Add unblob so REA can extract firmware

unblob 26.6.4 (the version REA is verified with) is installed from its
PyPI wheel into /opt/unblob, with dependencies pinned to its uv.lock at
the release commit. A wrapper puts that venv first on PATH, and
REA_UNBLOB_COMMAND points REA's extract_firmware at it.

Its extractors follow upstream's install-deps.sh: Ubuntu packages,
sasquatch v4.5.1-6 (also used by binwalk) and onekey-sec's e2fsprogs
fork, whose debugfs rdump options the ext2/3/4 handler needs. The build
checks that unblob finds every extractor.

The uv.lock converter moves to scripts/ and skips the locked project
itself generically, since ghidra-mcp and unblob both use it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
2026-11-02 18:20:01 +01:00
co-authored by Claude Opus 5.5
parent e61c004431
commit ab9bb3eae9
4 changed files with 80 additions and 26 deletions
+7 -6
View File
@@ -2,8 +2,8 @@
A Docker-based reverse-engineering workstation for Linux. Claude Desktop is
connected over MCP to Ghidra and to REA ("Reverse Engineer Anything"), and
binwalk and esptool are installed alongside them. Nothing beyond Docker and
an X server (or XWayland) is needed on the host.
binwalk, unblob and esptool are installed alongside them. Nothing beyond
Docker and an X server (or XWayland) is needed on the host.
## Usage
@@ -20,10 +20,10 @@ Desktop or Ghidra's project window stops everything.
## What runs where
| Container | Contents | Network |
| ---------------- | ------------------------------------------------------------ | -------------------------- |
| `claude-desktop` | Claude Desktop, Ghidra GUI + GhidraMCP, binwalk, esptool | default + internal |
| `claude-re-mcp` | REA MCP server (headless Ghidra, binwalk), no display | internal only, no internet |
| Container | Contents | Network |
| ---------------- | --------------------------------------------------------------- | -------------------------- |
| `claude-desktop` | Claude Desktop, Ghidra GUI + GhidraMCP, binwalk, unblob, esptool | default + internal |
| `claude-re-mcp` | REA MCP server (headless Ghidra, binwalk, unblob), no display | internal only, no internet |
Both containers run from the same image. REA gets its own container because
some of its tools run the target. Claude Desktop reaches it at
@@ -44,6 +44,7 @@ MCP servers in Claude Desktop (`claude-desktop/claude_desktop_config.json`):
- REA 6.8.0 (Reverse Engineer Anything): https://github.com/morluto/rea, npm `rea-agents`
- mcp-remote 0.15.1: https://github.com/punkpeye/mcp-remote (formerly geelen/mcp-remote)
- binwalk 3.1.1: https://github.com/ReFirmLabs/binwalk
- unblob 26.6.4: https://github.com/onekey-sec/unblob
- esptool 5.6.0: https://github.com/espressif/esptool
Versions and checksums are pinned in the `Dockerfile`. `CLAUDE.md` has the