Disrobe

Disrobe is a static decompiler, deobfuscator, and unpacker. It strips packing and obfuscation from compiled software one layer at a time and recovers the source code or the original bytes underneath.

Give disrobe auto an executable, an app package, a script, or a firmware image. It names each layer (installer, archive, packer, freezer, protector, obfuscator, bytecode), removes it with the matching recovery pass, and runs again on what that pass produced until no pass recognizes what is left. One Rust binary covers Python, JavaScript and WebAssembly, Java and Android, .NET, native PE, ELF, and Mach-O code, Go, Lua, PHP, Ruby, Erlang and Elixir, ActionScript, shell scripts and Office macros, React Native and Flutter apps, installers, and firmware. disrobe catalog lists the 169 packers, protectors, obfuscators, and bytecode families it recognizes across 15 ecosystems.

The engines are built in. Python bytecode decompiles without a Python installation, JavaScript recovery needs no Node.js, and the Java, Android, and .NET decompilers need no JVM or .NET SDK; jvm decompile and dotnet decompile run an installed external decompiler only when --backend names it. Disrobe does not launch the program it analyzes unless you pass --allow-dynamic, which applies only to PyArmor v6 and v7. The safety model lists the bounded interpreters that evaluate code taken from an input and the host tools Disrobe starts.

It is built for malware analysts, reverse engineers, incident responders, CTF players, and security researchers.

License: Disrobe Source-Available License 1.1. Personal hobby projects and learning, unpaid independent security research, nonprofit education and research, and journalism are free, as the license defines them. Any use by or for a company requires a paid license.

Quick start · What it recovers · Measured results · How it works · Safety model · Documentation

Quick start

Download the archive for your platform from GitHub Releases, check it against SHA256SUMS, and put disrobe (disrobe.exe on Windows) on your PATH. Then run:

disrobe identify suspect.exe                # compiler, packer, and protector, with evidence
disrobe auto suspect.exe --out recovered/   # remove the layers Disrobe can recover
disrobe context --out recovered/            # what each pass recovered, and at what confidence

Recorded output of identify and the unpacking step, run on a UPX-packed Rust program committed to this repository (corpus/native/packers/upx/hello.packed.nrv2b.exe):

$ disrobe identify hello.packed.exe
format: pe64 (64-bit) subsystem=windows-cui
packer     UPX  (96%)  -> disrobe native unpack
             - [section UPX0] UPX characteristic section
             - [section UPX1] UPX characteristic section
             - [section UPX2] UPX characteristic section
             - [byte scan] UPX packer magic
...

$ disrobe native unpack hello.packed.exe --out recovered/hello.bin
native unpack: OK
  input:        hello.packed.exe
  packer:       upx
  status:       Implemented
  packed_size:  53248
  recovered:    116810 bytes
  wrote:        recovered/hello.bin