Supported Formats¶
Didn't find what you're looking for? (1)
-
unblob is easily extensible, and you can write your own handler and include your own extractors for proprietary formats. To learn more about this, see the development section. Alternatively, just open a new ticket in the Github issue tracker.
Whenever we stumble upon proprietary formats in our ONEKEY analysis platform, we will add support for it. At this point, we have developed about a dozen of additional, proprietary format Handlers.
If you are interested in a custom format not supported by the open source version, check out our platform at https://www.onekey.com or you can Contact Us.
All supported formats
| Format | Type | Fully supported? |
|---|---|---|
7-ZIP |
ARCHIVE | |
ANDROID EROFS |
FILESYSTEM | |
ANDROID SPARSE |
FILESYSTEM | |
AR |
ARCHIVE | |
ARC |
ARCHIVE | |
ARJ |
ARCHIVE | |
AUTEL ECC |
ARCHIVE | |
BZIP2 |
COMPRESSION | |
CAB |
ARCHIVE | |
COMPRESS |
COMPRESSION | |
CPIO (BINARY) |
ARCHIVE | |
CPIO (PORTABLE ASCII CRC) |
ARCHIVE | |
CPIO (PORTABLE ASCII) |
ARCHIVE | |
CPIO (PORTABLE OLD ASCII) |
ARCHIVE | |
CRAMFS |
FILESYSTEM | |
D-LINK ENCRPTED_IMG |
ARCHIVE | |
D-LINK SHRS |
ARCHIVE | |
DMG |
ARCHIVE | |
ELF (32-BIT) |
EXECUTABLE | |
ELF (64-BIT) |
EXECUTABLE | |
ENGENIUS |
ARCHIVE | |
EXTFS |
FILESYSTEM | |
FAT |
FILESYSTEM | |
GZIP |
COMPRESSION | |
GZIP (MULTI-VOLUME) |
COMPRESSION | |
HP BDL |
ARCHIVE | |
HP IPKG |
ARCHIVE | |
INSTAR BNEG |
ARCHIVE | |
INSTAR HD |
ARCHIVE | |
ISO 9660 |
FILESYSTEM | |
JFFS2 (NEW) |
FILESYSTEM | |
JFFS2 (OLD) |
FILESYSTEM | |
LZ4 |
COMPRESSION | |
LZ4 (LEGACY) |
COMPRESSION | |
LZ4 (SKIPPABLE) |
COMPRESSION | |
LZH |
COMPRESSION | |
LZIP |
COMPRESSION | |
LZMA |
COMPRESSION | |
LZO |
COMPRESSION | |
MULTI-SEVENZIP |
ARCHIVE | |
NETGEAR CHK |
ARCHIVE | |
NETGEAR TRX V1 |
ARCHIVE | |
NETGEAR TRX V2 |
ARCHIVE | |
NTFS |
FILESYSTEM | |
PARTCLONE |
ARCHIVE | |
QNAP NAS |
ARCHIVE | |
RAR |
ARCHIVE | |
ROMFS |
FILESYSTEM | |
SQUASHFS (V1) |
FILESYSTEM | |
SQUASHFS (V2) |
FILESYSTEM | |
SQUASHFS (V3) |
FILESYSTEM | |
SQUASHFS (V3-BROADCOM) |
FILESYSTEM | |
SQUASHFS (V3-DDWRT) |
FILESYSTEM | |
SQUASHFS (V3-NON-STANDARD) |
FILESYSTEM | |
SQUASHFS (V4-BE) |
FILESYSTEM | |
SQUASHFS (V4-LE) |
FILESYSTEM | |
STUFFIT SIT |
ARCHIVE | |
STUFFIT SIT (V5) |
ARCHIVE | |
TAR (UNIX) |
ARCHIVE | |
TAR (USTAR) |
ARCHIVE | |
UBI |
FILESYSTEM | |
UBIFS |
FILESYSTEM | |
UZIP |
COMPRESSION | |
XIAOMI HDR1 |
ARCHIVE | |
XIAOMI HDR2 |
ARCHIVE | |
XZ |
COMPRESSION | |
YAFFS |
FILESYSTEM | |
ZIP |
ARCHIVE | |
ZLIB |
COMPRESSION | |
ZSTD |
COMPRESSION |
7-Zip¶
Fully supported
The 7-Zip file format is a compressed archive format with high compression ratios, supporting multiple algorithms, CRC checks, and multi-volume archives.
