4

I have a .bin file I would like to analyse. Especially find images embedded in this firmware update.

What other tools do you know to search for possible embedded files?

  • Usually, understanding raw firmware updates involves quite a bit of research. You should start with trying to analyze the file structure, if you can't match it to any known format – NirIzr Jun 1 '13 at 21:28
  • Answering a couple questions might help: Are there any readable strings in the .bin? Have you looked for common executable opcodes in the .bin? Have you looked at an entropy analysis of the .bin? If you post a bug report on the binwalk project page with a copy of the .bin or a link to it (if you aren't under and NDA), maybe there are some improvements that can be made to binwalk's signatures that will help. – devttys0 Jun 2 '13 at 0:49
  • I wanted to have this question a little bit more generic, so if you search for this problem you find a list of tools, rather than a solution for one example. Hachoir seems to be exactly what I was looking for. Unfortunately the image format in this firmware file seems not to be a standard image. It looks like a 2d array which will later be displayed as an image. – samuirai Jun 2 '13 at 1:22
8

Your best bet is Hachoir-Subfile. You can pass a file stream to Hachior-Subfile, it will search for all known embedded files and display the location. Some known formats it will calculate the size of the file. This makes it easy to carve out the files using dd. A helpful description of Hachoir-Subfile was left by one of the developers a couple weeks back in a similar question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.