>> [MUSIC] Hello everyone and
welcome back to Breaking Stuff With Joe
here on Cybrary On Demand.
Today we're going to be talking about the tool Binwalk.
Now, Binwalk is a great forensic utility
for examining firmware images
>> and extracting executables,
>> images, different file types.
Just anything you might be able to
pull from a firmware image,
this is capable of doing.
It's a really simple tool to use,
very, very effective,
and it's a great way to do that first-pass scan
of any target of
forensic activity if you have a firmware image.
We're going to see how easy it is to use,
we're going to see how useful it is,
and we're going to actually show it in use
here on Breaking Stuff With Joe.
As usual, here we are back in our Kali VM.
Now, you may note that the text on
the screen is a little bit smaller than usual,
a little bit tougher to read.
There's a good reason for that.
You'll see in just a second.
As I said before in the intro,
we're looking at the tool called Binwalk today.
It's a quick look because it's
a pretty easy tool to use at its most basic level.
All Binwalk is really doing is searching
through a given binary image.
Generally speaking,
firmware images are what you're looking for.
It's just hunting for any file signatures, any images,
any files that it can find inside of that firmware.
[NOISE] We're going to go ahead and we're going to just
do a quick example to see how you could use this tool.
Now, I downloaded a firmware file off of
the Intel website pretty much at random.
We're going to go ahead, we're just going
to run against that.
First, just to get a look at
all the different options you have with
Binwalk because it is a pretty hefty tool.
You can see that it will attempt to
extract known file types,
if you give it that opportunity,
it will attempt to calculate file entropy.
You can find all sorts of different signatures,
which is what we're going to be looking for in this case.
We're going to be using this tack B option here in just a
second to find common file signatures.
You can see we have disassembly scan options,
binary differential options.
This is a very robust tool that can perform
very in-depth forensic analysis on
this binary that we have access to.
In this case, we're really just wanting to
take a quick look and see what we can pull out
at an initial scan and see what information we
can gather with basically no work.
We're going to go ahead and run Binwalk,
tack B, and then we'll just autocomplete with this file.
Again, this is just a firmware image
that I pulled down from Intel.
You can see this is why we didn't zoom in.
If you zoom in it becomes very, very difficult to read.
Here you can see we've got
a few different pieces of information.
We have the decimal location,
the hexadecimal, and then we have
a description of what was found there.
This is again just looking for common file signatures,
and as soon as it finds one,
it reports the location both in decimal and hexadecimal,
and then it gives you a description.
It's got an ARG archive data,
so these are archives.
You can see most of the files are
found in archives with some exceptions.
We have two copyright strings
here both saying copyright from Intel.
You can see that we've got an initial look at
all the different pieces of
file information already in here.
You can see over here we've got
the original names of
these different files that have
been turned into archives.
You can see that the OS is for MS-DOS,
is for a Windows system.
The compressed file size versions,
you can do some digging into these ARJs.
Of course, because we know where they are and we know
that Binwalk is able to identify them very easily,
we can extract those actual archives
and start digging through them.
Now, it would be the subject of a much more
focused and of course, much longer course.
But that's the work that you can start doing
and start playing around with this tool
on your own time and then in some of
the labs that we have available here on Cybrary.
That's all there is for this tool, Binwalk.
Again, it is a tool for
forensic examination of firmware images
or really any binary,
but most specifically and most
generally, firmware images.
Thank you all for watching.
This has been Breaking Stuff With Joe
on Cybrary On Demand.
[MUSIC]