Technical Documentation: ReFirmLabs/binwalk
ℹ️ Provenance: Multi-Tier Ingestion · CodeWiki Reference
Overview (`CARGO_README.md`)
binwalk
A Rust implementation of the Binwalk firmware analysis tool.
System Requirements
Building requires the following system packages:
build-essential libfontconfig1-dev liblzma-devExample
use binwalk::Binwalk;
// Create a new Binwalk instance
let binwalker = Binwalk::new();
// Read in the data to analyze
let file_data = std::fs::read("/tmp/firmware.bin").expect("Failed to read from file");
// Scan the file data and print the results
for result in binwalker.scan(&file_data) {
println!("{:#?}", result);
}Overview (`README.md`)
Binwalk v3
This is an updated version of the Binwalk firmware analysis tool, re-written in Rust for speed and accuracy.
What does it do?
Binwalk can identify, and optionally extract, files and data that have been embedded inside of other files.
While its primary focus is firmware analysis, it supports a wide variety of file and data types.
Through entropy analysis, it can even help to identify unknown compression or encryption!
Binwalk can be customized and integrated into your own Rust projects.
How do I get it?
The easiest way to install Binwalk and all dependencies is to build a Docker image.
Binwalk can also be installed via the Rust package manager.
Or, you can compile from source!
How do I use it?
Usage is simple, analysis is fast, and results are detailed:
binwalk DIR-890L_AxFW110b07.binUse --help, or check out the Wiki for more advanced options!
Overview (`dependencies/README.md`)
Binwalk Dependencies
These scripts install the required Binwalk build and runtime system dependencies, except for the Rust compiler itself.
Execute the appropriate script for your operating system (e.g., ubuntu.sh for Ubuntu).
ubuntu.sh
This script installs all required dependencies for Ubuntu-based systems, including the dependencies listed in pip.sh and src.sh.
This should work for most Debian / Debian-based systems as well, but is only tested on Ubuntu.
pip.sh
This script installs all Python-based dependencies via pip3.
It should be sourced by higher-level scripts (e.g., ubuntu.sh).
src.sh
This script builds and installs all source-based dependencies.
It should be sourced by higher-level scripts (e.g., ubuntu.sh).
Overview (`fuzzing/README.md`)
Fuzzing Binwalk
Fuzz testing for Binwalk is done through AFL++.
At the moment code coverage is not 100% complete, but exercises the file parsing code, which is the most problematic and error-prone.
Fuzzer Dependencies
You must have a C compiler and make installed, as well as the cargo-afl crate:
sudo apt install build-essentials
cargo install cargo-aflBuilding the Fuzzer
cargo afl build --releaseRunning the Fuzzer
You must provide an input directory containing sample files for the fuzzer to mutate.
You must provide an output directory for the fuzzer to save crash results to.
cargo afl fuzz -i input_directory -o output_directory ./target/release/fuzz--- METRICS ---
- Files Extracted: 4
- Estimated Token Budget: ~901 tokens
- Canonical Reference: https://codewiki.google/github.com/ReFirmLabs/binwalk