- Handler type: Archive
Android EROFS¶
Fully supported
EROFS (Enhanced Read-Only File System) is a lightweight, high-performance file system designed for read-only use cases, commonly used in Android and Linux. It features compression support, metadata efficiency, and a fixed superblock structure.
- Handler type: FileSystem
- Vendor: Google
Android Sparse¶
Fully supported
Android sparse images are a file format used to efficiently store disk images by representing sequences of zero blocks compactly. The format includes a file header, followed by chunk headers and data, with support for raw, fill, and 'don't care' chunks.
- Handler type: FileSystem
- Vendor: Google
AR¶
Fully supported
Unix AR (archive) files are used to store multiple files in a single archive with a simple header format.
- Handler type: Archive
ARC¶
Fully supported
ARC is a legacy archive format used to store multiple files with metadata such as file size, creation date, and CRC.
- Handler type: Archive
ARJ¶
Fully supported
ARJ is a legacy compressed archive formats used to store multiple files with metadata such as file size, creation date, and CRC.
- Handler type: Archive
Autel ECC¶
Fully supported
Autel ECC files consist of a custom header followed by encrypted data blocks. The header includes metadata such as magic bytes, file size, and copyright information.
- Handler type: Archive
- Vendor: Autel
bzip2¶
Fully supported
The bzip2 format is a block-based compression format that uses the Burrows-Wheeler transform and Huffman coding for high compression efficiency. Each stream starts with a header and consists of one or more compressed blocks, ending with a footer containing a checksum.
- Handler type: Compression
CAB¶
Fully supported
Microsoft Cabinet (CAB) archive files are used for compressed file storage and software installation.
- Handler type: Archive
- Vendor: Microsoft
compress¶
Fully supported
Unix compress files use the Lempel-Ziv-Welch (LZW) algorithm for data compression and are identified by a 2-byte magic number (0x1F 0x9D). This format supports optional block compression and variable bit lengths ranging from 9 to 16 bits.
- Handler type: Compression
CPIO (binary)¶
Fully supported
CPIO (Copy In, Copy Out) is an archive file format used for bundling files and directories along with their metadata. It is commonly used in Unix-like systems for creating backups or transferring files, and supports various encoding formats including binary and ASCII.
- Handler type: Archive
CPIO (portable ASCII CRC)¶
Fully supported
CPIO (Copy In, Copy Out) is an archive file format used for bundling files and directories along with their metadata. It is commonly used in Unix-like systems for creating backups or transferring files, and supports various encoding formats including binary and ASCII.
- Handler type: Archive
CPIO (portable ASCII)¶
Fully supported
CPIO (Copy In, Copy Out) is an archive file format used for bundling files and directories along with their metadata. It is commonly used in Unix-like systems for creating backups or transferring files, and supports various encoding formats including binary and ASCII.
- Handler type: Archive
CPIO (portable old ASCII)¶
Fully supported
CPIO (Copy In, Copy Out) is an archive file format used for bundling files and directories along with their metadata. It is commonly used in Unix-like systems for creating backups or transferring files, and supports various encoding formats including binary and ASCII.
- Handler type: Archive
CramFS¶
Fully supported
CramFS is a lightweight, read-only file system format designed for simplicity and efficiency in embedded systems. It uses zlib compression for file data and stores metadata in a compact, contiguous structure.
- Handler type: FileSystem
D-Link encrpted_img¶
Fully supported
A binary format used by D-Link to store encrypted firmware or data. It consists of a custom 12-byte magic header followed by the encrypted payload.
- Handler type: Archive
- Vendor: D-Link
D-Link SHRS¶
Fully supported
SHRS is a D-Link firmware format with a custom header containing metadata, SHA-512 digests, and AES-CBC encryption parameters. The firmware data is encrypted using a fixed key and IV stored in the header.
- Handler type: Archive
- Vendor: D-Link
DMG¶
Fully supported
Apple Disk Image (DMG) files are commonly used on macOS for software distribution and disk image storage.
