onekey-sec/unblob

Health v2 · maintenance only

Adoption not part of the score

2544 stars · 112 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

unblob is an extraction suite that parses unknown binary blobs for 78+ archive, compression, and file-system formats, recursively extracting their contents and carving out unrecognized chunks. It provides both a command-line interface and a Python library, and is primarily aimed at firmware image analysis and reverse engineering.

Use cases

• extract files from firmware images
• unpack unknown binary blobs
• recursively extract nested archives and filesystems
• identify embedded filesystems like SquashFS or JFFS2 in firmware
• carve out unknown data chunks from binary files
• analyze entropy of unknown regions to spot encrypted or compressed data
• generate JSON reports of extracted chunk offsets and metadata
• extend extraction with custom format handler plugins

When to choose

• you need to extract and analyze firmware images or embedded device dumps
• you want accurate start and end offsets for chunks rather than naive carving
• you need recursive extraction across many archive, compression, and filesystem formats
• you want a Python library or CLI with a plugin system for custom formats
• you are doing data recovery, memory forensics, or malware analysis on binary blobs

When to avoid

• you only need to extract a single well-known archive format like a plain zip or tar
• you require a GUI-based extraction tool
• you cannot install external extractor dependencies like 7zip, unar, or sasquatch
• you need Windows-native support without Docker or WSL

Facets

cli-tool · maturity active

parser file-system compression cli security reverse-engineering plugin-system security reverse-engineering files embedded-systems developer-tools python cli firmware-analysis binary-blob-extraction data-recovery forensics malware-analysis chunk-carving entropy-analysis command-line linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="onekey-sec/unblob")