This should have been made easy using binwalk however I fail to understand what I did wrong with the following syntax:

$ wget --content-disposition https://github.com/devttys0/binwalk/archive/v2.1.1.zip
$ wget --content-disposition https://github.com/devttys0/binwalk/archive/v2.0.1.zip
$ cat binwalk-2.0.1.zip binwalk-2.1.1.zip > full
$ binwalk -r -C output -e full

lead to the following:

$ ls output/_full.extracted

Clearly it is missing the binwalk-2.0.1 expanded directory. Where did binwalk-2.0.1 go ?

I need to use the -r flag (Delete carved files after extraction), because it generates enormous zip and fill my disk (see Carved files are often equal in size to the original file)


The UnZip implementation is the cause of your problem. When binwalk extracts full, the first ZIP actually contains both ZIPs, but UnZip only extracts the last one (which is also stored independently in the second ZIP that binwalk extracted).

binwalk expects p7zip, so install p7zip to fix this problem.

$ wget https://github.com/devttys0/binwalk/archive/v2.0.1.zip
$ wget https://github.com/devttys0/binwalk/archive/v2.1.1.zip
$ mv v2.0.1.zip binwalk-2.0.1.zip
$ mv v2.1.1.zip binwalk-2.1.1.zip
$ cat binwalk-2.0.1.zip binwalk-2.1.1.zip > full
$ ls -l
2255007 binwalk-2.0.1.zip
 288920 binwalk-2.1.1.zip
2543927 full
$ binwalk -r -C output -e full
$ ls -l output/_full.extracted/
2543927 0.zip      # both ZIPs
 288920 22689F.zip # last ZIP
$ mkdir final && unzip output/_full.extracted/'*.zip' -d final/
$ ls -l final/
binwalk-2.1.1                                   # bad
$ rm -r output/ final/                          # cleanup
                                                # install p7zip                                                          
$ binwalk -r -C output -e full
$ ls -l output/_full.extracted/
binwalk-2.1.1                                   # good
  • Could you add the output of $ apt-cache policy p7zip-full in your answer ? – tibar Nov 23 '16 at 7:56
  • @tibar I am using MacPorts binwalk @2.1.1 and p7zip @16.02 on OS X. – tmp Nov 26 '16 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.