- Handler type: Archive
- Vendor: Apple
ELF (32-bit)¶
Fully supported
The 32-bit ELF (Executable and Linkable Format) is a binary file format used for executables, object code, shared libraries, and core dumps. It supports 32-bit addressing and includes headers for program and section information.
- Handler type: Executable
ELF (64-bit)¶
Fully supported
The 64-bit ELF (Executable and Linkable Format) is a binary file format used for executables, object code, shared libraries, and core dumps. It supports 64-bit addressing and includes headers for program and section information.
- Handler type: Executable
Engenius¶
Partially supported
Engenius firmware files contain a custom header with metadata, followed by encrypted data using an XOR cipher.
- Handler type: Archive
- Vendor: Engenius
- Does not support all firmware versions.
ExtFS¶
Fully supported
ExtFS (Ext2/Ext3/Ext4) is a family of journaling file systems commonly used in Linux-based operating systems. It supports features like large file sizes, extended attributes, and journaling for improved reliability.
- Handler type: FileSystem
FAT¶
Fully supported
FAT (File Allocation Table) is a file system format used for organizing and managing files on storage devices, supporting FAT12, FAT16, and FAT32 variants. It uses a table to map file clusters, enabling efficient file storage and retrieval.
- Handler type: FileSystem
GZIP¶
Fully supported
GZIP is a compressed file format that uses the DEFLATE algorithm and includes metadata such as original file name and modification time. It is commonly used for efficient file storage and transfer.
- Handler type: Compression
GZIP (multi-volume)¶
Fully supported
GZIP is a compressed file format that uses the DEFLATE algorithm and includes metadata such as original file name and modification time. It is commonly used for efficient file storage and transfer.
- Handler type: Compression
HP BDL¶
Fully supported
The HP BDL format is a firmware archive containing a custom header and a table of contents that specifies offsets and sizes of embedded firmware components. It includes metadata such as release, brand, device ID, version, and revision.
- Handler type: Archive
- Vendor: HP
HP IPKG¶
Fully supported
HP IPKG firmware archives consist of a custom header, followed by a table of contents and file entries. Each entry specifies metadata such as file name, offset, size, and CRC32 checksum.
- Handler type: Archive
- Vendor: HP
Instar BNEG¶
Fully supported
BNEG firmware files consist of a custom header followed by two partitions containing firmware components. The header specifies metadata such as magic value, version, and partition sizes.
- Handler type: Archive
- Vendor: Instar
Instar HD¶
Fully supported
Instar HD firmware files are modified ZIP archives with non-standard local file headers, central directory headers, and end-of-central-directory records. These modifications include custom magic bytes to differentiate them from standard ZIP files.
- Handler type: Archive
- Vendor: Instar
ISO 9660¶
Fully supported
ISO 9660 is a file system standard for optical disc media, defining a volume descriptor structure and directory hierarchy. It is widely used for CD-ROMs and supports cross-platform compatibility.
- Handler type: FileSystem
JFFS2 (new)¶
Fully supported
JFFS2 (Journaling Flash File System version 2) is a log-structured file system for flash memory devices, using an older magic number to identify its nodes. It organizes data into nodes with headers containing metadata and CRC checks for integrity.
- Handler type: FileSystem
JFFS2 (old)¶
Fully supported
JFFS2 (Journaling Flash File System version 2) is a log-structured file system for flash memory devices, using an older magic number to identify its nodes. It organizes data into nodes with headers containing metadata and CRC checks for integrity.
- Handler type: FileSystem
LZ4¶
Fully supported
LZ4 is a high-speed lossless compression algorithm designed for real-time data compression with minimal memory usage.
- Handler type: Compression
LZ4 (legacy)¶
Fully supported
LZ4 legacy format is an older framing format used prior to the LZ4 Frame specification, featuring a simpler structure and no support for skippable frames or extensive metadata. Unlike the default LZ4 Frame format, it lacks built-in checksums, versioning, or block independence flags, making it less robust and primarily used for backward compatibility.
- Handler type: Compression
LZ4 (skippable)¶
Fully supported
LZ4 skippable format is designed to encapsulate arbitrary data within an LZ4 stream allowing compliant parsers to skip over it safely. This format does not contain compressed data itself but is often used for embedding metadata or non-LZ4 content alongside standard frames.
