BitRock unpacker prototype
bitrock_unpacker is a module for extracting content of BitRock/InstallBuilder installers
without Tcl/TclKit.
I created that repo since I was not able to run original Tcl unpacker from here on Windows.
Run without installing:
uvx bitrock-unpacker --help
Run as a module:
python -m bitrock_unpacker --help
If installed, it also exposes:
bitrock-unpacker --help
Current capabilities
- Parses PE overlay boundaries.
- Locates BitRock/CookFS markers.
- Recovers
manifest.txtfrom the embedded zlib stream. - Parses old CookFS
CFS0002suffix/page tables. - Decompresses CookFS pages: raw, raw deflate, bzip2, and LZMA-Alone.
- Decodes the CookFS
CFS2.200fsindex. - Lists and extracts files by fsindex path.
- Stitches BitRock big-file chunks named
___bitrockBigFileNinto their base file by default.
Limitations
- Encrypted/proprietary
maui::utilpayloads are not supported. - Full installer post-processing is out of scope; extraction writes archive contents.
- Full extraction requires
--yes-allwhen no--limitis supplied.
Use --raw-chunks to show or extract hidden ___bitrockBigFileN chunk files instead of stitching them.
Quick checks
The pyproject.toml metadata exposes the bitrock-unpacker console script, so
the same CLI can be checked through uv run without installing it globally:
python -m bitrock_unpacker <installer.exe> --manifest-only --debug
python -m bitrock_unpacker <installer.exe> --list-pages --limit 5
python -m bitrock_unpacker <installer.exe> --list-files --limit 10
Extract one file:
python -m bitrock_unpacker <installer.exe> `
--path path/inside/archive.txt `
--extract $env:TEMP\files `
--limit 1
Inspect raw hidden chunks:
python -m bitrock_unpacker <installer.exe> `
--raw-chunks `
--list-files `
--path path/inside/archive.bin___bitrockBigFile1 `
--limit 5
Full stitched extraction can be large:
python -m bitrock_unpacker <installer.exe> --extract out --yes-all
Development
Validate the project metadata and run the self-test:
python -c "import tomllib; tomllib.load(open('pyproject.toml','rb')); print('pyproject: ok')"
python -m py_compile bitrock_unpacker\*.py
Release files for bitrock-unpacker 0.1.2
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| bitrock_unpacker-0.1.2.tar.gz | 11.5 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| bitrock_unpacker-0.1.2-py3-none-any.whl | Python 3 | none | any | Details |
Total release size:23.0 kB
Release files / bitrock_unpacker-0.1.2.tar.gz
| Download URL | bitrock_unpacker-0.1.2.tar.gz |
|---|---|
| Size | 11.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
eb9e2c7d49981c3afdf301331eb3191a7f42f6fcdbc2ffcf73aedb123b4b6f00
|
|
BLAKE2b-256 checksum How to use checksums |
fb7fa39626a0705d011be86bb87a4d57582e40aae40a69280aeda1b5bc79acbc
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 24, 2026.
Transparency logRelease files / bitrock_unpacker-0.1.2-py3-none-any.whl
| Download URL | bitrock_unpacker-0.1.2-py3-none-any.whl |
|---|---|
| Size | 11.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
61ad3e43e321fa111d6e71285f21967073e7f96c4a17c32a5bda7df1fe63b7bb
|
|
BLAKE2b-256 checksum How to use checksums |
62cd998430ea1ae47cc6a105e4c7cc9e9a7d71b92771624ccf9107df9017d8bf
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 24, 2026.
Transparency log