I'm just new to these field. So bare with me.

These is the result when I run binwalk.

Result of binwalk

When I try to extract it using binwalk, it just give endless archives and files to analyse.

Any ideas if it is a false positive? I just want to access one web file on the filesystem. Can anybody help?

This is the firmware file: https://www.mediafire.com/download/mc5as6tf357enxx/firmware.BIN

  • 1
    It'd be cool if you could copy+paste the output into a terminal, as this would make it searchable by search engines.
    – 0xC0000022L
    Commented Jan 3, 2014 at 23:59

2 Answers 2


Well, the files and archives aren't endless, but there are a lot of them. :)

If you run binwalk with just the -e option (no -M), it will only extract files from the firmware.BIN image and not scan any other files, or, as @user3119546 mentioned, you can limit the recursion depth.

All the gzip files that binwalk found appear to be valid (except for one). What you are seeing is not uncommon, mostly because two of the extracted gzip files (at offsets 0xC77C94 and 0x21CA97A) are uncompressed YAFFS file systems, thus when binwalk scans them, binwalk sees all the files in the YAFFS file systems (which in this case is a lot):

$ binwalk C77C94 

0             0x0             YAFFS filesystem
4112          0x1010          YAFFS filesystem
8224          0x2020          YAFFS filesystem
16448         0x4040          YAFFS filesystem
98688         0x18180         XML document, version: "1.0"
98738         0x181B2         Copyright string: " 2006, Google Inc.ed under the Apache License, Version 2.0 (the "License");"
111024        0x1B1B0         PEM RSA private key
172704        0x2A2A0         XML document, version: "1.0"
180928        0x2C2C0         XML document, version: "1.0"
189152        0x2E2E0         XML document, version: "1.0"
197376        0x30300         XML document, version: "1.0"
209712        0x33330         XML document, version: "1.0"
267280        0x41410         XML document, version: "1.0"
275504        0x43430         XML document, version: "1.0"
283728        0x45450         XML document, version: "1.0"
291952        0x47470         XML document, version: "1.0"
308400        0x4B4B0         XML document, version: "1.0"
320736        0x4E4E0         XML document, version: "1.0"
357744        0x57570         PEM RSA private key
370080        0x5A5A0         gzip compressed data, maximum compression, from Unix, NULL date: Wed Dec 31 19:00:00 1969
407088        0x63630         PEM RSA private key
423536        0x67670         PEM RSA private key
431790        0x696AE         LZMA compressed data, properties: 0x40, dictionary size: 16777216 bytes, uncompressed size: 6144 bytes
464656        0x71710         PEM certificate
505776        0x7B7B0         Zip archive data, at least v2.0 to extract, compressed size: 943, uncompressed size: 1675, name: "testkey.x509.pem"
506879        0x7BBFF         End of Zip archive

This is a situation where just extracting the original image then doing separate scans on each the extracted files is perhaps more informative.

A cursory glance at strings / binwalk scans of the other uncompressed gzip files, this appears to be a Huawei device running VxWorks, but the HTML file you're looking for is probably in one of those two YAFFS file systems.


You can limit the amount of levels it will scan. BinWalk defaults at 8 levels but this can be modified by giving the following command line switch:

-M, --matryoshka=[n]     Recursively scan extracted files, up to n levels deep (default: 8)

For further information on binwalk usage, as well as other extraction options try following up here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.