- Handler type: Compression
LZH¶
Fully supported
LZH is a legacy archive format that uses various compression methods such as '-lh0-' and '-lh5-'. It was widely used in Japan and on older systems for compressing and archiving files.
- Handler type: Compression
Lzip¶
Fully supported
Lzip is a lossless compressed file format based on the LZMA algorithm. It features a simple header, CRC-checked integrity, and efficient compression for large files.
- Handler type: Compression
LZMA¶
Fully supported
LZMA is a compression format based on the Lempel-Ziv-Markov chain algorithm, offering high compression ratios and efficient decompression. It is commonly used in standalone .lzma files and embedded in other formats like 7z.
- Handler type: Compression
LZO¶
Fully supported
LZO is a data compression format featuring a simple header structure and optional checksum verification. It is optimized for fast decompression and supports various compression levels and flags for additional metadata.
- Handler type: Compression
multi-sevenzip¶
Fully supported
The 7-Zip file format is a compressed archive format with high compression ratios, supporting multiple algorithms, CRC checks, and multi-volume archives.
- Handler type: Archive
Netgear CHK¶
Fully supported
Netgear CHK firmware files consist of a custom header containing metadata and checksums, followed by kernel and root filesystem partitions. The header includes fields for partition sizes, checksums, and a board identifier.
- Handler type: Archive
- Vendor: Netgear
Netgear TRX v1¶
Fully supported
Netgear TRX v1 firmware format includes a custom header with partition offsets and a CRC32 checksum for integrity verification. It supports up to three partitions defined in the header.
- Handler type: Archive
- Vendor: Netgear
Netgear TRX v2¶
Fully supported
Netgear TRX v2 firmware format includes a custom header with partition offsets and a CRC32 checksum for integrity verification. It supports up to four partitions defined in the header.
- Handler type: Archive
- Vendor: Netgear
NTFS¶
Fully supported
NTFS (New Technology File System) is a proprietary file system developed by Microsoft, featuring metadata support, advanced data structures, and journaling for reliability. It is commonly used in Windows operating systems for efficient storage and retrieval of files.
- Handler type: FileSystem
- Vendor: Microsoft
Partclone¶
Fully supported
Partclone is a utility used for backing up and restoring partitions. Many cloning tools (such as Clonezilla) rely on it to create block-level images that include filesystem metadata.
- Handler type: Archive
QNAP NAS¶
Fully supported
QNAP NAS firmware files consist of a custom header, encrypted data sections, and a footer marking the end of the encrypted stream. The header contains metadata such as device ID, firmware version, and encryption details.
- Handler type: Archive
- Vendor: QNAP
RAR¶
Partially supported
RAR archive files are commonly used for compressed data storage. They can contain multiple files and directories, and support various compression methods.
- Handler type: Archive
- Does not support encrypted RAR files.
RomFS¶
Fully supported
RomFS is a simple, space-efficient, read-only file system format designed for embedded systems. It features 16-byte alignment, minimal metadata overhead, and supports basic file types like directories, files, symlinks, and devices.
- Handler type: FileSystem
SquashFS (v1)¶
Fully supported
SquashFS version 1 is a compressed, read-only file system format designed for minimal storage usage. It is commonly used in embedded systems and early Linux distributions.
- Handler type: FileSystem
SquashFS (v2)¶
Fully supported
SquashFS version 2 is a compressed, read-only file system format designed for minimal storage usage. It builds upon version 1 with additional features and improvements for embedded systems and Linux distributions.
- Handler type: FileSystem
SquashFS (v3)¶
Fully supported
SquashFS version 3 is a compressed, read-only file system format designed for minimal storage usage. It is widely used in embedded systems and Linux distributions for efficient storage and fast access.
- Handler type: FileSystem
SquashFS (v3-Broadcom)¶
Fully supported
SquashFS version 3 Broadcom is a variant of the SquashFS v3 format used in Broadcom firmware. It features a unique magic number and may include specific optimizations for Broadcom devices.
- Handler type: FileSystem
- Vendor: Broadcom
SquashFS (v3-DDWRT)¶
Fully supported
SquashFS version 3 DD-WRT is a variant of the SquashFS v3 format used in DD-WRT firmware. It features a unique magic number and may include specific optimizations for embedded systems.
