不用Linux，Windows 也能安装隐写神器binwalk，新入CTFer必备！

最新推荐文章于 2024-09-13 21:29:39 发布

你们这样一点都不可耐

最新推荐文章于 2024-09-13 21:29:39 发布

阅读量1.3k

点赞数 3

分类专栏： MISC 文章标签： linux python cmd 安全加密解密

本文链接：https://blog.csdn.net/vanarrow/article/details/105929896

版权

MISC 专栏收录该内容

17 篇文章 3 订阅

订阅专栏

下载地址https://github.com/ReFirmLabs/binwalk
在这里插入图片描述进releases
下载zip压缩包

解压后，进文件夹
cmd命令输入
python setup.py install
在这里插入图片描述

在这里插入图片描述把该文件夹路径E:\CTF\隐写\binwalk-2.2.0\src\scripts加入系统环境变量

在这里插入图片描述
一路确定到底

其实添加build路径下的scripts-路径亲测也行（我的电脑有py2、3、Anaconda所以我都）
在这里插入图片描述

桌面创建cmd快捷方式
在这里插入图片描述
把E:\CTF\隐写\binwalk-2.2.0\src添加到快速访问
下次直接把要分析的东西，丢到里面，然后快捷方式okk！！！

在这里插入图片描述
-e把带压缩包的图片分离之后的场景

安好后的，常见姿势~

附上官方完整用法

Binwalk v2.2.0
Craig Heffner, ReFirmLabs
https://github.com/ReFirmLabs/binwalk

Usage: binwalk [OPTIONS] [FILE1] [FILE2] [FILE3] ...

Signature Scan Options:
    -B, --signature              Scan target file(s) for common file signatures
    -R, --raw=<str>              Scan target file(s) for the specified sequence of bytes
    -A, --opcodes                Scan target file(s) for common executable opcode signatures
    -m, --magic=<file>           Specify a custom magic file to use
    -b, --dumb                   Disable smart signature keywords
    -I, --invalid                Show results marked as invalid
    -x, --exclude=<str>          Exclude results that match <str>
    -y, --include=<str>          Only show results that match <str>

Extraction Options:
    -e, --extract                Automatically extract known file types
    -D, --dd=<type:ext:cmd>      Extract <type> signatures, give the files an extension of <ext>, and execute <cmd>
    -M, --matryoshka             Recursively scan extracted files
    -d, --depth=<int>            Limit matryoshka recursion depth (default: 8 levels deep)
    -C, --directory=<str>        Extract files/folders to a custom directory (default: current working directory)
    -j, --size=<int>             Limit the size of each extracted file
    -n, --count=<int>            Limit the number of extracted files
    -r, --rm                     Delete carved files after extraction
    -z, --carve                  Carve data from files, but don't execute extraction utilities
    -V, --subdirs                Extract into sub-directories named by the offset

Entropy Options:
    -E, --entropy                Calculate file entropy
    -F, --fast                   Use faster, but less detailed, entropy analysis
    -J, --save                   Save plot as a PNG
    -Q, --nlegend                Omit the legend from the entropy plot graph
    -N, --nplot                  Do not generate an entropy plot graph
    -H, --high=<float>           Set the rising edge entropy trigger threshold (default: 0.95)
    -L, --low=<float>            Set the falling edge entropy trigger threshold (default: 0.85)

Binary Diffing Options:
    -W, --hexdump                Perform a hexdump / diff of a file or files
    -G, --green                  Only show lines containing bytes that are the same among all files
    -i, --red                    Only show lines containing bytes that are different among all files
    -U, --blue                   Only show lines containing bytes that are different among some files
    -u, --similar                Only display lines that are the same between all files
    -w, --terse                  Diff all files, but only display a hex dump of the first file

General Options:
    -l, --length=<int>           Number of bytes to scan
    -o, --offset=<int>           Start scan at this file offset
    -O, --base=<int>             Add a base address to all printed offsets
    -K, --block=<int>            Set file block size
    -g, --swap=<int>             Reverse every n bytes before scanning
    -f, --log=<file>             Log results to file
    -c, --csv                    Log results to file in CSV format
    -t, --term                   Format output to fit the terminal window
    -q, --quiet                  Suppress output to stdout
    -v, --verbose                Enable verbose output
    -h, --help                   Show help output
    -a, --finclude=<str>         Only scan files whose names match this regex
    -p, --fexclude=<str>         Do not scan files whose names match this regex
    -s, --status=<int>           Enable the status server on the specified port