unblob is an extraction suite for working with unknown binary blobs.
It parses embedded archive, compression, and file system data, making it particularly useful for firmware extraction, vulnerability research, and reverse engineering workflows. The software extracts nested containers recursively, reports metadata about discovered chunks, and helps separate recognised file content from unexplained regions inside complex images.
This is free and open source software.
Key Features
- Supports more than 78 archive, compression, and file system formats, including SquashFS, JFFS2, UBI/UBIFS, ext, CPIO, ZIP, 7-Zip, gzip, XZ, LZMA, LZ4, and LZ4.
- Recursively extracts containers within containers up to a configurable depth.
- Identifies start and end offsets of recognised chunks to reduce false positives.
- Carves unknown data regions and recognises common null and 0xFF padding.
- Calculates Shannon entropy and chi-square probability for unknown chunks.
- Generates JSON metadata reports with chunk offsets, sizes, entropy, ownership, permissions, and timestamps.
- Uses multiple CPU cores by default for faster extraction.
- Offers an extensible plugin system for adding custom format handlers and extractors.
- Runs as a regular user without requiring elevated privileges.
- Cross-platform support – runs under Linux and macOS.
Website: github.com/onekey-sec/unblob
Support:
Developer: ONEKEY
License: MIT License
unblob is written in Python. Learn Python with our recommended free books and free tutorials.
Related Software
| Binary Analysis Tools | |
|---|---|
| Ghidra | Software reverse engineering framework |
| Radare2 | Portable reversing framework |
| Cutter | Graphical reverse engineering platform |
| Capstone | Lightweight multi-architecture disassembly framework |
| Detect it Easy | File inspection utility |
| ImHex | Analyze binary data |
| Miasm | Reverse engineering framework for analysing and emulating binaries |
| Reko | General-purpose decompiler for machine-code binaries |
| capa | Command line malware analysis tool |
| binwalk | Search a given binary image for embedded files |
| FLOSS | FLARE Obfuscated String Solver |
| unblob | Extraction suite for working with unknown binary blobs |
| Rizin | UNIX-like reverse engineering framework |
| REDasm | Cross-platform disassembler with an extensible graphical interface |
| Pharos | Framework for automated static analysis of binary programs |
| LIEF | Work with executable and binary formats |
| RetDec | Retargetable machine-code decompiler |
| knife | Static binary triage, disassembly and vulnerability analysis toolkit |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.