All Projects → tintinweb → unbox

tintinweb / unbox

Licence: GPL-3.0 license
🎁 unbox - Unpack and Decompile the $h*! out of things

Programming Languages

python
139335 projects - #7 most used programming language

Projects that are alternatives of or similar to unbox

TML.Patcher
Console application for decompiling, recompiling, packaging, and patching tModLoader's .tmod files at blazing-fast speeds.
Stars: ✭ 38 (-2.56%)
Mutual labels:  decompiler, unpacker
Clj Java Decompiler
REPL-integrated Clojure-to-Java decompiler
Stars: ✭ 177 (+353.85%)
Mutual labels:  decompiler
Python Uncompyle6
A cross-version Python bytecode decompiler
Stars: ✭ 2,461 (+6210.26%)
Mutual labels:  decompiler
Jpexs Decompiler
JPEXS Free Flash Decompiler
Stars: ✭ 2,939 (+7435.9%)
Mutual labels:  decompiler
Lucid
An Interactive Hex-Rays Microcode Explorer
Stars: ✭ 188 (+382.05%)
Mutual labels:  decompiler
Dnpatch
.NET Patcher library using dnlib
Stars: ✭ 249 (+538.46%)
Mutual labels:  decompiler
Recaf
The modern Java bytecode editor
Stars: ✭ 3,374 (+8551.28%)
Mutual labels:  decompiler
Il2cppspy
Unity IL2CPP Disassembler (for apk)
Stars: ✭ 213 (+446.15%)
Mutual labels:  decompiler
Rellic
Rellic produces goto-free C output from LLVM bitcode
Stars: ✭ 234 (+500%)
Mutual labels:  decompiler
binsync
A collaborative reversing plugin for cross-decompiler collaboration, built on git.
Stars: ✭ 266 (+582.05%)
Mutual labels:  decompiler
Hrdevhelper
Context-sensitive HexRays decompiler plugin that visualizes the ctree of decompiled functions.
Stars: ✭ 193 (+394.87%)
Mutual labels:  decompiler
Hexraystoolbox
Hexrays Toolbox - Find code patterns within the Hexrays AST
Stars: ✭ 202 (+417.95%)
Mutual labels:  decompiler
FIDL
A sane API for IDA Pro's decompiler. Useful for malware RE and vulnerability research
Stars: ✭ 421 (+979.49%)
Mutual labels:  decompiler
Rebel Framework
Advanced and easy to use penetration testing framework 💣🔎
Stars: ✭ 183 (+369.23%)
Mutual labels:  decompiler
SDA
SDA is a rich cross-platform tool for reverse engineering that focused firstly on analysis of computer games. I'm trying to create a mix of the Ghidra, Cheat Engine and x64dbg. My tool will combine static and dynamic analysis of programs. Now SDA is being developed.
Stars: ✭ 98 (+151.28%)
Mutual labels:  decompiler
Fernflower
Unofficial mirror of FernFlower Java decompiler (All pulls should be submitted upstream)
Stars: ✭ 2,380 (+6002.56%)
Mutual labels:  decompiler
homm3-unpacker
Parse HOMM3 game files
Stars: ✭ 23 (-41.03%)
Mutual labels:  unpacker
PboViewer
Cross-platform PBO maker / unpacker
Stars: ✭ 28 (-28.21%)
Mutual labels:  unpacker
ghidra2dwarf
🐉 Export ghidra decompiled code to dwarf sections inside ELF binary
Stars: ✭ 135 (+246.15%)
Mutual labels:  decompiler
RoAMer
Robust Automated Malware Unpacker
Stars: ✭ 72 (+84.62%)
Mutual labels:  unpacker

unbox Unpack and Decompile the $h*! out of things

unbox

Unbox is a convenient one-click unpack and decompiler tool that wraps existing 3rd party applications like IDA Pro, JD-Cli, Dex2Src, and others to provide a convenient archiver liker command line interfaces to unpack and decompile various types of files. It currently features support for compiled binaries (.net, PE, elf, mach, ...), java classes, android application packages and various types of archives or browser extensions. The goal of this tool is mainly to take off the extra efford needed to deal with the various decompiler tools and give a standard yet easy to use interface.

