unbox-anything

Universal unpacker for "box-like" files — the ones that look like a single file but are secretly a container of many files (an .exe installer, an .docx document, an .apk app, an .asar Electron bundle). Give it any such file and it cracks the box open into a clean directory, then writes a manifest describing what it found.

Designed for agent-driven analysis (crash investigation, reverse engineering, content extraction, build inspection), not for human-facing GUI workflows. Output is deterministic and structured so downstream steps can read it.

Iron Rules (read first, every time)

These exist because unpacking unknown files can be dangerous. An .exe you unpack today might be malware; a .dmg auto-mounted into Finder can trigger preview handlers. The rules below keep the agent — and the user's machine — safe.

1. Extract only. Never execute. Never run, source, open, or double-click anything inside the extracted directory. Binaries (.exe, .dll, .so, .dylib, .app, scripts) are extracted as bytes for inspection, never launched. If a downstream task needs to run them, that is a separate human-approved step.
2. Mount disk images read-only and quietly. For .dmg/.iso on macOS, always pass -nobrowse -readonly to hdiutil so Finder does not auto-open and trigger preview handlers. Unmount immediately after copying files out.
3. Detect encryption before extracting. Run 7z l -slt <file> first; if the output shows Encrypted = +, stop and report — do not let 7z hang waiting on a password prompt. Ask the user for the password explicitly or skip.
4. Always extract into a fresh directory. Output to <outname>-unboxed/ (suffix, never overwrite). Never extract into . or an existing populated dir — 7z/unar will silently clobber.
5. One source of truth per run. Do not pipeline two different tools on the same source simultaneously; finish one extraction, verify, then recurse.

Prerequisites

Primary tool: 7z covers ~80% of formats (zip, 7z, tar, gz, bz2, xz, zst, cab, iso, rpm, deb, nsis, msi, ar, cpio, chm, and more). Install it once and most formats just work.