-
Notifications
You must be signed in to change notification settings - Fork 1.6k
Supported Signatures
devttys0 edited this page Feb 2, 2025
·
6 revisions
Binwalk supports a wide variety of file and data signatures; these can be viewed at any time by running:
$ binwalk --list
------------------------------------------------------------------------------------------------
Signature Description Signature Name Extraction Utility
------------------------------------------------------------------------------------------------
7-zip archive data 7zip 7zz
AES S-Box aes_sbox None
Android boot image android_bootimg None
Android sparse image android_sparse Built-in
Apple Disk iMaGe dmg dmg2img
APple File System apfs 7zzs
Arcadyan obfuscated LZMA arcadyan Built-in
Autel obfuscated firmware autel Built-in
BIN firmware header binhdr None
BMP image (Bitmap) bmp Built-in
BTRFS file system btrfs None
bzip2 compressed data bzip2 Built-in
CFE bootloader cfe None
CHK firmware header chk None
compress'd data compressd 7zz
Copyright text copyright None
CPIO ASCII archive cpio 7zz
CramFS filesystem cramfs 7zz
CRC32 polynomial table crc32 None
CSman DAT file csman Built-in
D-Link Encrpted Image encrpted_img Built-in
D-Link MH01 firmware image mh01 Built-in
D-Link TLV firmware dlink_tlv Built-in
Dahua ZIP archive dahua_zip Built-in
Debian package file deb None
Device tree blob (DTB) dtb Built-in
DirectX shader bytecode dxbc Built-in
DKBS firmware header dkbs Built-in
DLK encrypted firmware dlke Built-in
DLOB firmware header dlob None
DMS firmware image dms Built-in
DOS Master Boot Record mbr Built-in
DPAPI blob data dpapi None
eCos kernel exception handler ecos None
EFI Global Partition Table efigpt 7zz
ELF binary elf None
EXT filesystem ext tsk_recover
FAT file system fat tsk_recover
GIF image gif Built-in
GPG signed file gpg_signed Built-in
gzip compressed data gzip Built-in
HP Printer Job Language data pjl None
Intel serial flash for PCH ROM pchrom uefi-firmware-parser
ISO9660 primary volume iso9660 7zz
JBOOT firmware header jboot_arm None
JBOOT SCH2 header jboot_sch2 Built-in
JBOOT STAG header jboot_stag None
JFFS2 filesystem jffs2 jefferson
JPEG image jpeg Built-in
Known encrypted firmware encfw Built-in
Linux ARM boot executable zImage linux_arm_zimage None
Linux kernel ARM64 boot image linux_arm64_boot_image None
Linux kernel boot image linux_boot_image None
Linux kernel version linux_kernel vmlinux-to-elf
LogFS file system logfs None
LUKS header luks None
LZ4 compressed data lz4 lz4
LZFSE compressed data lzfse lzfse
LZMA compressed data lzma Built-in
LZO compressed data lzop lzop
Matter OTA firmware matter_ota Built-in
Microsoft Cabinet archive cab cabextract
Motorola S-record srecord srec_cat
Motorola S-record (generic) srecord_generic srec_cat
NTFS partition ntfs tsk_recover
OpenSSL encryption openssl Built-in
PackImg firmware header packimg None
Pcap-NG capture file pcapng Built-in
PDF document pdf None
PEM certificate pem_certificate Built-in
PEM private key pem_private_key Built-in
PEM public key pem_public_key Built-in
PKCS DER hash pkcs_der_hash None
PNG image png Built-in
POSIX tar archive tarball tar
QNX IFS image qnx_ifs dumpifs
RAR archive rar unrar
RIFF image riff Built-in
RomFS filesystem romfs Built-in
RSA encrypted session key rsa None
RTK firmware header rtk None
SEAMA firmware header seama None
SHA256 hash constants sha256 None
SHRS encrypted firmware shrs Built-in
SquashFS file system squashfs sasquatch
SVG image svg Built-in
TP-Link firmware header tplink None
TP-Link RTOS firmware tplink_rtos None
TRX firmware image trx Built-in
U-Boot version string uboot None
UBI image ubi ubireader_extract_images
UBIFS image ubifs ubireader_extract_files
UEFI capsule image uefi_capsule uefi-firmware-parser
UEFI PI firmware volume uefi_pi_volume uefi-firmware-parser
uImage firmware image uimage Built-in
VxWorks symbol table vxworks_symtab Built-in
VxWorks WIND kernel version wind_kernel None
Windows CE binary image wince Built-in
Windows PE binary pe None
XZ compressed data xz Built-in
YAFFSv2 filesystem yaffs unyaffs
ZIP archive zip 7zz
Zlib compressed file zlib Built-in
ZSTD compressed data zstd zstd
------------------------------------------------------------------------------------------------
Total signatures: 104
Extractable signatures: 71
Note
When run in a terminal, signatures displayed in yellow are prone to false positives, and by default, only searched for
at the beginning of each file.
Tip
To search for all signatures at all file offsets, use the --search-all command line option.