Packages and Binaries:

unblob

This package contains an accurate, fast, and easy-to-use extraction suite. It parses unknown binary blobs for more than 30 different archive, compression, and file-system formats, extracts their content recursively, and carves out unknown chunks that have not been accounted for.

This package installs the library for Python 3.

Installed size: 432 KB
How to install: sudo apt install unblob

unblob

root@kali:~# unblob -h
Usage: unblob [OPTIONS] FILE

  A tool for getting information out of any kind of binary blob.

  You also need these extractor commands to be able to extract the supported
  file types: 7z, debugfs, jefferson, lz4, lziprecover, lzop, sasquatch,
  sasquatch-v4be, simg2img, ubireader_extract_files, ubireader_extract_images,
  unar, zstd

  NOTE: Some older extractors might not be compatible.

Options:
  -e, --extract-dir DIRECTORY     Extract the files to this directory. Will be
                                  created if doesn't exist.
  -f, --force                     Force extraction even if outputs already
                                  exist (they are removed).
  -d, --depth INTEGER RANGE       Recursion depth. How deep should we extract
                                  containers.  [default: 10; x>=1]
  -n, --entropy-depth INTEGER RANGE
                                  Entropy calculation depth. How deep should
                                  we calculate entropy for unknown files? 1
                                  means input files only, 0 turns it off.
                                  [default: 1; x>=0]
  -P, --plugins-path PATH         Load plugins from the provided path.
  -S, --skip-magic TEXT           Skip processing files with given magic
                                  prefix. The provided values are appended to
                                  unblob's own skip magic list unless --clear-
                                  skip-magic is provided. [default: BFLT,
                                  Composite Document File V2 Document, Erlang
                                  BEAM file, GIF, GNU message catalog, HP
                                  Printer Job Language, Intel serial flash for
                                  PCH ROM, JPEG, Java module image, MPEG, MS
                                  Windows icon resource, Macromedia Flash
                                  data, Microsoft Excel, Microsoft PowerPoint,
                                  Microsoft Word, OpenDocument, PDF document,
                                  PNG, SQLite, TrueType Font data, Web Open
                                  Font Format, Windows Embedded CE binary
                                  image, Xilinx BIT data, compiled Java class,
                                  magic binary file, python]
  --skip-extension TEXT           Skip processing files with given extension
                                  [default: .rlib]
  --clear-skip-magics             Clear unblob's own skip magic list.
  -p, --process-num INTEGER RANGE
                                  Number of worker processes to process files
                                  parallelly.  [default: 4; x>=1]
  --report PATH                   File to store metadata generated during the
                                  extraction process (in JSON format).
  --log PATH                      File to save logs (in text format). Defaults
                                  to unblob.log.
  -s, --skip-extraction           Only carve chunks and skip further
                                  extraction
  -k, --keep-extracted-chunks     Keep extracted chunks
  -v, --verbose                   Verbosity level, counting, maximum level: 3
                                  (use: -v, -vv, -vvv)
  --show-external-dependencies    Shows commands needs to be available for
                                  unblob to work properly
  --version                       Shows unblob version
  -h, --help                      Show this message and exit.