Requires: 🐍 python-2

Dependencies:

Usage 🐑

  example: unbox.py <command> [options] <target> [<target>, ...]
  options:
       -y, --yes    ...   answer prompts with yes
       -n, --no     ...   answer prompts with no

  command  ... list <target>
           ... extract <target> <destination path>

           ... check-dependencies

  target   ... file

One interface to rule them all...

usage command
unpack and decompile all *.jar files #> unbox/cli.py extract \lib\Adv*.jar c:\_tmp\decompiled
decompile a Windows dll #> unbox/cli.py extract samples\7-zip32.dll c:\_tmp\decompiled
decompile an elf executable #> unbox/cli.py extract samples/crackme1 /tmp/decompiled
unpack and decompile an apk #> unbox/cli.py extract test.apk c:\_tmp\decompiled
decompile a .net application #> unbox/cli.py extract test.exe c:\_tmp\decompiled
unpack a browser extension #> unbox/cli.py extract sample.crx c:\_tmp\decompiled
unpack all supported files #> unbox/cli.py extract * c:\_tmp\decompiled

I think you got the idea ...
... and yes it will recursively unpack things ...

Configuration

  • in case your 3rd party tools are not generally available via PATH configure them in unbox.json

application search-path order for unbox.json is

  • current working dir OR
  • ~/unbox.json OR
  • ~/.unbox/unbox.json

Setup

  • install
  • check dependencies python cli.py check-dependencies
    • install missing 3rd party applications (see table below)
    • make them available in PATH or configure them in unbox.json

As a Library

from unbox import UnboxPath

target = "path/to/target/file"

dst = UnboxPath(target)		# crate an unbox path instance
for p in dst.files.walk():	# auto-decompile/unpack and walk resulting files (source-code, etc..)
	print p.path		# print the unpacked files' path

Live Action

List contents of windows DLL

#> unbox/cli.py list "samples\7-zip32.dll"
[handler.base/2808][DEBUG     ] [base.get_path      ] unknown: 7-zip32.dll
[handler.base/2808][DEBUG     ] [base.get_path      ] {'source': 'databuffer', 'magic': {'mimetype': 'application/x-executable-mz', 'patterns': [{'regex': '\\x4D\\x5A', 'offset': 0, 'size': 2}], 'shortname': 'EXE', 'id': 31, 'longname': 'Windows Executable'}}
[handler.base/2808][DEBUG     ] [base.get_path      ] 2
[handler.commands.commands/2808][DEBUG     ] [commands.decompile     ] [u'ida\\idaw.exe', '-B', '-M', '-S"home\\.unbox\\ida_batch_decompile.py -o\\"tmpfolder\\unbox3fcvpg\\7-zip32.c\\""', '"7-zip32.dll"']
[handler.base/2808][DEBUG     ] [base.get_path      ] scheme: c
[handler.base/2808][DEBUG     ] [base.get_path      ] <Application32Bits encoding=None path=WindowsPath('tmpfolder/unbox3fcvpg')>
[handler.local/2808][DEBUG     ] [local.walk          ] walk: tmpfolder

[handler.base/2808][DEBUG     ] [base.get_path      ] unknown: tmpfolder\7-zip32.c
[handler.base/2808][DEBUG     ] [base.get_path      ] {'source': 'databuffer', 'magic': None}
[handler.base/2808][DEBUG     ] [base.get_path      ] scheme: c
[handler.base/2808][DEBUG     ] [base.get_path      ] <LocalPath encoding=None path=WindowsPath('tmpfolder/unbox3fcvpg/7-zip32.c')>
tmpfolder/unbox3fcvpg/7-zip32.c

Decompile a windows DLL

#> unbox/cli.py extract "samples\7-zip32.dll"
[handler.base/9848][DEBUG     ] [base.get_path      ] unknown: 7-zip32.dll
[handler.base/9848][DEBUG     ] [base.get_path      ] {'source': 'databuffer', 'magic': {'mimetype': 'application/x-executable-mz', 'patterns': [{'regex': '\\x4D\\x5A', 'offset': 0, 'size': 2}], 'shortname': 'EXE', 'id': 31, 'longname': 'Windows Executable'}}
[handler.base/9848][DEBUG     ] [base.get_path      ] 2
[handler.commands.commands/9848][DEBUG     ] [commands.decompile     ] [u'ida\\idaw.exe', '-B', '-M', '-S"home\\.unbox\\ida_batch_decompile.py -o\\"tmpfolder\\unboxdaj2bd\\7-zip32.c\\""', '"7-zip32.dll"']
[handler.base/9848][DEBUG     ] [base.get_path      ] scheme: c
[handler.base/9848][DEBUG     ] [base.get_path      ] <Application32Bits encoding=None path=WindowsPath('tmpfolder/unboxdaj2bd')>
[handler.local/9848][DEBUG     ] [local.walk          ] walk: tmpfolder\unboxdaj2bd

