There are several solutions available to extract Pyc files from Windows binaries and then decompile them using uncompyle2 or uncompyle6.
However, I have a Linux ELF 64-bit binary which was compiled using one of the Packagers used for Python (might be CX Freeze or PyInstaller). I am not sure of the exact package name.
File command output:
bin: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, BuildID[sha1]=212a49c7fff7342713aec6af6789abbaf3a8014, stripped
I also have a .so file called: libpython2.7.so.1.0 which I believe is the python interpreter.
The binary also has a .pydata section inside it as shown below:
 pydata PROGBITS 0000000000000000 00007a48 00000000000a0c47 0000000000000000 0 0 1
The binary has strings inside it as shown below:
Py_SetPythonHome Cannot dlsym for Py_SetPythonHome Error loading Python lib '%s': dlopen: %s Error detected starting Python VM. libpython2.7.so.1.0
So, I'm quite sure that it is Python code compiled to a Linux binary.
Neither of these projects work for me.
unfrozen_binary - gives an error because in common.py it imports decompilers library which is not available.
pyThaw - it leverages radare2 however when I use it with my binary, it just hangs and does not extract the source code.
Are there any alternate solutions to decompile such elf binaries with python byte code for Linux?