PAGES
← all tools
◆ Reverse Engineering

binwalk

v3.1.0 open-source

Binwalk is a firmware analysis tool that identifies and optionally extracts files and data embedded inside other files.

source ↗ rss ↗ What is a cyber toolchain?

Summary

binwalk is an open-source reverse-engineering tool, rewritten in Rust, that identifies and extracts files and data embedded inside other files, with a primary focus on firmware images. It runs as a command-line utility, installed via Docker, the Rust package manager, or compiled from source, and it can also be embedded as a library in Rust projects for custom analysis pipelines. It suits firmware analysts and reverse engineers who need to pull filesystems, compressed data, or encrypted volumes out of a binary blob, with signature detection covering formats like NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT., APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices., BTRFS, and LUKSLUKSA disk-encryption standard built into the Linux kernel that stores encryption metadata in a header on the volume itself, letting cyber tools unlock encrypted drives portably across distributions and implementations., plus entropy analysis to flag unknown compression or encryption. First committed in 2013 and maintained by 111 contributors, it has seen 10 commits in the past year across 11 tracked releases, though the last release landed 659 days ago.

Binwalk is a firmware analysis tool that identifies and optionally extracts files and data embedded inside other files.

How binwalk helps

What kinds of files or filesystems are hidden inside this firmware image?

scans the binary for known signatures and reports every embedded file type it recognizes, including NTFS, APFS, BTRFS, and other filesystem headers, at the offset where each one starts

Is any part of this firmware image encrypted or compressed in a way that hides its contents?

runs entropy analysis across the file and flags regions of unusually high randomness that suggest unknown compression or encryption, even when no signature matches

Can I pull the embedded filesystem or data out of this blob without manually calculating offsets?

extracts the identified files and data automatically once it locates their signatures, writing them out as separate files instead of just reporting where they sit

Does this device image contain an encrypted disk volume I need to account for?

checks for LUKS header signatures and calls out any encrypted volume it finds so it isn't mistaken for opaque or corrupted data

Is this firmware dump from a device type with a nonstandard header format?

matches the file against vendor-specific header signatures, such as TP-Link RTOS and Autel drone firmware, that a generic file-type check would miss

Can I fold this kind of scan into my own analysis pipeline instead of running it by hand each time?

can be embedded as a library in a Rust project, letting a custom pipeline call the same signature and extraction logic programmatically

all 6 features, with the evidence for each →

Languages

Not documented

Features

6 capabilities

Built from binwalk's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date.

Compare with peers →

All capabilities 6 capabilities
Deployment flexibility shipped Supports execution on Windows and via Docker containers for portable deployment. 6 releases · 3 other sources · first seen Jul 2014

release

  • Supports native Windows compilation. v3.1.0 · Oct 2024 · source · release history
  • Adds Docker container support for portable deployment. v3.1.0 · Oct 2024 · source · release history
  • Adds --run-as command line option to allow users to control the privilege level external extractors are given as well as the power to run as root if they so choose. v2.3.3 · Sep 2021 · source · release history
  • Adds new ida_binwalk plugin for running binwalk inside the IDA Pro IDE v2.1.1 · Dec 2015 · source · release history
  • Drops support for Python 2, requiring the tool to run on a Python 3 environment v2.0.0 · Jul 2014 · source · release history
  • Adds native Python 3 support, dropping the requirement for Python 2 v2.0.0 · Jul 2014 · source · release history

example

  • Run an external extractor with elevated privileges when analyzing a firmware image requiring root access. binwalk --run-as root firmware.bin v2.3.3 · Sep 2021 · source
  • Drop privileges for extraction to enhance safety during automated analysis pipelines. binwalk --run-as nobody firmware.bin v2.3.3 · Sep 2021 · source
  • Install the plugin to enable binwalk functionality directly within the IDA Pro interface. Copy `ida_binwalk.py` to your IDA plugins directory and restart IDA. v2.1.1 · Dec 2015 · source
Filesystem signature detection and extraction shipped Identifies and extracts data from specific filesystem formats including BTRFS, APFS, NTFS, and Chroot paths. 5 releases · first seen Jul 2014

release

  • Adds BTRFS filesystem signature detection and extraction support. v3.1.0 · Oct 2024 · source · release history
  • Adds APFS filesystem signature detection and extraction support. v3.1.0 · Oct 2024 · source · release history
  • Supports Chroot path extraction on Windows. v3.1.0 · Oct 2024 · source · release history
  • Adds NTFS filesystem signature detection and extraction support. v3.1.0 · Oct 2024 · source · release history
  • Expands signature database with more and improved signatures v2.0.0 · Jul 2014 · source · release history
Firmware and binary header signature detection shipped Detects specific firmware, binary, and RTOS headers including BIN, WinCE, TP-Link RTOS, and Autel-encoded drone firmware. 4 releases · 1 other source · first seen Dec 2015

