binwalk (ReFirmLabs)

What it is

A command-line program, rewritten in Rust for version 3, that scans a binary blob for known file signatures. It identifies compressed archives, file systems, and executables inside the image and can carve them out.

What it helps with

- Unpacking router and IoT firmware images
- Finding hidden or embedded files in binaries
- Spotting encrypted or compressed areas with entropy analysis
- Carving known and unknown sections of a file to disk

Who it's for

Embedded security researchers, malware analysts, and forensic examiners.

Worth knowing

It officially supports 64-bit Linux, and building the project's Docker image is the easiest way to get it with all its dependencies.

What do I do with the extracted files?
In our view Ghidra or Rizin are natural next steps for analyzing the executables you pull out.

Can it handle very large files?
It needs at least as much free memory as the files being analyzed, so very large images may not fit on small systems.