---
name: "binwalk"
section: "1"
platform: "linux"
package: "binwalk"
version: "2.4.3+dfsg1-2+deb13u1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/binwalk"
---

# binwalk(1)

tool for searching binary images for embedded files and executable code

## NAME

binwalk - tool for searching binary images for embedded files and executable code

## SYNOPSIS

**binwalk** \[*OPTIONS*\] \[*FILE1*\] \[*FILE2*\] \[*FILE3*\] ...

## DESCRIPTION

Binwalk v2.3.2+dcb1403 Craig Heffner, ReFirmLabs https://github.com/ReFirmLabs/binwalk

### Signature Scan Options:

- **-B**, **--signature**

  Scan target file(s) for common file signatures

- **-R**, **--raw=**\<str\>

  Scan target file(s) for the specified sequence of bytes

- **-A**, **--opcodes**

  Scan target file(s) for common executable opcode signatures

- **-m**, **--magic=**\<file\>

  Specify a custom magic file to use

- **-b**, **--dumb**

  Disable smart signature keywords

- **-I**, **--invalid**

  Show results marked as invalid

- **-x**, **--exclude=**\<str\>

  Exclude results that match \<str\>

- **-y**, **--include=**\<str\>

  Only show results that match \<str\>

### Extraction Options:

- **-e**, **--extract**

  Automatically extract known file types

- **-D**, **--dd=**\<type\[:ext\[:cmd\]\]\>

  Extract \<type\> signatures (regular expression), give the files an extension of \<ext\>, and execute \<cmd\>

- **-M**, **--matryoshka**

  Recursively scan extracted files

- **-d**, **--depth=**\<int\>

  Limit matryoshka recursion depth (default: 8 levels deep)

- **-C**, **--directory=**\<str\>

  Extract files/folders to a custom directory (default: current working directory)

- **-j**, **--size=**\<int\>

  Limit the size of each extracted file

- **-n**, **--count=**\<int\>

  Limit the number of extracted files

- **-r**, **--rm**

  Delete carved files after extraction

- **-z**, **--carve**

  Carve data from files, but don't execute extraction utilities

- **-V**, **--subdirs**

  Extract into sub-directories named by the offset

### Entropy Options:

- **-E**, **--entropy**

  Calculate file entropy

- **-F**, **--fast**

  Use faster, but less detailed, entropy analysis

- **-J**, **--save**

  Save plot as a PNG

- **-Q**, **--nlegend**

  Omit the legend from the entropy plot graph

- **-N**, **--nplot**

  Do not generate an entropy plot graph

- **-H**, **--high=**\<float\>

  Set the rising edge entropy trigger threshold (default: 0.95)

- **-L**, **--low=**\<float\>

  Set the falling edge entropy trigger threshold (default: 0.85)

### Binary Diffing Options:

- **-W**, **--hexdump**

  Perform a hexdump / diff of a file or files

- **-G**, **--green**

  Only show lines containing bytes that are the same among all files

- **-i**, **--red**

  Only show lines containing bytes that are different among all files

- **-U**, **--blue**

  Only show lines containing bytes that are different among some files

- **-u**, **--similar**

  Only display lines that are the same between all files

- **-w**, **--terse**

  Diff all files, but only display a hex dump of the first file

### Raw Compression Options:

- **-X**, **--deflate**

  Scan for raw deflate compression streams

- **-Z**, **--lzma**

  Scan for raw LZMA compression streams

- **-P**, **--partial**

  Perform a superficial, but faster, scan

- **-S**, **--stop**

  Stop after the first result

### General Options:

- **-l**, **--length=**\<int\>

  Number of bytes to scan

- **-o**, **--offset=**\<int\>

  Start scan at this file offset

- **-O**, **--base=**\<int\>

  Add a base address to all printed offsets

- **-K**, **--block=**\<int\>

  Set file block size

- **-g**, **--swap=**\<int\>

  Reverse every n bytes before scanning

- **-f**, **--log=**\<file\>

  Log results to file

- **-c**, **--csv**

  Log results to file in CSV format

- **-t**, **--term**

  Format output to fit the terminal window

- **-q**, **--quiet**

  Suppress output to stdout

- **-v**, **--verbose**

  Enable verbose output

- **-h**, **--help**

  Show help output

- **-a**, **--finclude=**\<str\>

  Only scan files whose names match this regex

- **-p**, **--fexclude=**\<str\>

  Do not scan files whose names match this regex

- **-s**, **--status=**\<int\>

  Enable the status server on the specified port