Comments on: Unwrapping 10G wrapped PL/SQL Friends of Oracle and Java Sat, 01 Aug 2015 11:10:05 +0000 hourly 1 By: Anton Scheffer Tue, 08 Mar 2011 08:15:38 +0000 @Murali, you can deploy the wrapped source to a 10G database, without unwrapping it first.

By: Murali Tue, 08 Mar 2011 08:10:25 +0000 Hi:
We have a requirement to upgrade a custom application built on Oracle7 to 10g. There are some wrapped procedures which could not be migrated. Is there any toll available to unwarp the same and reqrap after migration to 10g?

By: KAIN66 Thu, 24 Feb 2011 00:25:23 +0000 Marcio Eduardo:

still need to unwrap packages for oracle 9i.
Enter the following link , click at least in our link advertising and will gladly help

By: Praveen Ray Mon, 31 Jan 2011 11:45:50 +0000 What about those LIBRARied extprocs… any idea how to decode them…

Praveen Ray

By: Marcio Brazil Fri, 22 Oct 2010 18:11:36 +0000 Hello, My name is Marcio and I from Brazil, I need to unwrap packages  9i , do you know about, any tool for 9i packages, please, if any people, help me,
Marcio Eduardo

By: Florian Brunner Wed, 30 Jun 2010 09:44:40 +0000 Nice work. Thank you.

By: Steve Mon, 12 Apr 2010 16:29:32 +0000 A 10g/11g unwrapping script was posted to the dbsec mailinglist recently:

By: Anton Scheffer Thu, 18 Mar 2010 08:28:11 +0000 @Renuka You’re right. 9i (and before) wrapping doesn’t use Base64 encoding.

By: renuka Wed, 17 Mar 2010 21:57:45 +0000 Hi,
I came across your blog and I am trying to unwrap a PL/SQL package in 9i, But it fails. If I am not mistaken, Base 64 encoding is in 10g not in 9i.  I tried unwrap utility online but it fails saying not a valid wrapped code.

By: Erik Kerkhoven Mon, 07 Dec 2009 10:28:12 +0000 Impressive work.
This web application of Manuel Bleichenbacher worked well for me:


By: Anton Scheffer Thu, 25 Jun 2009 11:41:51 +0000 @Szymon
No I did not checked my code on the Oracle build-in packages, because that is not allowed.
But your are right about the maximum RAW length. In my sql-queries the maximum allowed length of RAW and VARCHAR2 is 4000, which means that sql-queries can not be used for unwrapping “large” pieces of code. For those larger unwrapping tasks you have to use plsql, which has a limit of more than 32000, or java, which I use for my own unwrapper.
And for cutting of the first 40 chars, in that example the RAW value is converted to a VARCHAR2 value. And in that conversion every RAW becomes the 2 byte hexadecimal represatation of the value.
And for unwrapping 9i wrapped code you have to check the work of Pete Finnigan

By: Szymon Wed, 24 Jun 2009 11:50:31 +0000 Hi,

Did you checked that this works on various Oracle build-in packages?

I have database, and when trying to unwrap body of SYS.UTL_URL it works flawless.

But when I try do unwrap body of SYS.UTL_ENCODE I get an error “ORA-24305: bad bind or define context” from call of Java inflate procedure. So something in that package, broke the decompressor.

Another problem is maximum RAW length. For example trying to unwrap UTL_TCP fails with error:
“ORA-06502: PL/SQL: numeric or value error: raw variable length too long
ORA-06512: at “SYS.UTL_RAW”, line 224″
Because of this I have tried to rewrite whole unwrap procedure in Java using NetBeans, but no success yet – I think that Base64 decoding fails, so when I cut off first 20 bytes of decoded text, it is not equal to SHA1 of the rest, and inflate function says: “ unknown compression method”.
Also tell me why, in Your example You cut off first 40 chars from Base64 decoded text, not 20 (SHA1 signature is 20bytes = 160bits long)?

And last but not least, I have upgraded my database from in February, so I have many wrapped packages body (from used applications) which in 20 line has text “9200000” and data below IS NOT Base64 encoded. I think that it is before 10g wrapping which 10g can use, but i don’t know (yet) how to unwrap it…

Best regards

By: vonbean Thu, 14 May 2009 03:21:53 +0000 Nice tool! This tool works well with built-in package from Oracle and It would be even more execelllent if the trojan horse problem is fixed.

By: Anton Scheffer Mon, 20 Apr 2009 19:23:04 +0000 @Lorenzo

Lety me guess: you use a database. It looks that in that version does a uppercase on the package name before wrapping it.
My code doesn’t handle that correctly.
So you have two options.
Upgrade your database or change my code a bit:
change procedure fill2 to

procedure fill2( p_txt in varchar2 )
for i in 0 .. 10
fill( p_txt, ascii( ‘A’ ), ascii( ‘Z’ ), to_char( i, ‘fm999′ ) );
end loop;

And make some more calls to fill2
fill2( ‘PACKAGE ‘ );
fill2( ‘PACKAGE BODY ‘ );
fill2( ‘FUNCTION ‘ );


By: Lorenzo Mon, 20 Apr 2009 10:16:47 +0000 Hi, i created java objects and package, but tring to execute statement from “declare” i got this error.
Error at line 1
ORA-01403: no data found
ORA-06512: at line 40
ORA-06512: at line 51
ORA-06512: at line 63
what’s wrong?
many thanks for yout help.