[handler.base/9848][DEBUG     ] [base.get_path      ] unknown: tmpfolder\unboxdaj2bd\7-zip32.c
[handler.base/9848][DEBUG     ] [base.get_path      ] {'source': 'databuffer', 'magic': None}
[handler.base/9848][DEBUG     ] [base.get_path      ] scheme: c
[handler.base/9848][DEBUG     ] [base.get_path      ] <LocalPath encoding=None path=WindowsPath('tmpfolder/unboxdaj2bd/7-zip32.c')>
tmpfolder\unboxdaj2bd\7-zip32.c

Unpack and decompile apk

(java) while decompiling binary applications on the fly (see ida output below)

#> unbox/cli.py extract test.apk
[handler.decompilable/13668][DEBUG     ] [decompilable._fetch        ] destination: test.apk.jar
[handler.utils.shell/13668][DEBUG     ] [shell.execute       ] [u'dex-tools-2.0\\dex2jar-2.0\\d2j-dex2jar.bat', '-o', 'tmpfolder\\unboxsmansz\\test.apk.jar', 'test.apk']
dex2jar test.apk -> tmpfolder\unboxsmansz\test.apk.jar
[handler.decompilable/13668][DEBUG     ] [decompilable._fetch        ] unpack .apk to tmpfolder\unboxsmansz\.apk
[handler.decompilable/13668][DEBUG     ] [decompilable._fetch        ] decompile .jar to tmpfolder\unboxsmansz\.source
[handler.utils.shell/13668][DEBUG     ] [shell.execute       ] [u'jd-cli\\jd-cli.bat', '--outputDir', 'tmpfolder\\unboxsmansz\\.source', 'test.apk.jar']
21:05:30.434 INFO  jd.cli.Main - Decompiling tmpfolder\unboxsmansz\test.apk.jar
21:05:30.467 INFO  jd.core.output.DirOutput - Directory output will be initialized for path tmpfolder\unboxsmansz\.source
21:05:30.787 WARN  jd.core.output.DirOutput - Class name or java source is null
ReferenceMap.add: InvalidParameterException(android/util/SparseArray<Landroid/support/v4/app/Fragment;>)
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ReferenceMap.add: InvalidParameterException(java/util/Map<Ljava/lang/String;Ljava/lang/String;>)
ReferenceMap.add: InvalidParameterException(java/util/Map<Ljava/lang/String;Ljava/lang/String;>)
Undefined type catch
Undefined type catch
Undefined type catch
Undefined type catch
Undefined type catch
Undefined type catch
Undefined type catch
Undefined type catch
java.lang.Throwable: NameGenerator.generateParameterNameFromSignature: invalid signature 'TT;'
	at jd.core.process.analyzer.variable.DefaultVariableNameGenerator.generateLocalVariableNameFromSignature(DefaultVariableNameGenerator.java:106)
	at jd.core.process.analyzer.classfile.LocalVariableAnalyzer.GenerateLocalVariableNames(LocalVariableAnalyzer.java:1733)
	at jd.core.process.analyzer.classfile.LocalVariableAnalyzer.Analyze(LocalVariableAnalyzer.java:206)
	at jd.core.process.analyzer.classfile.ClassFileAnalyzer.PreAnalyzeMethods(ClassFileAnalyzer.java:698)
	at jd.core.process.analyzer.classfile.ClassFileAnalyzer.AnalyzeClass(ClassFileAnalyzer.java:126)
	at jd.core.process.analyzer.classfile.ClassFileAnalyzer.Analyze(ClassFileAnalyzer.java:84)
	at jd.commonide.IdeDecompiler.decompile(IdeDecompiler.java:49)
	at jd.core.JavaDecompiler.decompile(JavaDecompiler.java:121)
	at jd.core.JavaDecompiler.decompileClass(JavaDecompiler.java:58)
	at jd.core.input.ZipFileInput.decompile(ZipFileInput.java:87)
	at jd.cli.Main.main(Main.java:118)
21:05:56.837 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:56.848 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:57.270 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:57.293 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:57.441 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:57.445 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:57.501 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:57.502 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:57.506 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:57.507 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:57.510 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:57.522 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:57.527 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:57.543 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:57.547 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:58.220 WARN  jd.core.output.DirOutput - Class name or java source is null
21:05:58.414 WARN  jd.core.output.DirOutput - Class name or java source is null
Undefined type catch
Undefined type catch
Undefined type catch
Undefined type catch
ReferenceMap.add: InvalidParameterException(java/util/Map<Ljava/lang/String;Ljava/lang/String;>)
21:06:04.651 WARN  jd.core.output.DirOutput - Class name or java source is null
ReferenceMap.add: InvalidParameterException(java/util/Map<Ljava/lang/String;Ljava/lang/String;>)
ReferenceMap.add: InvalidParameterException(java/util/Map<Ljava/lang/String;Ljava/lang/String;>)
ReferenceMap.add: InvalidParameterException(java/util/Map<Ljava/lang/String;Ljava/lang/String;>)
ReferenceMap.add: InvalidParameterException(java/util/Map<Ljava/lang/String;Ljava/lang/String;>)
ReferenceMap.add: InvalidParameterException(java/util/Map<Ljava/lang/String;Ljava/lang/String;>)
ReferenceMap.add: InvalidParameterException(java/util/Map<Ljava/lang/String;Ljava/lang/String;>)
Undefined type catch
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ReferenceMap.add: InvalidParameterException(java/util/Map<Ljava/lang/String;Ljava/lang/String;>)
ReferenceMap.add: InvalidParameterException(java/util/ArrayList<Ljava/lang/String;>)
21:06:11.038 WARN  jd.core.output.DirOutput - Class name or java source is null
java.lang.Throwable: NameGenerator.generateParameterNameFromSignature: invalid signature 'TT;'
	at jd.core.process.analyzer.variable.DefaultVariableNameGenerator.generateLocalVariableNameFromSignature(DefaultVariableNameGenerator.java:106)
	at jd.core.process.analyzer.classfile.LocalVariableAnalyzer.GenerateLocalVariableNames(LocalVariableAnalyzer.java:1733)
	at jd.core.process.analyzer.classfile.LocalVariableAnalyzer.Analyze(LocalVariableAnalyzer.java:206)
	at jd.core.process.analyzer.classfile.ClassFileAnalyzer.PreAnalyzeMethods(ClassFileAnalyzer.java:698)
	at jd.core.process.analyzer.classfile.ClassFileAnalyzer.AnalyzeClass(ClassFileAnalyzer.java:126)
	at jd.core.process.analyzer.classfile.ClassFileAnalyzer.Analyze(ClassFileAnalyzer.java:84)
	at jd.commonide.IdeDecompiler.decompile(IdeDecompiler.java:49)
	at jd.core.JavaDecompiler.decompile(JavaDecompiler.java:121)
	at jd.core.JavaDecompiler.decompileClass(JavaDecompiler.java:58)
	at jd.core.input.ZipFileInput.decompile(ZipFileInput.java:87)
	at jd.cli.Main.main(Main.java:118)
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
Undefined type catch
Undefined type catch
Undefined type catch
Undefined type catch
Undefined type catch
Undefined type catch
Undefined type catch
Undefined type catch
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
ConstantPool.addConstantClass: invalid name index
21:06:19.486 INFO  jd.core.output.DirOutput - Finished with 2593 class file(s) and 0 resource file(s) written.
[handler.decompilable/13668][DEBUG     ] [decompilable._fetch        ] remove .jar - we do not need it anymore
[handler.base/13668][DEBUG     ] [base.get_path      ] scheme: c
[handler.base/13668][DEBUG     ] [base.get_path      ] <Apk encoding=None path=WindowsPath('tmpfolder/unboxsmansz')>
[handler.local/13668][DEBUG     ] [local.walk          ] walk: tmpfolder\unboxsmansz
21:06:19.486 INFO  jd.core.output.DirOutput - Finished with 2593 class file(s) and 0 resource file(s) written.
[handler.decompilable/13668][DEBUG     ] [decompilable._fetch        ] remove .jar - we do not need it anymore
[handler.base/13668][DEBUG     ] [base.get_path      ] scheme: c
[handler.base/13668][DEBUG     ] [base.get_path      ] <Apk encoding=None path=WindowsPath('tmpfolder/unboxsmansz')>
[handler.local/13668][DEBUG     ] [local.walk          ] walk: tmpfolder\unboxsmansz

