I want to unpack the fortigate firmware - FGT_110C-v400-build0092-FORTINET.out. binwalk only gives a hint about gzip compressed data.

~/Documents# binwalk -i FGT_110C-v400-build0092-FORTINET.out 

  0            0x0         gzip compressed data, has original file name: 
                           "FG110C-4.00-FW-build092-090220-patch00", from Unix,
                           last modified: Fri Feb 20 18:00:29 2009

These is no other output. How can I unpack the firmware?

I uploaded the firmware here.

  • With gzip? It looks like you're on Windows, so you could also try 7z which supports gzip decompression too.
    – Rup
    Commented Sep 13, 2017 at 7:30
  • it is on linux,with the binwalk, and the binwalk output is gzip compressed data. I upload the bin these www52.zippyshare.com/v/7RyFqBJy/file.html
    – Devid Lee
    Commented Sep 14, 2017 at 2:35
  • How does the patch00 file relate to the .out file you are talking about. I downloaded it, it seems very regular, if you make a hexdump of 64 bytes wide, you will notice. Probably it is xorred with a fixed 64 byte string. Commented Sep 14, 2017 at 7:26

2 Answers 2


Main part of fortigate firmware is a /bin/init executable, most of other files are just symbolic links to it. So, you can obtain this file (or any other file of interest) from device or VM using fnsysctl and exec backup commands, together with the configured tftp-server. In my case it looks like this:

#> fnsysctl cp /bin/init /var/log/root/mlog.0
#> exec backup disk log tftp AA.BB.CC.DD anomaly

Then, rename the received file on the tftp-server.


binwalk -e extracts it just fine.

You'll need https://github.com/sviehb/jefferson though, later.

  • Could you elaborate a little more? why is the -e flag useful? etc.
    – NirIzr
    Commented Jul 22, 2018 at 19:41
  • Because it tells binwalk to extract? These are basics: -e, --extract Automatically extract known file types Commented Jul 23, 2018 at 13:14
  • 2
    Can you include that as part of your answer?
    – NirIzr
    Commented Jul 23, 2018 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.