I have a .bin file I would like to analyse. Especially find images embedded in this firmware update.
- binwalk couldn't find anything.
What other tools do you know to search for possible embedded files?
-
Usually, understanding raw firmware updates involves quite a bit of research. You should start with trying to analyze the file structure, if you can't match it to any known format– NirIzrJun 1, 2013 at 21:28
-
Answering a couple questions might help: Are there any readable strings in the .bin? Have you looked for common executable opcodes in the .bin? Have you looked at an entropy analysis of the .bin? If you post a bug report on the binwalk project page with a copy of the .bin or a link to it (if you aren't under and NDA), maybe there are some improvements that can be made to binwalk's signatures that will help.– devttys0Jun 2, 2013 at 0:49
-
I wanted to have this question a little bit more generic, so if you search for this problem you find a list of tools, rather than a solution for one example. Hachoir seems to be exactly what I was looking for. Unfortunately the image format in this firmware file seems not to be a standard image. It looks like a 2d array which will later be displayed as an image.– samuiraiJun 2, 2013 at 1:22
Add a comment
|
1 Answer
Your best bet is Hachoir-Subfile. You can pass a file stream to Hachior-Subfile, it will search for all known embedded files and display the location. Some known formats it will calculate the size of the file. This makes it easy to carve out the files using dd. A helpful description of Hachoir-Subfile was left by one of the developers a couple weeks back in a similar question.