[handler.base/13668][DEBUG     ] [base.get_path      ] unknown: tmpfolder\unboxsmansz\.apk\AndroidManifest.xml
tmpfolder\unboxsmansz\.apk\AndroidManifest.xml
[handler.base/13668][DEBUG     ] [base.get_path      ] {'source': 'databuffer', 'magic': None}
[handler.base/13668][DEBUG     ] [base.get_path      ] scheme: c
[handler.base/13668][DEBUG     ] [base.get_path      ] <LocalPath encoding=None path=WindowsPath('tmpfolder/unboxsmansz/.apk/AndroidManifest.xml')>
[handler.base/13668][DEBUG     ] [base.get_path      ] unknown: tmpfolder\unboxsmansz\.apk\classes.dex
[handler.base/13668][DEBUG     ] [base.get_path      ] {'source': 'databuffer', 'magic': None}
tmpfolder\unboxsmansz\.apk\classes.dex
[handler.base/13668][DEBUG     ] [base.get_path      ] scheme: c
[handler.base/13668][DEBUG     ] [base.get_path      ] <LocalPath encoding=None path=WindowsPath('tmpfolder/unboxsmansz/.apk/classes.dex')>
[handler.base/13668][DEBUG     ] [base.get_path      ] unknown: tmpfolder\unboxsmansz\.apk\resources.arsc
[handler.base/13668][DEBUG     ] [base.get_path      ] {'source': 'databuffer', 'magic': None}
tmpfolder\unboxsmansz\.apk\resources.arsc
[handler.base/13668][DEBUG     ] [base.get_path      ] scheme: c
[handler.base/13668][DEBUG     ] [base.get_path      ] <LocalPath encoding=None path=WindowsPath('tmpfolder/unboxsmansz/.apk/resources.arsc')>
[handler.base/13668][DEBUG     ] [base.get_path      ] unknown: tmpfolder\unboxsmansz\.apk\assets\fonts\eurostilebold.ttf
[handler.base/13668][DEBUG     ] [base.get_path      ] {'source': 'databuffer', 'magic': {'mimetype': 'application/x-font-ttf', 'patterns': [{'regex': '\\x00\\x01\\x00\\x00\\x00', 'offset': 0, 'size': 5}], 'shortname': 'TTF', 'id': 32, 'longname': 'TrueType Font'}}
[handler.base/13668][DEBUG     ] [base.get_path      ] None
[handler.commands.commands/13668][DEBUG     ] [commands.decompile     ] [u'ida\\idaw.exe', '-B', '-M', '-S"home\\.unbox\\ida_batch_decompile.py -o\\"tmpfolder\\unboxeqk0no\\eurostilebold.c\\""', '"tmpfolder\\unboxsmansz\\.apk\\assets\\fonts\\eurostilebold.ttf"']
[handler.base/13668][DEBUG     ] [base.get_path      ] scheme: c
[handler.base/13668][DEBUG     ] [base.get_path      ] <Application32Bits encoding=None path=WindowsPath('tmpfolder/unboxeqk0no')>
[handler.local/13668][DEBUG     ] [local.walk          ] walk: tmpfolder\unboxeqk0no
...

