BINWALK(1)

💖 BINWALK(1) 💖

okay bestie, sit down, hydrate, because we're about to talk about the binwalk manual page and it's genuinely iconic. this is the User Commands section of the manual, and binwalk is that girl: she searches binary images for embedded files and executable code. no cap. she finds things. 🔍✨

---

🌸 NAME 🌸

binwalk — the tool for searching binary images for embedded files and executable code. she's a detective, she's a forensic queen, she's everything. 💅

---

🎀 SYNOPSIS 🎀

binwalk [OPTIONS] [FILE1] [FILE2] [FILE3] ...

like. give her options, give her files, give her multiple files if you want. she's not gonna complain. she's built different. 🫶

---

🦋 DESCRIPTION 🦋

This is Binwalk v2.3.2+dcb1403, brought to you by Craig Heffner, ReFirmLabs. the whole vibe lives at https://github.com/ReFirmLabs/binwalk and honestly? go look. iykyk. 🌈

---

✨ Signature Scan Options ✨

these are the "what even IS in this file" options. the vibe check, if you will.

• -B, --signature — scan your target file(s) for common file signatures. the classic. the main character move. 🔥
• -R, --raw=<str> — scan the target file(s) for a specific sequence of bytes that you pick. custom queen behavior. 💅
• -A, --opcodes — scan target file(s) for common executable opcode signatures. code vibes detected. ⚡
• -m, --magic=<file> — point her at a custom magic file to use. bring your own magic. 🪄
• -b, --dumb — disable smart signature keywords. yes the option is literally called dumb and yes we respect it. 💀
• -I, --invalid — show results that got marked as invalid. she's showing you the messy ones too, no gatekeeping. 🙈
• -x, --exclude=<str> — exclude results that match <str>. not today, babes. 🚫
• -y, --include=<str> — only show results that match <str>. yes only. tunnel vision. obsessed. 🎯

---

🌸 Extraction Options 🌸

this is where she stops just looking and starts taking. respectfully. 💖

• -e, --extract — automatically extract known file types. she does the work, you do the celebrating. 🎉
• -D, --dd=<type[:ext[:cmd]]> — extract <type> signatures (that's a regular expression, bestie), give the files an extension of <ext>, and execute <cmd>. three little fields, so much power. 👑
• -M, --matryoshka — recursively scan extracted files. like a nesting doll, like a plot twist inside a plot twist. 🪆
• -d, --depth=<int> — limit the matryoshka recursion depth. default is 8 levels deep. after that she's like okay babe we're done. ✋
• -C, --directory=<str> — extract files/folders to a custom directory. default is the current working directory. 🏠
• -j, --size=<int> — limit the size of each extracted file. portion control. 🍓
• -n, --count=<int> — limit the number of extracted files. we're not doing infinity today. 🔢
• -r, --rm — delete carved files after extraction. she cleans up after herself. 🧹
• -z, --carve — carve data from files, but don't execute extraction utilities. hands off, just take. 🫳
• -V, --subdirs — extract into sub-directories named by the offset. organized. aesthetic. folder structure slay. 🗂️

---

🧚 Entropy Options 🧚

chaos measurement time. how random is this file? let's find out. 🌪️

• -E, --entropy — calculate file entropy. numbers go brrr. 📈
• -F, --fast — use faster, but less detailed, entropy analysis. speed over detail, a tradeoff, we accept it. ⚡
• -J, --save — save the plot as a PNG. screenshots for the group chat. 🖼️
• -Q, --nlegend — omit the legend from the entropy plot graph. minimalism era. 🤍
• -N, --nplot — do not generate an entropy plot graph at all. no graph. zero graph. 📉
• -H, --high=<float> — set the rising edge entropy trigger threshold. default: 0.95. 📶
• -L, --low=<float> — set the falling edge entropy trigger threshold. default: 0.85. 📉

---

💜 Binary Diffing Options 💜

comparing files. sibling rivalry but make it forensics. 👯

• -W, --hexdump — perform a hexdump / diff of a file or files. 🧾
• -G, --green — only show lines containing bytes that are the same among all files. green = agree. 💚
• -i, --red — only show lines containing bytes that are different among all files. red = everyone's fighting. ❤️
• -U, --blue — only show lines containing bytes that are different among some files. blue = it's complicated. 💙
• -u, --similar — only display lines that are the same between all files. matching outfits. 👗
• -w, --terse — diff all files, but only display a hex dump of the first file. short and to the point. ✂️

---

🌈 Raw Compression Options 🌈

squished data detection. decompress your feelings. 🫧

• -X, --deflate — scan for raw deflate compression streams. 🎈
• -Z, --lzma — scan for raw LZMA compression streams. 🎀
• -P, --partial — perform a superficial, but faster, scan. surface level but make it quick. 🏃‍♀️
• -S, --stop — stop after the first result. one and done. ✋

---

⭐ General Options ⭐

the everything-else section. the supporting cast that is actually all leads. 💫

• -l, --length=<int> — number of bytes to scan. 📏
• -o, --offset=<int> — start scan at this file offset. start where i say. 📍
• -O, --base=<int> — add a base address to all printed offsets. math but cute. ➕
• -K, --block=<int> — set the file block size. 🧱
• -g, --swap=<int> — reverse every n bytes before scanning. flip it. 🔄
• -f, --log=<file> — log results to file. receipts. 🧾
• -c, --csv — log results to file in CSV format. spreadsheet girlies rise. 📊
• -t, --term — format output to fit the terminal window. aesthetics matter. 🖥️
• -q, --quiet — suppress output to stdout. shhh. 🤫
• -v, --verbose — enable verbose output. tell me EVERYTHING. 🗣️
• -h, --help — show help output. when in doubt. 🆘
• -a, --finclude=<str> — only scan files whose names match this regex. selective. 💅
• -p, --fexclude=<str> — do not scan files whose names match this regex. blocked. 🚷
• -s, --status=<int> — enable the status server on the specified port. she's online. 🌐

bestie reminder: options that take a value use the = form exactly like it says above, and those <str>, <int>, <float> and <file> bits are placeholders — swap in your own, don't type the angle brackets literally. 🫶

---

and that's the whole page, no skips, no summaries, every flag accounted for. 💖

binwalk 2.3.2 — September 2021 🌸 that's the version and the date, mwah, bye bestie, go carve something iconic 💅✨🦋