I have been trying to use binwalk on a very large dump file without much success so far. Everytime I tried to use it, it produces very large zip file that fill the disk until I reach a disk full error (using Linux).
I am trying to understand what I did wrong, so here is a simple scenario hopefully to understand what I am doing wrong.
$ dd if=/dev/zero of=head bs=1 count=512 $ dd if=/dev/zero of=tail bs=1 count=512 $ wget https://github.com/devttys0/binwalk/archive/master.zip $ cat head binwalk-master.zip tail > full $ binwalk -z -C demo -D 'zip archive:zip:unzip %e' full
Could someone please let me know why I am seeing the following:
$ find demo demo demo/_full.extracted demo/_full.extracted/483BD.zip demo/_full.extracted/200.zip
Where is this file coming from ? Is there any reason to keep it around ?
$ unzip -l demo/_full.extracted/483BD.zip Archive: demo/_full.extracted/483BD.zip 5be61ad220a42e7b2c7e912024fda5edd84b4843 error [demo/_full.extracted/483BD.zip]: missing 295357 bytes in zipfile (attempting to process anyway) error [demo/_full.extracted/483BD.zip]: attempt to seek before beginning of zipfile (please check that you have transferred or created the zipfile in the appropriate BINARY mode and that you have compiled UnZip properly)
Bonus question: is there a way to really extract only the zip file (removing the
$ crc32 binwalk-master.zip demo/_full.extracted/200.zip 8ce4d36c binwalk-master.zip 81923fef demo/_full.extracted/200.zip $ ls -al binwalk-master.zip demo/_full.extracted/200.zip -rw-r--r-- 1 user user 295419 Sep 29 08:54 binwalk-master.zip -rw-r--r-- 1 user user 295931 Sep 29 09:02 demo/_full.extracted/200.zip