...
tmpfolder\unboxsmansz\.source\org\stockchart\e\h$a.java
tmpfolder\unboxsmansz\.source\org\stockchart\e\h.java
[handler.base/13668][DEBUG     ] [base.get_path      ] {'source': 'databuffer', 'magic': None}
[handler.base/13668][DEBUG     ] [base.get_path      ] scheme: c
[handler.base/13668][DEBUG     ] [base.get_path      ] <LocalPath encoding=None path=WindowsPath('tmpfolder/unboxsmansz/.source/org/stockchart/e/h.java')>
[handler.base/13668][DEBUG     ] [base.get_path      ] unknown: tmpfolder\unboxsmansz\.source\org\stockchart\e\i.java
[handler.base/13668][DEBUG     ] [base.get_path      ] {'source': 'databuffer', 'magic': None}
[handler.base/13668][DEBUG     ] [base.get_path      ] scheme: c
[handler.base/13668][DEBUG     ] [base.get_path      ] <LocalPath encoding=None path=WindowsPath('tmpfolder//unboxsmansz/.source/org/stockchart/e/i.java')>
tmpfolder\unboxsmansz\.source\org\stockchart\e\i.java

Contribute 🏆

Add new tools and file formats

TBD

  • add external command wrapper to handler.commands.commands
  • add the file handler to handler.<archive,decompilable,local,remote>
  • route the file to the correct handler in handler.base.UniversalPath.get_path

Supported Formats and implemented 3rd Party Applications:

Status Type Tool Dependency ref
✔️ archive patool or 7z -
✔️ browser extension patool or 7z -
✔️ .net application JustDecompile (windows) https://github.com/telerik/JustDecompileEngine
✔️ apk dex2jar and jd-cli https://github.com/pxb1988/dex2jar
✔️ compiled java jd-cli https://github.com/kwart/jd-cmd
✔️ binary applications IDA PRO / RetDec https://www.hex-rays.com/products/ida/ https://github.com/avast-tl/retdec
Ethereum solidity smart contract porosity https://github.com/comaeio/porosity/
compiled python python-uncompyle6 https://github.com/rocky/python-uncompyle6/

Are you missing your favorite decompiler? Let me know or create a PR

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].