Skip to main content

CI PyPI - Version PyPI - Python Version PyPI Downloads

BitRock unpacker prototype

bitrock_unpacker is a module for extracting content of BitRock/InstallBuilder installers without Tcl/TclKit.

I created that repo since I was not able to run original Tcl unpacker from here on Windows.

Run without installing:

uvx bitrock-unpacker --help

Run as a module:

python -m bitrock_unpacker --help

If installed, it also exposes:

bitrock-unpacker --help

Current capabilities

  • Parses PE overlay boundaries.
  • Locates BitRock/CookFS markers.
  • Recovers manifest.txt from the embedded zlib stream.
  • Parses old CookFS CFS0002 suffix/page tables.
  • Decompresses CookFS pages: raw, raw deflate, bzip2, and LZMA-Alone.
  • Decodes the CookFS CFS2.200 fsindex.
  • Lists and extracts files by fsindex path.
  • Stitches BitRock big-file chunks named ___bitrockBigFileN into their base file by default.

Limitations

  • Encrypted/proprietary maui::util payloads are not supported.
  • Full installer post-processing is out of scope; extraction writes archive contents.
  • Full extraction requires --yes-all when no --limit is supplied.

Use --raw-chunks to show or extract hidden ___bitrockBigFileN chunk files instead of stitching them.

Quick checks

The pyproject.toml metadata exposes the bitrock-unpacker console script, so the same CLI can be checked through uv run without installing it globally:

python -m bitrock_unpacker <installer.exe> --manifest-only --debug
python -m bitrock_unpacker <installer.exe> --list-pages --limit 5
python -m bitrock_unpacker <installer.exe> --list-files --limit 10

Extract one file:

python -m bitrock_unpacker <installer.exe> `
  --path path/inside/archive.txt `
  --extract $env:TEMP\files `
  --limit 1

Inspect raw hidden chunks:

python -m bitrock_unpacker <installer.exe> `
  --raw-chunks `
  --list-files `
  --path path/inside/archive.bin___bitrockBigFile1 `
  --limit 5

Full stitched extraction can be large:

python -m bitrock_unpacker <installer.exe> --extract out --yes-all

Development

Validate the project metadata and run the self-test:

python -c "import tomllib; tomllib.load(open('pyproject.toml','rb')); print('pyproject: ok')"
python -m py_compile bitrock_unpacker\*.py

Release files for bitrock-unpacker 0.1.2

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for bitrock-unpacker 0.1.2
File Size Uploaded
bitrock_unpacker-0.1.2.tar.gz 11.5 kB Details

Built distribution (wheel)

Table of built distributions (wheels) for bitrock-unpacker 0.1.2
File Interpreter ABI Platform
bitrock_unpacker-0.1.2-py3-none-any.whl Python 3 none any Details

Total release size:23.0 kB

Release files / bitrock_unpacker-0.1.2.tar.gz

Download URL bitrock_unpacker-0.1.2.tar.gz
Size 11.5 kB
Tags Source
SHA-256 checksum
How to use checksums
eb9e2c7d49981c3afdf301331eb3191a7f42f6fcdbc2ffcf73aedb123b4b6f00
BLAKE2b-256 checksum
How to use checksums
fb7fa39626a0705d011be86bb87a4d57582e40aae40a69280aeda1b5bc79acbc
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jul 24, 2026.

Transparency log

Release files / bitrock_unpacker-0.1.2-py3-none-any.whl

Download URL bitrock_unpacker-0.1.2-py3-none-any.whl
Size 11.6 kB
Tags Python 3
SHA-256 checksum
How to use checksums
61ad3e43e321fa111d6e71285f21967073e7f96c4a17c32a5bda7df1fe63b7bb
BLAKE2b-256 checksum
How to use checksums
62cd998430ea1ae47cc6a105e4c7cc9e9a7d71b92771624ccf9107df9017d8bf
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jul 24, 2026.

Transparency log

Release history Release notifications | RSS feed

This release

0.1.2 This release

2 release files

0.1.1

2 release files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page