binwalk/sh is a cloud-based frontend for the binwalk v3 engine, designed for rapid firmware triage and binary analysis without the need for local toolchain installation. It provides a browser-based environment to upload firmware images, ROM dumps, or unknown binary blobs to identify embedded files, file systems, and potential security artifacts.
Key Features
- Powered by the binwalk v3 engine for high-accuracy signature matching across hundreds of file types.
- Supports identification and extraction of SquashFS, JFFS2, EXT, UBI, and Android sparse images.
- Integrated Shannon-entropy charting to visually pinpoint packed, compressed, or encrypted data regions.
- Recursive extraction capabilities (matryoshka) to uncover nested file systems and archives within archives.
- Detects bootloaders (U-Boot), kernel headers (TRX/CHK), certificates, private keys, and executable sections (ELF/PE).
Use Cases
- Rapid firmware triage during IoT or embedded device penetration tests.
- Analyzing unknown binary blobs to identify embedded file systems for static analysis.
- Identifying encrypted or compressed regions in firmware to prioritize reverse engineering efforts.
- Carving out specific artifacts such as PEM blocks or digital certificates for crypto analysis.
- Extracting root file systems for binary analysis in disassemblers like Ghidra or IDA Pro.
