Supported file formats¶
unblob supports more than 30 formats. You can see their code in
unblob/handlers/.
✅: Some or all metadata is preserved for the format.
❌: Metadata is not preserved (limitation of the format).
Archives¶
| Format | Preserved metadata | Handler | Extractor command | ||
|---|---|---|---|---|---|
| timestamps | permissions | ownership | |||
| AR | ❌ | ❌ | ❌ | archive/ar.py | unar |
| ARC | ❌ | ❌ | ❌ | archive/arc.py | unar |
| ARJ | ✅ | ✅ | ❌ | archive/arj.py | 7z |
| CAB | ❌ | ❌ | ❌ | archive/cab.py | 7z |
| CPIO | ✅ | ✅ | ✅ | archive/cpio.py | unblob extractor |
| DMG | ❌ | ❌ | ❌ | archive/dmg.py | 7z |
| RAR | ❌ | ❌ | ❌ | archive/rar.py | unar |
| 7ZIP | ❌ | ❌ | ❌ | archive/sevenzip.py | 7z |
| StuffIt | ❌ | ❌ | ❌ | archive/stuffit.py | unar |
| TAR | ✅ | ✅ | ✅ | archive/tar.py | 7z |
| ZIP | ✅ | ✅ | ✅ | archive/zip.py | 7z |
Compression¶
For compression formats, metadata cannot be preserved, as this information in most cases is not stored in the format.
| Format | Handler | Extractor |
|---|---|---|
| bzip2 | compression/bzip2.py | 7z |
| UNIX compress | compression/compress.py | 7z |
| gzip | compression/gzip.py | 7z |
| LZ4 | compression/lz4.py | lz4 |
| LZH | compression/lzh.py | 7z |
| LZIP | compression/lzip.py | lziprecover |
| LZMA | compression/lzma.py | 7z |
| LZO | compression/lzo.py | lzop |
| XZ | compression/xz.py | 7z |
| ZLIB | compression/zlib.py | ZlibExtractor custom code |
| ZSTD | compression/zstd.py | zstd |
Filesystems¶
| Format | Preserved metadata | Handler | Extractor command |
|---|---|---|---|
| Android sparse image | ❌ | filesystem/android/sparse.py | simg2img |
| CRAMFS | ✅ | filesystem/cramfs.py | 7z |
| ExtFS | ✅ | filesystem/extfs.py | debugfs |
| FAT | ✅ | filesystem/fat.py | 7z |
| ISO9660 | ✅ | filesystem/iso9660.py | 7z |
| JFFS2 | ✅ | filesystem/jffs2.py | jefferson |
| NTFS | ✅ | filesystem/ntfs.py | 7z |
| RomFS | ✅ everything is o+rw or o+rwx |
filesystem/romfs.py | RomFsExtractor custom code |
| SquashFS (v3, v4) | ✅ | filesystem/squashfs.py | sasquatch |
| SquashFS v4 Big Endian | ✅ | filesystem/squashfs.py | sasquatch-v4-be |
| UBI | ✅ | filesystem/ubi.py | ubireader_extract_images |
| UBIFS | ✅ | filesystem/ubi.py | ubireader_extract_files |
| YAFFS (1, 2) | ✅ | filesystem/yaffs.py | YAFFSExtractor custom code |
Vendors¶
| Format | Preserved metadata | Handler | Extractor command |
|---|---|---|---|
| HP BDL | ❌ | archive/hp/bdl.py | unblob extractor |
| HP IPKG | ❌ | archive/hp/ipkg.py | unblob extractor |
| Instar HD | ❌ | archive/instar/instar_hd.py | unblob extractor |
| Instar BNEG | ❌ | archive/instar/bneg.py | unblob extractor |
| QNAP NAS | ❌ | archive/qnap/qnap_nas.py | unblob extractor |
| D-Link SHRS | ❌ | archive/dlink/encrpted_img.py | unblob extractor |
| D-Link encrpted (sic) | ❌ | archive/dlink/shrs.py | unblob extractor |
| Engeniustech | ❌ | archive/engeniustech/engenius.py | unblob extractor |
| Netgear TRX | ❌ | archive/netgear/trx.py | unblob extractor |
| Netgear CHK | ❌ | archive/netgear/chk.py | unblob extractor |
| Xiaomi HDR | ❌ | archive/xiaomi/hdr.py | unblob extractor |
Didn't find your format supported yet?¶
unblob is easily extensible, and you can write your own handler and include your own extractors for proprietary formats. To learn more about this, see the development section. Alternatively, just open a new ticket in the Github issue tracker.
Whenever we stumble upon proprietary formats in our ONEKEY analysis platform, we will add support for it. At this point, we have developed about a dozen of additional, proprietary format Handlers.
If you are interested in a custom format not supported by the open source version, check out our platform at https://www.onekey.com or you can Contact Us.