e <filename> for quick extraction, but always examine the _*.extracted directory carefully. Check file sizes and types.
• Use binwalk -E <filename> to visually spot areas of high entropy (potential hidden data).
• If extraction fails or seems incomplete, manually carve data using tools like dd based on the offsets reported by Binwalk.
• Combine with other forensics tools like strings, exiftool, foremost, or scalpel.