0Pricing
Reverse Engineering & Binary Analysis Basics · Lesson

Extracting & Analyzing Filesystems from Firmware

Carve, identify, and mount the embedded filesystems hidden inside firmware images to recover the binaries, configs, and keys they contain.

Extracting & Analyzing Filesystems from Firmware is a free Reverse Engineering & Binary Analysis Basics lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Reverse Engineering & Binary Analysis Basics learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Inside the Firmware Blob

You can analyze firmware images, emulate embedded binaries, and use hardware-assisted debugging. Most firmware is more than code: it embeds entire filesystems holding executables, web pages, and secrets.

Extracting them is often where the real findings live.

Firmware Layout

A typical image is a stack of regions:

  • Bootloader
  • Kernel
  • One or more root filesystems
  • Configuration / NVRAM areas

Each region may use a different format and compression.

Identifying Contents with binwalk

binwalk scans for known magic signatures and reports what is inside and where.

binwalk firmware.bin
# 0x40   uImage header
# 0x1A00 Squashfs filesystem, gzip

Carving Out Sections

Once you know offsets, you can extract a region. binwalk can do this automatically, or you can carve with dd.

binwalk -e firmware.bin
# or carve manually:
dd if=firmware.bin of=rootfs.sqsh bs=1 skip=6656

Common Embedded Filesystems

Embedded devices favor compact, sometimes read-only filesystems:

  • SquashFS (compressed, read-only)
  • JFFS2 / UBIFS (flash-aware)
  • CramFS (older, read-only)

Each needs the matching tool to unpack.

Unpacking SquashFS

SquashFS is the most common. Extract it with unsquashfs to get a normal directory tree.

unsquashfs rootfs.sqsh
# creates ./squashfs-root with /bin /etc /www ...

What to Look For

Inside the root filesystem, hunt for high-value files:

  • /etc/passwd and hardcoded credentials
  • Web admin scripts in /www
  • TLS keys and certificates
  • Startup scripts revealing services
grep -rIn 'password' squashfs-root/etc 2>/dev/null

Finding Hardcoded Secrets

Vendors frequently embed backdoor accounts or API keys. Scan strings across the whole tree and inspect config files.

These secrets are the most common firmware vulnerability you will report.

Connecting to Your Other Skills

Extracted binaries feed back into your earlier work: emulate a recovered service binary, or attach hardware-assisted debugging to a running device executing that same code.

Filesystem extraction unlocks the targets for those techniques.

When Extraction Fails

If binwalk finds nothing, the image may be encrypted or use a proprietary container.

  • Check entropy: uniformly high suggests encryption
  • Look for the bootloader's decryption routine
  • Try vendor update tools or known keys

Repacking After Modification

For dynamic testing you sometimes patch a filesystem and put it back. Repack with the matching tool and fix the firmware header checksum, or the device rejects the image.

Always work on copies and keep the pristine original for reference.

mksquashfs squashfs-root rootfs_new.sqsh -comp gzip

Quick Check

Which tool is commonly used to scan a firmware image for embedded filesystems and other known structures by their signatures?

Recap

You can now mine firmware for its real contents:

  • Map the layout, then identify regions with binwalk
  • Carve sections and unpack SquashFS/JFFS2/UBIFS
  • Hunt for credentials, keys, and admin scripts
  • Feed recovered binaries into emulation and debugging

Frequently asked questions

Is the “Extracting & Analyzing Filesystems from Firmware” lesson free?

Yes — the full text of “Extracting & Analyzing Filesystems from Firmware” is free to read here on the web, and the Reverse Engineering & Binary Analysis Basics course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Reverse Engineering & Binary Analysis Basics course, upgrade to CoddyKit PRO.

What will I learn in “Extracting & Analyzing Filesystems from Firmware”?

Carve, identify, and mount the embedded filesystems hidden inside firmware images to recover the binaries, configs, and keys they contain. You practise Reverse Engineering & Binary Analysis Basics with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Reverse Engineering & Binary Analysis Basics?

No prior experience is required. Reverse Engineering & Binary Analysis Basics on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Extracting & Analyzing Filesystems from Firmware” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Reverse Engineering & Binary Analysis Basics lesson?

Yes. Every Reverse Engineering & Binary Analysis Basics lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Analyzing Firmware Images
  2. Emulating Embedded Binaries
  3. Hardware-Assisted Debugging
  4. Extracting & Analyzing Filesystems from Firmware
← Back to Reverse Engineering & Binary Analysis Basics