- Handler type: FileSystem
- Vendor: DDWRT
SquashFS (v3-non-standard)¶
Fully supported
SquashFS version 3 is a compressed, read-only file system format designed for minimal storage usage. It is widely used in embedded systems and Linux distributions for efficient storage and fast access.
- Handler type: FileSystem
- Vendor: unknown
SquashFS (v4-BE)¶
Fully supported
SquashFS version 4 is a compressed, read-only file system format designed for minimal storage usage and fast access. It supports both big-endian and little-endian formats and is widely used in embedded systems and Linux distributions.
- Handler type: FileSystem
SquashFS (v4-LE)¶
Fully supported
SquashFS version 4 is a compressed, read-only file system format designed for minimal storage usage and fast access. It is widely used in embedded systems and Linux distributions for efficient storage management.
- Handler type: FileSystem
Stuffit SIT¶
Fully supported
StuffIt SIT archives is a legacy compressed archive format commonly used on macOS and earlier Apple systems.
- Handler type: Archive
- Vendor: StuffIt Technologies
Stuffit SIT (v5)¶
Fully supported
StuffIt SIT archives is a legacy compressed archive format commonly used on macOS and earlier Apple systems.
- Handler type: Archive
- Vendor: StuffIt Technologies
TAR (Unix)¶
Fully supported
Unix tar files are a widely used archive format for storing files and directories with metadata.
- Handler type: Archive
TAR (USTAR)¶
Fully supported
USTAR (Uniform Standard Tape Archive) tar files are extensions of the original tar format with additional metadata fields.
- Handler type: Archive
UBI¶
Fully supported
UBI (Unsorted Block Image) is a volume management system for raw flash devices, providing wear leveling and bad block management. It operates as a layer between the MTD subsystem and higher-level filesystems like UBIFS.
- Handler type: FileSystem
UBIFS¶
Fully supported
UBIFS (Unsorted Block Image File System) is a flash file system designed for raw flash memory, providing wear leveling, error correction, and power failure resilience. It operates on top of UBI volumes, which manage flash blocks on raw NAND or NOR flash devices.
- Handler type: FileSystem
UZIP¶
Fully supported
FreeBSD UZIP is a block-based compressed disk image format. It uses a table of contents to index compressed blocks, supporting ZLIB, LZMA, and ZSTD compression algorithms.
- Handler type: Compression
- Vendor: FreeBSD
Xiaomi HDR1¶
Fully supported
Xiaomi HDR1 firmware files feature a custom header containing metadata, CRC32 checksum, and blob offsets for embedded data. These files are used in Xiaomi devices for firmware updates.
- Handler type: Archive
- Vendor: Xiaomi
Xiaomi HDR2¶
Fully supported
Xiaomi HDR2 firmware files feature a custom header with metadata, CRC32 checksum, and blob offsets for embedded data. These files also include additional fields for device ID and region information.
- Handler type: Archive
- Vendor: Xiaomi
XZ¶
Fully supported
XZ is a compressed file format that uses the LZMA2 algorithm for high compression efficiency. It is designed for general-purpose data compression with support for integrity checks and padding for alignment.
- Handler type: Compression
YAFFS¶
Fully supported
YAFFS (Yet Another Flash File System) is a log-structured file system designed for NAND flash memory, storing data in fixed-size chunks with associated metadata. It supports features like wear leveling, error correction, and efficient handling of power loss scenarios.
- Handler type: FileSystem
ZIP¶
Partially supported
ZIP is a widely used archive file format that supports multiple compression methods, file spanning, and optional encryption. It includes metadata such as file names, sizes, and timestamps, and supports both standard and ZIP64 extensions for large files.
- Handler type: Archive
- Does not support encrypted ZIP files.
zlib¶
Fully supported
The zlib format is a compressed data format based on the DEFLATE algorithm, often used for data compression in various applications. It includes a lightweight header and checksum for data integrity.
- Handler type: Compression
ZSTD¶
Fully supported
Zstandard (ZSTD) is a fast lossless compression algorithm with high compression ratios, designed for modern data storage and transfer. Its file format includes a frame structure with optional dictionary support and checksums for data integrity.
- Handler type: Compression