Get started · Supported inputs · Automatic recovery · Tool comparisons · Evidence · Documentation

See the software underneath

Disrobe is a Rust command-line suite for decompiling, deobfuscating, and unpacking software. Use it to triage an unknown file, recover code for reverse engineering, extract indicators for an investigation, or prepare artifacts for a disassembler.

Recover Python from bytecode and frozen applications, Java from classfiles and DEX, C# from CIL, JavaScript from bundles, Lua from custom virtual machines, and C or Rust from native code. Extract files from installers, firmware, mobile packages, and Electron, Tauri, or Wails applications. Keep recovered source, symbols, strings, types, and provenance together for further analysis.

The full build catalogs 170 families across 15 ecosystems and detects 103 container formats. disrobe auto identifies each layer, runs a matching pass, and follows recovered children into their own recovery paths. Dedicated commands expose finer controls, analysis reports, and optional backends. Recovery runs statically by default; source, structure, partial output, and missing-key boundaries remain distinguishable in the result.

If Disrobe is useful to you, consider starring the repository.

See it in action

Watch the full video · Read the transcript

Twenty CLI commands in 2 minutes 12 seconds: unpack a native executable, recover Python and Lua, split JavaScript modules, restore source maps, inspect WebAssembly and Android resources, extract indicators, and preserve reports and artifact hashes. The final chapter shows project configuration, IDE setup, analyst annotations, and shell completions. The transcript includes the recorded build's complete command inventory; the capability map explains its support limits.

Get started

Download the archive for your platform from GitHub Releases, check it against the release's SHA256SUMS, and put disrobe on your PATH. Release archives include signature bundles; the verification guide explains how to inspect them.

Check the binary you installed:

disrobe --version
disrobe --help

To build the CLI from a clone, install the repository's Rust toolchain and the native build prerequisites, then run:

cargo build --locked --release -p disrobe-cli --bin disrobe

The executable is target/release/disrobe, or target/release/disrobe.exe on Windows. See the installation guide for feature flags and slim builds.

Recover an application

Start with an application, library, or package. Identify it, recover its recognized layers, then inspect the recovery summary:

disrobe identify path/to/application
disrobe auto path/to/application --out recovered/ --capture-stages
disrobe context --out recovered/

identify reports the format and available signals. auto extracts and recovers the recognized layers. context summarizes the resulting passes, confidence, and provenance. With --capture-stages, inspect each stage under recovered/01-*/, recovered/02-*/, and recovered/final/; chain.json records the topology and hashes, and recovery.json records outcomes and timings.

Use a dedicated command when you know the output you need:

disrobe py decompile module.pyc --out python-source/
disrobe js deob bundle.js --full --out readable.js
disrobe native decompile application.exe --out native-source/
disrobe native export packed.exe --format ghidra --out ghidra-input/
disrobe webview desktop.exe --out frontend/

The native decompiler emits C by default on x86-64; --format rust selects Rust. AArch64, ARM32, and MIPS32 emit pseudo-C. native export rebuilds supported packed PE images for an external analysis tool; webview writes the recovered frontend asset tree without starting the application.

Try a small, inspectable artifact

The repository includes a tiny WebAssembly module for the browser playground. From a clone, with the full CLI on your PATH:

disrobe wasm decompile playground/public/samples/add.wasm --target json --out add.summary.json
disrobe wasm decompile playground/public/samples/add.wasm --target wat --out add.lifted.wat
disrobe auto playground/public/samples/add.wasm --out recovered/ --capture-stages

The first command writes add.summary.json; the second writes WebAssembly text to add.lifted.wat. Automatic recovery selects an available chain and writes its artifacts under recovered/; --capture-stages retains intermediate results. These operations inspect the module without running its exported function.

Inspect the recovered files alongside the report: identification alone does not establish recovery. Unsupported constructs, absent key material, and unavailable chains appear in the result. The result guide explains artifacts, diagnostics, partial outcomes, and provenance.

Open the browser playground · Follow the quickstart

Find your input

Recover means a reachable path emits source, bytes, or structure. Partial means it recovers only part of that information. Detect-only means it identifies the family without recovering its protected body. These levels describe operations on supported inputs; a family name alone is not a guarantee that every version or configuration recovers. The lists below include the full family catalog and additional formats exposed by dedicated commands and extractors.

Automatic recovery

auto chooses a pass from the compiled registry, runs it, then re-identifies its output and extracted children. It stops at the confidence threshold, a repeated content hash, or the depth limit (eight by default). Reports and source files tagged as terminal remain outputs rather than being fed back into detection. The following table accounts for every pass registered by a full build; a slim build can omit feature-gated rows.

For example, a recognized PyInstaller application can progress through pyinstaller.extract → pyarmor.unpack → py.decompile; an APK through member extraction → DEX → Java; and a packed native image through unpacking → language or image analysis. Each arrow depends on what that particular layer actually yields.

disrobe passes
disrobe catalog python --json
disrobe auto input-directory/ --out recovered/ --batch-max-depth 6 --capture-stages
disrobe chain module.pyc --chain py.decompile --out python-source/

scan, frisk, taint, vulnmatch, explicit source-target selection, mapping replay, and optional external-backend invocation remain dedicated operations. Pass registry · Chain selection and output layout.

