Carving bins

Radare was initially developed as a forensic tool. Nowadays most people use it for static code analysis or binary patching, but the framework and the tools still provide functionalities for analyzing disk partitions or filesystems.. In this post I’m going to explain how to use r2 to extract some ELFs files from a raw memory dump or unknown format firmware image. This kind of search is called ‘carving’ and there are already several tools that can do this automatically for free.