26

Does anybody have a suggestion for (non commercial) software to decompile "byte-code" Python (.pyc) files?

Everything I've found seems to break...

Improve this question
5

7 Answers 7

Reset to default
25

What Python version you're decompiling? Py3k is not well supported, but there are quite a few decompilers for 2.x. One of the latest projects is this:

https://github.com/Mysterie/uncompyle2

It runs on Python 2.7 but supports decompiling 2.5 to 2.7.

Note that some commercial projects has been known to use modified Python interpreters. Modifications can include:

  • bytecode files encryption
  • changed opcode values or additional opcodes
  • a heavily customized runtime (e.g. Stackless Python)

If you need to handle this, one approach is to convert non-standard bytecode to standard one and then use the usual decompilers (this apparently was used by the people from above project to decompile Dropbox code). Another is to change the decompiler to directly support the variations.

Improve this answer
1
13

You might find pyREtic from Immunity to be useful. The presentation from BlackHat USA 2010 on pyREtic is here (YouTube).

pyREtic

Reverse Engineer Obfuscated Python Bytecode This toolkit allows you to take a object in memory back to source code, without needing access to the bytecode directly on disk. This can be useful if the applictions pyc's on disk are obfuscated in one of many ways.

Improve this answer
5

I, of course, use uncompyle6. Disclaimer: I work on this project.

I've written at length about the uncompyle6 and pycdc here.

Improve this answer
1
  • 1
    I did use this for a CTF, I am impressed by the quality of the code generated (for a simple pyc in my case).
    – Olivier Lasne
    Nov 23, 2022 at 10:24
2

For initial and rough Python bytecode disassembly, I would be using the Python standard library dis module: https://docs.python.org/2/library/dis.html

Improve this answer
1

Here is what you're looking for, I just came across a fully working Python decompiler named "Easy Python Decompiler".

Improve this answer
0

There is also an open-source Python (.pyc) decompiler, called Decompyle++

Decompyle++ aims to translate compiled Python byte-code back into valid and human-readable Python source code. While other projects have achieved this with varied success, Decompyle++ is unique in that it seeks to support byte-code from any version of Python.

Improve this answer
0

I recommend uncompyle6. it can decompile pyc/pyo files and it is compatible with python 3

  1. pip install uncompyle6

  2. uncompyle6 FILE.pyc

Improve this answer
1
  • Could not find a version that satisfies the requirement decompyle3.
    – bikalpa
    Feb 10, 2021 at 5:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.