Home
Recursive package / installer / archive / binary extractor for reverse-engineering triage.
RE-Unpacker takes a file or a directory and recursively pulls apart every package, installer, archive, filesystem image, compressed stream, and packed binary it recognizes, writing a structured tree of extracted content plus a machine-readable manifest. It is pure standard-library Python (no runtime dependencies) and drives well-known external system binaries for extraction. It runs on Linux (Kali / Debian / Ubuntu) and Windows.
Current version: 0.5.0. Manifest schema: 1.1.0.
- Quick Start Guide -- get running in five minutes.
- Setup Guide -- install and provision tools on Linux and Windows.
- Usage Guide -- every CLI mode, flag, and workflow.
- Troubleshooting Guide -- symptom-to-fix playbooks.
- Frequently Asked Questions -- scope, safety, behavior.
- Supported Formats -- the format-to-tool mapping.
- Manifest Schema Reference -- the output record format.
- Architecture and Design -- how detection and dispatch work.
- Development Guide -- contributing, extractor / verifier / classifier patterns.
- Repository: https://github.com/Sandler73/RE-Unpacker
- Changelog: https://github.com/Sandler73/RE-Unpacker/blob/main/CHANGELOG.md
- Security policy: https://github.com/Sandler73/RE-Unpacker/blob/main/SECURITY.md
- License: https://github.com/Sandler73/RE-Unpacker/blob/main/LICENSE (MIT)
RE-Unpacker is designed to process untrusted, potentially malicious input and implements defensive controls (argv-only subprocess execution, per-extractor timeouts, bounded output capture, path-traversal auditing with quarantine, and byte / file-count quotas). No tool can guarantee complete safety on adversarial input. Run RE-Unpacker in an isolated analysis environment and treat every extracted artifact as potentially malicious.