Supported Formats - unblob - extract everything!
Extracto
unblob is an accurate, fast, and easy-to-use extraction suite. unblob parses unknown binary blobs for more than 30 different archive, compression, and file-system formats, extracts their content recursively, and carves out unknown chunks that have not been accounted for. This turns unblob into the perfect companion for extracting, analyzing, and reverse engineering firmware images.
Contenido
unblob supports more than 30 formats. You can see their code in
unblob/handlers/.
✅: Some or all metadata is preserved for the format.
❌: Metadata is not preserved (limitation of the format).
Archives¶
| Format | Preserved metadata | Handler | Extractor command | ||
|---|---|---|---|---|---|
| timestamps | permissions | ownership | |||
| AR | ❌ | ❌ | ❌ | archive/ar.py | unar |
| ARC | ❌ | ❌ | ❌ | archive/arc.py | unar |
| ARJ | ✅ | ✅ | ❌ | archive/arj.py | 7z |
| CAB | ❌ | ❌ | ❌ | archive/cab.py | 7z |
| CPIO | ✅ | ✅ | ✅ | archive/cpio.py | 7z |
| DMG | ❌ | ❌ | ❌ | archive/dmg.py | 7z |
| RAR | ❌ | ❌ | ❌ | archive/rar.py | unar |
| 7ZIP | ❌ | ❌ | ❌ | archive/sevenzip.py | 7z |
| StuffIt | ❌ | ❌ | ❌ | archive/stuffit.py | unar |
| TAR | ✅ | ✅ | ✅ | archive/tar.py | 7z |
| ZIP | ✅ | ✅ | ✅ | archive/zip.py | 7z |
Compression¶
For compression formats, metadata cannot be preserved, as this information in most cases is not stored in the format.
| Format | Handler | Extractor |
|---|---|---|
| bzip2 | compression/bzip2.py | 7z |
| UNIX compress | compression/compress.py | 7z |
| gzip | compression/gzip.py | 7z |
| LZ4 | compression/lz4.py | lz4 |
| LZH | compression/lzh.py | 7z |
| LZIP | compression/lzip.py | lziprecover |
| LZMA | compression/lzma.py | 7z |
| LZO | compression/lzo.py | lzop |
| XZ | compression/xz.py | 7z |
| ZSTD | compression/zstd.py | zstd |
Filesystems¶
| Format | Preserved metadata | Handler | Extractor command |
|---|---|---|---|
| Android sparse image | ❌ | filesystem/android/sparse.py | simg2img |
| CRAMFS | ✅ | filesystem/cramfs.py | 7z |
| ExtFS | ✅ | filesystem/extfs.py | debugfs |
| FAT | ✅ | filesystem/fat.py | 7z |
| ISO9660 | ✅ | filesystem/iso9660.py | 7z |
| JFFS2 | ✅ | filesystem/jffs2.py | jefferson |
| NTFS | ✅ | filesystem/ntfs.py | 7z |
| RomFS | ✅ everything is o+rw or o+rwx |
filesystem/romfs.py | RomFsExtractor custom code |
| SquashFS (v3, v4) | ✅ | filesystem/squashfs.py | sasquatch |
| SquashFS v4 Big Endian | ✅ | filesystem/squashfs.py | sasquatch-v4-be |
| UBI | ✅ | filesystem/ubi.py | ubireader_extract_images |
| UBIFS | ✅ | filesystem/ubi.py | ubireader_extract_files |
| YAFFS (1, 2) | ✅ | filesystem/yaffs.py | yaffshiv |
Didn't find your format supported yet?¶
unblob is easily extensible, and you can write your own handler and include your own extractors for proprietary formats. To learn more about this, see the development section. Alternatively, just open a new ticket in the Github issue tracker.
Whenever we stumble upon proprietary formats in our ONEKEY analysis platform, we will add support for it. At this point, we have developed about a dozen of additional, proprietary format Handlers.
If you are interested in a custom format not supported by the open source version, check out our platform at https://www.onekey.com or you can Contact Us.