I've got some SSIS packages stored as varbinary, and I can load them into a temp table like so:

    Use SSISDB

    if object_id('tempdb..#package') is not null begin drop table #package end

    create table #package ( package varbinary(max))

    insert into #package (package) EXEC SSISDB.catalog.get_project 'my_folder','my_project'

    select * from #package

this returns a very long varbinary string which starts with 0x

Problem: when I try and convert the varbinary to nvarchar, it is still the same 0x... varbinary. I think it is encrypted.

Question: How can I decrypt these varbinary strings and convert them to a searchable format?

I think I need a key, but I'm not sure where those are stored.

  • 1
    get_project is going to return the .ispac (aka zip) representation of the package so you'll first get to unzip the binary and then you can examine the contents which will be a manifest file, a possibly empty file for project parameters, optionally project level connection managers and then all the packages the project contains.
    – billinkc
    Dec 4, 2019 at 21:14
  • @billinkc woah I came across your powershell script. A challenge for tomorrow's James, I think.
    – James
    Dec 4, 2019 at 21:42

1 Answer 1



So the package is not encrypted. As Billinkc said, it is zipped as a .ispac file.

These .ispac files first have to be exported from the database, then extracted into their components, which can be one or more .dtsx packages.

Microsoft provide a powershell script that will export every .ispac from your database:


    Import folders and projects from local file system to SSIS catalog.  
    Import SSIS projects from $ProjectFilePath. The folders under $ProjectFilePath 
    will be imported as folders in the SSIS catalog, with all ispac files under that 
    folder imported accordingly.  

    The script will connect to the local SQL Server instance. It will first 
    drop the SSISDB catalog if exists and create a new catalog with a fixed secret.  

# Variables 
$ProjectFilePath = "C:\SSIS" 

# Load the IntegrationServices Assembly 
[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SqlServer.Management.IntegrationServices") | Out-Null; 

# Store the IntegrationServices Assembly namespace to avoid typing it every time 
$ISNamespace = "Microsoft.SqlServer.Management.IntegrationServices" 

Write-Host "Connecting to server ..." 

# Create a connection to the server 
$sqlConnectionString = "Data Source=localhost;Initial Catalog=master;Integrated Security=SSPI;" 
$sqlConnection = New-Object System.Data.SqlClient.SqlConnection $sqlConnectionString 

# Create the Integration Services object 
$integrationServices = New-Object $ISNamespace".IntegrationServices" $sqlConnection 

Write-Host "Removing previous catalog ..." 

# Drop the existing catalog if it exists 
if ($integrationServices.Catalogs.Count -gt 0) { $integrationServices.Catalogs["SSISDB"].Drop() } 

Write-Host "Creating new SSISDB Catalog ..." 

# Provision a new SSIS Catalog 
$catalog = New-Object $ISNamespace".Catalog" ($integrationServices, "SSISDB", "SUPER#secret1") 

write-host "Enumerating all folders..." 

$folders = ls -Path $ProjectFilePath -Directory 

if ($folders.Count -gt 0) 
    foreach ($filefolder in $folders) 
        Write-Host "Creating Folder " $filefolder.Name " ..." 

        # Create a new folder 
        $folder = New-Object $ISNamespace".CatalogFolder" ($catalog, $filefolder.Name, "Folder description") 

        $projects = ls -Path $filefolder.FullName -File -Filter *.ispac 
        if ($projects.Count -gt 0) 
            foreach($projectfile in $projects) 
                $projectfilename = $projectfile.Name.Replace(".ispac", "") 
                Write-Host "Deploying " $projectfilename " project ..." 

                # Read the project file, and deploy it to the folder 
                [byte[]] $projectFileContent = [System.IO.File]::ReadAllBytes($projectfile.FullName) 
                $folder.DeployProject($projectfilename, $projectFileContent) 

Write-Host "All done."

Fill out the connection string, and all your packages will get saved to C:\SSIS

From here, the packages need to be extracted, which I did using python:

import os
import zipfile
import pandas as pd
from sqlalchemy import create_engine
import urllib

conn_str = (
r'Driver=ODBC Driver 13 for SQL Server;'

quoted_conn_str = urllib.parse.quote_plus(conn_str)
engine = create_engine('mssql+pyodbc:///?odbc_connect={}'.format(quoted_conn_str))
cnxn  = engine = create_engine('mssql+pyodbc:///?`odbc_connect{}'.format(quoted_conn_str)).execution_options(autocommit=True)`

directory = 'C:\\SSIS\\'
directory_to_extract_to = 'D:\\Defeintely_not_local\\SSIS_Packages\\'

for subdir, dirs, files in os.walk(directory):
    for filename in files:
        if filename.endswith(".ispac"):
            #print (subdir)
            folder = subdir.split('\\')[2]

            target_directory = directory_to_extract_to + folder 

+ '\\'

            with zipfile.ZipFile(subdir + '\\' + filename, 'r') 

as zip_ref:

for subdir, dirs, files in os.walk(directory_to_extract_to):
    for file in files:

        if file.endswith('.dtsx'):

            folder = subdir.split('\\')[5]

            sql = """insert into pkg_xml_data (subdir, 

package_name, bulkcolumn, loaddate) 
            SELECT '{}','{}', CONVERT(XML, BulkColumn) AS 

BulkColumn, GETDATE() 

x;""".format(folder,file, subdir, file)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.