Automatically extract known file types (eg. zip) using binwalk

Question

This should have been made easy using binwalk however I fail to understand what I did wrong with the following syntax:

$ wget --content-disposition https://github.com/devttys0/binwalk/archive/v2.1.1.zip
$ wget --content-disposition https://github.com/devttys0/binwalk/archive/v2.0.1.zip
$ cat binwalk-2.0.1.zip binwalk-2.1.1.zip > full
$ binwalk -r -C output -e full

lead to the following:

$ ls output/_full.extracted
binwalk-2.1.1/

Clearly it is missing the binwalk-2.0.1 expanded directory. Where did binwalk-2.0.1 go ?

I need to use the -r flag (Delete carved files after extraction), because it generates enormous zip and fill my disk (see Carved files are often equal in size to the original file)

Answer 1

The UnZip implementation is the cause of your problem. When binwalk extracts full, the first ZIP actually contains both ZIPs, but UnZip only extracts the last one (which is also stored independently in the second ZIP that binwalk extracted).

binwalk expects p7zip, so install p7zip to fix this problem.

$ wget https://github.com/devttys0/binwalk/archive/v2.0.1.zip
$ wget https://github.com/devttys0/binwalk/archive/v2.1.1.zip
$ mv v2.0.1.zip binwalk-2.0.1.zip
$ mv v2.1.1.zip binwalk-2.1.1.zip
$ cat binwalk-2.0.1.zip binwalk-2.1.1.zip > full
$ ls -l
2255007 binwalk-2.0.1.zip
 288920 binwalk-2.1.1.zip
2543927 full
$ binwalk -r -C output -e full
$ ls -l output/_full.extracted/
2543927 0.zip      # both ZIPs
 288920 22689F.zip # last ZIP
$ mkdir final && unzip output/_full.extracted/'*.zip' -d final/
$ ls -l final/
binwalk-2.1.1                                   # bad
$ rm -r output/ final/                          # cleanup
                                                # install p7zip                                                          
$ binwalk -r -C output -e full
$ ls -l output/_full.extracted/
binwalk-2.0.1
binwalk-2.1.1                                   # good