Binwalk

Binwalk is the standard first tool for taking apart a router, camera or IoT firmware image. Point it at the file and it lists every recognizable object inside with its byte offset: a U-Boot header at 0x40, a gzip-compressed kernel at 0x20000, a SquashFS root file system at 0x1A0000. Add the extraction flag and it carves each object out into a folder.

The 3.x series is a full rewrite in Rust. Earlier Python versions matched on magic bytes alone, which produced a long tail of false hits. The new parsers read the actual structure of each format, so a match has to make sense as a header before it is reported, and every result carries a high, medium or low confidence rating.

Recursive extraction (binwalk -Me) keeps unpacking until nothing new appears, which handles firmware that nests a file system inside a compressed image inside a container. Entropy analysis plots where data is compressed or encrypted, and JSON output feeds the results into scripts. The Rust crate doubles as a library for your own tools.

Binwalk runs natively on 64-bit Linux and macOS; on Windows it runs through WSL or the official Docker image. More than 100 signatures ship built in, and some extraction formats call out to external tools such as sasquatch or 7z that you install separately. The project is MIT licensed and all analysis happens locally.