Unblob Tutorial: Extract Files from Binary and Firmware Blobs

Firmware analysis and embedded device security assessments often begin with extracting proprietary binary packages. Traditional tools frequently struggle when dealing with multi-layered containers, compressed file systems, or nested vendor images. Unblob is an open-source binary extraction suite designed to identify, unpack, and carve files from unknown container formats with high speed and precision. Security researchers often combine automated extraction pipelines with core Linux data processing tools, such as the sort command for organizing extracted file lists, to streamline reverse engineering workflows.

What Is Unblob?

Unblob is a modern extraction and analysis suite maintained by the security team at ONEKEY and released under the MIT license on the official Unblob GitHub repository. Built primarily in Python and Rust, the framework detects and parses more than 30 distinct archive, compression, and file system formats.

Rather than merely scanning magic bytes and guessing boundaries, Unblob validates headers, validates structure integrity, and recursively unpacks internal payloads. Any unrecognized or unaccounted-for binary chunks are carved out separately for inspection, ensuring analysts do not miss hidden configurations, bootloaders, or obfuscated payloads.

Key Features and Extraction Capabilities

Unblob stands out in the firmware auditing ecosystem through several architectural features:

• Recursive Unpacking: Automatically extracts nested archives within file systems, such as a tar archive inside a SquashFS image packed into an encrypted update container.
• Multi-Format Coverage: Supports file systems like SquashFS, CramFS, YAFFS, UBIFS, and Ext2/3/4, alongside archive types including ZIP, 7z, TAR, and CPIO.
• Accurate Carving: Identifies unmapped offsets and carves out unknown chunks without corrupting adjacent structured content.
• Dual Interface: Functions either as an interactive command-line utility or as a modular Python library integrated into automated scanning pipelines.
• Fast Processing: Uses high-performance parsing libraries and multi-core execution to inspect large multi-gigabyte disk images quickly.

Supported Formats Overview

Installing Unblob

Unblob relies on external decompression helpers and native system libraries to handle diverse file formats. The recommended deployment method uses Docker or Python package managers on Linux distributions.

Using Pip on Linux

Ensure Python 3.10 or newer is available, install required system utilities, and install the package via pip:

sudo apt-get update
sudo apt-get install -y libmagic1 liblzo2-2
pip install unblob

Running via Docker

To avoid managing external system dependencies manually, run Unblob inside its official pre-built container:

docker pull onekeysec/unblob
docker run --rm -v $(pwd):/data onekeysec/unblob /data/firmware.bin

Basic Usage and CLI Syntax

Unblob features a straightforward command-line interface. To analyze a binary blob and extract all recognized structures into a destination directory, execute:

unblob --extract-dir ./extracted_output firmware.bin

During the extraction run, Unblob scans the input file sequentially, builds a hierarchical map of internal chunks, and extracts nested partitions to disk. Useful operational options include:

• --extract-dir DIRECTORY: Sets the target directory where carved contents and unpacked file systems will be stored.
• --keep-extracted-chunks: Preserves raw carved chunks on disk alongside the uncompressed directory trees.
• --verbose: Enables detailed logging to trace file boundary detection and format validation in real time.

By producing cleanly organized output directories and handling edge-case container structures, Unblob significantly cuts down manual triage time for firmware auditors and defensive security engineers.