Binwalk Cheat Sheet

Binwalk looks inside a binary blob — most often a firmware image — and identifies what's embedded in it: filesystems, compressed archives, kernels, bootloaders, certificates. It's usually the first tool run against any firmware file, whether that file came off a chip in-circuit or straight from a vendor's support site.

Red Team / Offensive Use

On a hardware or embedded engagement, binwalk is how a firmware dump stops being an opaque blob and becomes a filesystem you can actually search — grep for hardcoded credentials, read init scripts to see what starts on boot, and check whether the update mechanism verifies what it's flashing. Entropy analysis is the other half: high-entropy regions that don't extract as anything recognizable are the tell for encryption, which is worth flagging even when it can't be broken outright.

Established Cheatsheet

Binwalk Wiki (ReFirmLabs) — the project's own documentation, including supported signatures and usage examples.

PWNMI's Top 5 Use Cases

• binwalk firmware.bin — signature scan; lists what's embedded and at what offset, without extracting anything. Always run this first.
• binwalk -e firmware.bin — extract everything binwalk recognizes into a _firmware.bin.extracted directory
• binwalk -Me firmware.bin — recursive extraction (matryoshka mode): extracts, then re-scans and extracts anything found inside what was just extracted — the default choice for a firmware image with nested archives or filesystems
• binwalk -E firmware.bin — entropy analysis; flags high-entropy regions that likely indicate compression or encryption, useful when a section doesn't extract as anything recognizable
• binwalk -A firmware.bin — opcode scan to identify the CPU architecture a binary blob was compiled for, useful before loading an unknown extracted binary into a disassembler

Note on versions: the flags above are for binwalk v2 (2.4.x), which is what apt install binwalk gives you on Kali as of 2026. A separate Rust rewrite, v3, ships as the binwalk3 package with a different flag set (--extract, --matryoshka, --entropy instead of short flags, and no direct equivalent for -A) — check binwalk --help against binwalk3 --help before assuming which one a given command targets.

Next step

Once something's extracted, Hardware Hacking Fundamentals covers what to actually do with a firmware filesystem once binwalk has pulled it apart — and where firmware extraction fits next to UART and JTAG access.