Analyze and export the result

The capability map covers command groups and integrations. Its machine-readable inventory links source, tests, documentation, support status, and demos. The CLI reference covers nested commands; global flags cover shared options. Use disrobe <command> --help for the interface of your installed build.

Project and service commands are also indexed there: serve, plugin, init, config, catalog, passes, doctor, install, install-deps, self-update, completions, man, explain, and bug-report. Use doctor to probe 46 to 51 external tools depending on the platform and identify missing optional backends.

Use the same recovery in your workflow

Compare tools

The table maps each recovery task to Disrobe’s commands and related tools. Installed decompilers and exported artifacts provide the integration points shown below.

The comparison inventory names the outstanding shared-input comparisons. Backend options are documented in installation and the linked language guides above.

Measured tool comparisons

Measurements use the pinned inputs, tool versions, and scoring rules linked below. DEX and JAR counts measure compilation of each tool’s emitted regions. Those populations differ, so their counts do not rank recovery quality. APK secret recall uses the same eight-token ground truth.

Inputs, raw tool results, and reproduction commands.

Give Ghidra the recovered executable

The same Ghidra 12.1.2 analysis sees different code after Disrobe exports a packed executable as a rebuilt PE. These local snapshots use real benign packed fixtures and record both increases and decreases. The function/instruction/string columns come from the nine-input analysis snapshot; completed C renderings come from the separate six-input decompiler snapshot. A completed rendering is nonempty output, not a source-correctness grade.

The kkrunchy counts decrease. More discovered functions are not necessarily more correct functions, and these analysis counts do not replace a byte comparison. Read the analysis snapshot, decompiler snapshot, and separate native byte-recovery measurements.

Inspect the evidence

The evidence index links recovery measurements to their fixtures, comparison methods, commands, and results.

Results distinguish byte recovery, compiler acceptance, and behavioral checks. Compiler acceptance and coverage counts are not equivalence scores.

Recovery checked against independent references

These checks measure Disrobe against an original artifact, compiler, interpreter, or labeled corpus. They are distinct from comparing two decompilers. Each linked result records the input population, prerequisites, and reproduction command.

Chart labels use strong for an independent correctness reference, recompile-only for compiler acceptance, and coverage-self-reported for Disrobe's own coverage counters. The comparison method and population define each result's scope.

Browse the results, tool comparisons, and reproduction prerequisites for individual measurements.

Know the limits

• Compiled output loses information. Original comments, formatting, names, and some type information may be absent.
• Family recognition is broader than recovery. A catalog match or successful parser can coexist with partial source emission. Read the family tier and the actual result.
• Native recovery depends on architecture and output language. The native guide lists supported paths and their tests.
• Commercial VM-protector detection is not a general source-recovery promise. Internal helpers and protected-section artifacts do not establish a complete CLI recovery path. See native unpacking.
• Missing keys remain missing. Runtime-derived keys and absent name-hashing seeds cannot be inferred from an unsupported artifact. Python, PHP, and container guides state format-specific boundaries.
• External backends have their own requirements. Some commands can select installed tools through --backend auto. Check the command's help and installation guide before choosing a backend.
• Analysis defaults to static recovery. This does not make untrusted input harmless. Resource limits, explicitly selected dynamic operations, and external-process boundaries are described in forensics safety.

Understand the pipeline

The chain runner connects single-purpose passes through shared artifacts and intermediate representations. A pass contributes the output it can justify; downstream consumers retain provenance and report unsupported boundaries. Explore the architecture, pass model, IR ladder, and chain runner.

Documentation and contribution

Start with the documentation, quickstart, and result guide. Use disrobe explain <code> to look up a diagnostic. For changes to the project, read the contributing guide and the relevant feature's tests and evidence.

The threat model describes trust boundaries and input handling. Report security concerns through SECURITY.md. LEGAL.md describes the project's legal considerations; permission to analyze an artifact depends on your circumstances.

License

Every version of Disrobe is proprietary and source-available under the Disrobe Source-Available License, Version 1.1, which supersedes the Elastic License 2.0 and Version 1.0 for all versions and revokes all earlier grants as stated in the relicensing notice.

Personal hobby projects, personal learning, and unpaid independent security research by individuals, nonprofit education and research, and bona fide journalism are free, as defined in the license.

Any use by or for a company requires a paid license. See commercial licensing.

Required credit: This work used Disrobe, created by 1-3-7: https://github.com/1-3-7/disrobe

Forks other than contribution forks, reposting, rebranding, resale, hosting, and competing development are prohibited. The software is provided as is, at the user's own risk.

See attribution, contributor terms, summary, and third-party notices.

Copyright (c) 2025-2026 1-3-7. All rights reserved.

_{Earlier development commits were consolidated into a single baseline as part of the documentation and visual refresh.}