unblob
A tool for getting information out of any kind of binary blob.
You also need these extractor commands to be able to extract the supported file types: 7z, debugfs, fsck.erofs, jefferson, lz4, lziprecover, lzop, partclone.restore, sasquatch, sasquatch-v4be, simg2img, ubireader_extract_files, ubireader_extract_images, unar, zstd
Usage
Usage: unblob [OPTIONS] FILE
Extraction & Output
| Option | Description |
|---|---|
-e, --extract-dir DIRECTORY | Extract the files to this directory. Will be created if it doesn’t exist. |
-f, --force | Force extraction even if outputs already exist (they are removed). |
--report PATH | File to store metadata generated during the extraction process (in JSON format). |
--log PATH | File to save logs (in text format). Defaults to unblob.log. |
-s, --skip-extraction | Only carve chunks and skip further extraction. |
-k, --keep-extracted-chunks | Keep extracted chunks. |
--carve-suffix TEXT | Carve directory name is source file + this suffix. Note: carving is skipped when the whole file is of a known type. Default: _extract |
--extract-suffix TEXT | Extraction directory name is source file + this suffix. Default: _extract |
Processing Control
| Option | Description |
|---|---|
-d, --depth INTEGER RANGE | Recursion depth. How deep should we extract containers. Default: 10 (x ≥ 1) |
-n, --randomness-depth INTEGER RANGE | Entropy calculation depth. How deep should we calculate randomness for unknown files? 1 means input files only, 0 turns it off. Default: 1 (x ≥ 0) |
-p, --process-num INTEGER RANGE | Number of worker processes to process files in parallel. Default: 12 (x ≥ 1) |
Plugins & Magic Skipping
| Option | Description |
|---|---|
-P, --plugins-path PATH | Load plugins from the provided path. |
-S, --skip-magic TEXT | Skip processing files with given magic prefix. The provided values are appended to unblob’s default skip list unless --clear-skip-magics is used. Default values include: BFLT, Composite Document File V2 Document, Erlang BEAM file, GIF, GNU message catalog, HP Printer Job Language, JPEG, Java module image, MPEG, MS Windows icon resource, Macromedia Flash data, Microsoft Excel, Microsoft PowerPoint, Microsoft Word, OpenDocument, PDF document, PNG, SQLite, TrueType Font data, Web Open Font Format, Windows Embedded CE binary image, Xilinx BIT data, compiled Java class, magic binary file, python. |
--skip-extension TEXT | Skip processing files with given extension. Default: .rlib |
--clear-skip-magics | Clear unblob’s default skip magic list. |
Miscellaneous
| Option | Description |
|---|---|
-v, --verbose | Verbosity level (max level: 3). Use -v, -vv, or -vvv. |
--show-external-dependencies | Show commands required for unblob to work properly. |
--build-handlers-doc TEXT | Build handlers markdown documentation. |