release

example

  • Run a disassembly scan on a firmware image to extract and analyze code sections. binwalk --disassemble firmware.bin v2.1.1 · Dec 2015 · source
Encrypted volume detection shipped Identifies encrypted disk volumes within firmware images via LUKS header detection. 3 releases · first seen Jul 2014

release

  • Adds LUKS header detection for identifying encrypted disk volumes in firmware images. v3.1.0 · Oct 2024 · source · release history
  • Improves scan speed through optimized code paths v2.0.0 · Jul 2014 · source · release history
  • Increases performance of entropy scans v2.0.0 · Jul 2014 · source · release history
Integrated Disassembly Scanning shipped Runs disassembly scans on firmware images using the Capstone Engine to extract and analyze code sections. 1 release · first seen Dec 2015

release

  • Adds --disassemble flag to run disassembly scans using the Capstone Engine v2.1.1 · Dec 2015 · source · release history
Raw deflate detection and extraction shipped Detects and extracts data using raw deflate signatures. 1 release · first seen Jul 2014

release

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for binwalk, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail binwalk puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

4 entries

  1. October 20241
  3. September 20211
  5. December 20151
  7. July 20141
    Show

    4 entries

    1. v3.1.0 Oct 31, 2024 · release notes

      binwalk v3.1.0 rewrites the tool in Rust, adding LUKSLUKSA disk-encryption standard built into the Linux kernel that stores encryption metadata in a header on the volume itself, letting cyber tools unlock encrypted drives portably across distributions and implementations., NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT., APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices., BTRFS, WinCE, and Autel firmware support with Windows compilation.

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.1.0 https://github.com/ReFirmLabs/binwalk.git
# already have the repo? check out this version:
$ git checkout v3.1.0
      • Complete rewrite in Rust delivers significantly faster scanning with far fewer false positives.
      • Adds LUKS header detection for identifying encrypted disk volumes in firmware images.
      • Adds NTFS filesystem signature detection and extraction support.
      • Adds APFS filesystem signature detection and extraction support.
      • Adds BTRFS filesystem signature detection and extraction support.
      +7 more show less
      • Adds WinCE image signature detection support.
      • Adds detection and extraction support for Autel-encoded drone firmware.
      • Adds TP-Link RTOS firmware header signature detection.
      • Adds BIN firmware header signature detection.
      • Supports native Windows compilation.
      • Adds Docker container support for portable deployment.
      • Supports Chroot path extraction on Windows.

      12 details in Everything

    2. v2.3.3 Sep 10, 2021 · release notes

      Adds --run-as CLI flag to control extractor privilege levels

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.3.3 https://github.com/ReFirmLabs/binwalk.git
# already have the repo? check out this version:
$ git checkout v2.3.3
      └──▷ USE IT
      Run an external extractor with elevated privileges when analyzing a firmware image requiring root access.
      shell 
      binwalk --run-as root firmware.bin
      Drop privileges for extraction to enhance safety during automated analysis pipelines.
      shell 
      binwalk --run-as nobody firmware.bin
      • Adds --run-as command line option to allow users to control the privilege level external extractors are given as well as the power to run as root if they so choose.

      1 detail in Everything

    3. v2.1.1 Dec 23, 2015 · release notes

      binwalk v2.1.1 adds disassembly scans via Capstone, IDA plugin, and native Windows support.

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.1.1 https://github.com/ReFirmLabs/binwalk.git
# already have the repo? check out this version:
$ git checkout v2.1.1
      └──▷ TRY IT
      Run a disassembly scan on a firmware image to extract and analyze code sections.
      $ binwalk --disassemble firmware.bin
      Install the plugin to enable binwalk functionality directly within the IDA Pro interface.
      📍Copy ida_binwalk.py to your IDA plugins directory and restart IDA.
      • Adds --disassemble flag to run disassembly scans using the Capstone Engine
      • Adds new ida_binwalk plugin for running binwalk inside the IDA Pro IDE

      2 details in Everything

    4. v2.0.0 Jul 26, 2014 · release notes

      binwalk v2.0.0 adds Python 3 support, raw deflate extraction, faster entropy scans, and an improved API

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.0.0 https://github.com/ReFirmLabs/binwalk.git
# already have the repo? check out this version:
$ git checkout v2.0.0
      • Adds native Python 3 support, dropping the requirement for Python 2
      • Adds raw deflate detection and extraction capabilities
      • Improves scan speed through optimized code paths
      • Increases performance of entropy scans
      • Expands signature database with more and improved signatures

      5 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Drops support for Python 2, requiring the tool to run on a Python 3 environment

    Project health

    Issue, contributor and maintainer activity in ReFirmLabs/binwalk, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 −24 vs prior 12 months
    2. Maintainers 1 +2 joined · −2 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 18 days first maintainer reply 138 days
    6. Open backlog 61 of 556 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 61
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 14,359
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback