Binwalk plugin

[thknx]

Hi guys.

Is there a binwalk plugin?

(We Loved so much ImHex. Thanks a lot.)

[WerWolv]

Hey!
I don't think there is anything related to binwalk. What would a binwalk plugin do exactly?

[thknx]

https://github.com/ReFirmLabs/binwalk

It analyzes any binary and gives result about what it contains.

Here is an example:

user@user:kernel$ binwalk Image.lzo-initramfs

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             LZO compressed data
85424         0x14DB0         SHA256 hash constants, little endian
3130071       0x2FC2D7        SHA256 hash constants, little endian
3264462       0x31CFCE        xz compressed data
3653084       0x37BDDC        AES S-Box
3653340       0x37BEDC        AES Inverse S-Box

[erdnaxe]

Binwalk integration could enable ImHex to detect cryptographic constants, or known magics. Binwalk is cool because it comes with its own set of carefully crafted rules (e.g. https://github.com/ReFirmLabs/binwalk/blob/v2.3.4/src/binwalk/magic/hashing).

However, integrating binwalk rules inside ImHex seems to duplicate the Yara integration.
Maybe as an alternative to binwalk integration, ImHex could ship by default some Yara rules such as https://github.com/polymorf/findcrypt-yara/blob/master/findcrypt3.rules?

[Tarek-Hasan]

HexWalk has Binwalk integrated. It would be nice to have in ImHex too.

However, integrating binwalk rules inside ImHex seems to duplicate the Yara integration.
Maybe as an alternative to binwalk integration, ImHex could ship by default some Yara rules such as https://github.com/polymorf/findcrypt-yara/blob/master/findcrypt3.rules?

@erdnaxe will it be compatible to binwalk?