Disrobe

Disrobe is a static decompiler, deobfuscator, and unpacker. It strips packing and obfuscation from compiled software one layer at a time and recovers the source code or the original bytes underneath.

Give disrobe auto an executable, an app package, a script, or a firmware image. It names each layer (installer, archive, packer, freezer, protector, obfuscator, bytecode), removes it with the matching recovery pass, and runs again on what that pass produced until no pass recognizes what is left. One Rust binary covers Python, JavaScript and WebAssembly, Java and Android, .NET, native PE, ELF, and Mach-O code, Go, Lua, PHP, Ruby, Erlang and Elixir, ActionScript, shell scripts and Office macros, React Native and Flutter apps, installers, and firmware. disrobe catalog lists the 169 packers, protectors, obfuscators, and bytecode families it recognizes across 15 ecosystems.

The engines are built in. Python bytecode decompiles without a Python installation, JavaScript recovery needs no Node.js, and the Java, Android, and .NET decompilers need no JVM or .NET SDK; jvm decompile and dotnet decompile run an installed external decompiler only when --backend names it. Disrobe does not launch the program it analyzes unless you pass --allow-dynamic, which applies only to PyArmor v6 and v7. The safety model lists the bounded interpreters that evaluate code taken from an input and the host tools Disrobe starts.

It is built for malware analysts, reverse engineers, incident responders, CTF players, and security researchers.

License: Disrobe Source-Available License 1.1. Personal hobby projects and learning, unpaid independent security research, nonprofit education and research, and journalism are free, as the license defines them. Any use by or for a company requires a paid license.

Quick start · What it recovers · Measured results · How it works · Safety model · Documentation

Quick start

Download the archive for your platform from GitHub Releases, check it against SHA256SUMS, and put disrobe (disrobe.exe on Windows) on your PATH. Then run:

disrobe identify suspect.exe                # compiler, packer, and protector, with evidence
disrobe auto suspect.exe --out recovered/   # remove the layers Disrobe can recover
disrobe context --out recovered/            # what each pass recovered, and at what confidence

Recorded output of identify and the unpacking step, run on a UPX-packed Rust program committed to this repository (corpus/native/packers/upx/hello.packed.nrv2b.exe):

$ disrobe identify hello.packed.exe
format: pe64 (64-bit) subsystem=windows-cui
packer     UPX  (96%)  -> disrobe native unpack
             - [section UPX0] UPX characteristic section
             - [section UPX1] UPX characteristic section
             - [section UPX2] UPX characteristic section
             - [byte scan] UPX packer magic
...

$ disrobe native unpack hello.packed.exe --out recovered/hello.bin
native unpack: OK
  input:        hello.packed.exe
  packer:       upx
  status:       Implemented
  packed_size:  53248
  recovered:    116810 bytes
  wrote:        recovered/hello.bin

The unpacking benchmark recovers the same file and compares it with the original build: the .text section is byte-identical, 73,160 bytes with no differences (unpacking measurements).

Release archives cover Windows (x86-64, ARM64), macOS (x86-64, ARM64), and Linux (x86-64 and ARM64 with glibc, static x86-64 with musl). Each archive has a separate cosign signature bundle, and SECURITY.md explains the check. Building from source needs the Rust toolchain pinned in rust-toolchain.toml (1.96.1; the minimum supported version is 1.95) and a C toolchain for native dependencies:

git clone https://github.com/1-3-7/disrobe
cd disrobe
cargo build --locked --release -p disrobe-cli --bin disrobe

The installation guide covers feature flags and the optional external backends. Run disrobe doctor to probe 46 to 51 external tools depending on the platform and see which optional backends are installed.

What it recovers

Each row names the formats Disrobe reads and the protection it removes. Where disrobe catalog lists a family, the level shown is the catalog's. Families named first are recovered. Partial families are peeled as far as the input allows, and the result names what is left. Detect only families are identified, and the result states why the rest cannot be recovered, usually because a key exists only at run time. A name in bold is graded on output of the real tool, committed to this repository; the other names are graded on samples written for the tests, or are only detected. Each ecosystem links to its guide. The Evidence column labels each row: real links a result or test that grades output of the real compiler or tool, synthetic names what is graded only on inputs built for the tests, and claimed names what no test exercises.