Manifest Schema Reference

Manifest Schema Reference

This page mirrors the Output layout and Manifest schema sections of the README.

Output layout

Every run writes to <output_root>/ with this structure:

<output_root>/
├── manifest.json                     # consolidated final manifest
├── manifest.jsonl                    # streaming JSONL, line-buffered (crash-resilient)
├── extraction.log                    # full DEBUG log (line-buffered)
├── errors.log                        # warnings+ only, for quick triage
├── tree.txt                          # pure-Python tree-style listing of extracted/
├── summary.txt                       # stats, top kinds, largest files, error summary
└── extracted/
    └── <input-name>.unpacked/        # top-level input
        ├── (files from primary extraction)
        ├── <nested>.unpacked/        # recursive: same scheme at each depth
        │   └── …
        ├── _secondary_<extractor>/   # e.g. _secondary_wrestool/ or _secondary_objcopy_ELF_sections/
        │   └── …
        └── _quarantine/              # (only if the path-safety audit moved anything here)

The .unpacked suffix makes it obvious in ls output which directories are re-unpacker products. _secondary_… subdirectories are the outputs of resource / section extractors (PE resources, ELF sections). _quarantine only appears if an escaping path was detected and relocated.

---

Manifest schema

manifest.json is the authoritative machine-readable record. Schema version is currently 1.1.0 (tracked in constants.SCHEMA_VERSION). All fields are UTF-8 strings unless noted.

Top-level

{
  "schema_version": "1.1.0",
  "tool": "re-unpacker",
  "tool_version": "0.3.2",
  "generated_at": "2026-04-21T17:48:30Z",
  "opened_at":    "2026-04-21T17:48:28Z",
  "host": "kali-rig-01",
  "os":   "Linux-6.6.x-…",
  "invocation": {
    "argv": ["…", "sample.deb", "-o", "out"],
    "cwd":  "/home/re/work",
    "pid":  12345
  },
  "input_root":  "/path/to/input",
  "output_root": "/path/to/out",
  "tools_detected": { /* per-tool: path, version, package_hint, available */ },
  "stats":  { /* see below */ },
  "errors": [ /* list of ErrorEntry */ ],
  "files":  [ /* list of FileEntry */ ]
}

stats object

{
  "inputs_scanned":          22,
  "files_extracted":         22,
  "archives_processed":      3,
  "archives_failed":         0,
  "archives_skipped_dedup":  0,
  "bytes_in":                0,
  "bytes_out":               356826,
  "duration_seconds":        1.38,
  "max_depth_reached":       4,
  "errors_count":            0,
  "quarantined_paths":       0,
  "symlinks_neutralized":    0
}

FileEntry

One per file the orchestrator looked at (both extracted and pass-through):

{
  "path":                    "/abs/path/to/file",
  "rel_path":                "extracted/…/file",
  "rel_path_from_source":    "inner/path/inside/archive",
  "source_archive":          "/abs/path/to/parent.tar.gz",
  "source_archive_sha256":   "27b4…",
  "size":                    51234,
  "sha256":                  "…",
  "md5":                     "…",
  "file_magic":              "ELF 64-bit LSB pie executable, x86-64, …",
  "mime_type":               "application/x-pie-executable",
  "kind":                    "ELF",
  "extractor":               null,
  "depth":                   3,
  "mode":                    "0755",
  "mtime":                   "2026-04-21T17:48:28Z",
  "signals":                 ["magic:ELF", "file_desc:ELF …", "mime:…", "ext:"],
  // -------- schema 1.1.0 additions, all optional --------
  "ssdeep":                  "768:abc...:xyz",          // null when not computed
  "tlsh":                    "T1A2B3C4...",              // null below TLSH min size / diversity
  "entropy":                 7.823,                       // bits/byte, range 0.0--8.0
  "encrypted":               false,
  "encryption_scheme":       null,                        // "luks" | "gpg" | "rar5-encrypted" | "age" | null
  "yara_matches":            [
    {
      "rule_name":  "Suspicious_Powershell",
      "namespace":  "etc:0:rules",
      "tags":       ["powershell", "obfuscated"],
      "meta":       {"author": "...", "severity": "high"}
    }
  ],
  "exif_metadata":           { "FileType": "ELF", "MachineType": "AMD64", /* ... */ },
  "enrichment_skipped":      null,                        // "size_exceeds_cap" when > 256 MiB
  "verification":            [
    {
      "verifier_name":     "rpm-K",
      "performed":         true,
      "applicable":        true,
      "signed":            true,
      "valid":             true,
      "signer":            null,
      "error":             null,
      "duration_seconds":  0.123
    }
  ]
}

ErrorEntry

{
  "timestamp":       "2026-04-21T17:48:29Z",
  "path":            "/abs/path/to/source.exe",
  "extractor":       "innoextract",
  "error_class":     "ExtractorFailure",
  "message":         "Extractor 'innoextract' failed on '…' (rc=1)",
  "returncode":      1,
  "stderr_snippet":  "I/O error…",
  "context":         { /* per-error extras */ }
}

manifest.jsonl

One JSON record per line (record_type is "header", "file", "error", or "footer"). Line-buffered. Grep- and jq -c-friendly:

jq -c 'select(.record_type == "file" and .kind == "ELF") | .path' out/manifest.jsonl

---