1

Python versions, this method has been tried on: 3.7.5, 3.6.0, 3.5.0, 2.7.17? (I know, I'm just too desperate to get my source back.)

I have problem with decompiling an exe. I kind of deleted the wrong folder and now I'm left with the .exe, made by pyinstaller and nothing else. So basically I googled how to decompile pyinstaller exes and I found that first I use this: https://github.com/countercept/python-exe-unpacker/blob/master/pyinstxtractor.py to dissasemble to .pyc files and then uncompyle6 to get the source. The problem is that pyinstxtractor doesn't return the source code in .pyc format so I basically had to convert it myself and then add the "magic numbers" to it so that uncompyle6 sees it as .pyc. If you are wondering how I got the magic numbers, well I just used a hex editor to see the magic numbers of another .pyc, that pyinstxtractor spat out and then I just pasted them in the main file. So after that, I write

uncompyle63 name_of_pyc.pyc

and I get this error:

Traceback (most recent call last):
  File "c:\python\lib\site-packages\xdis\load.py", line 208, in load_module_from_file_object
    co = marshal.loads(bytecode)
ValueError: bad marshal data (unknown type code)
Traceback (most recent call last):
  File "c:\python\lib\site-packages\xdis\load.py", line 208, in load_module_from_file_object
    co = marshal.loads(bytecode)
ValueError: bad marshal data (unknown type code)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "c:\python\lib\runpy.py", line 193, in _run_module_as_main
    "__main__", mod_spec)
  File "c:\python\lib\runpy.py", line 85, in _run_code
    exec(code, run_globals)
  File "C:\Python\Scripts\uncompyle6.exe\__main__.py", line 9, in <module>
  File "c:\python\lib\site-packages\uncompyle6\bin\uncompile.py", line 194, in main_bin
    **options)
  File "c:\python\lib\site-packages\uncompyle6\main.py", line 261, in main
    source_encoding, linemap_stream, do_fragments)
  File "c:\python\lib\site-packages\uncompyle6\main.py", line 161, in decompile_file
    source_size) = load_module(filename, code_objects)
  File "c:\python\lib\site-packages\xdis\load.py", line 116, in load_module
    get_code=get_code,
  File "c:\python\lib\site-packages\xdis\load.py", line 222, in load_module_from_file_object
    "Ill-formed bytecode file %s\n%s; %s" % (filename, kind, msg)
ImportError: Ill-formed bytecode file Bot.pyc
<class 'ValueError'>; bad marshal data (unknown type code)

What are some other ways to decompile pyinstaller executables (If this one is useless)?

  • 3
    before attempting to go the hard way have you looked around and tried some of the recovery software like undelete etc basically file deletion just erases the file details not the file contents and many software exist which can recover the deleted files – blabb Dec 2 '19 at 21:25
  • I'd guess it's to late once you started tinkering ... at the point such a mistake is made and you want to use an undelete tool you basically need to "pull the plug". Each additional write diminishes your chances to recover some of the deleted data. – 0xC0000022L Dec 17 '19 at 23:05
1

As you said, .pyc files begin with a magic (per python version)+timestamp. The tools sometimes fail reading these files despite them being correctly structured. Anyhow, this metadata is not required for decompiling.

If you can get to the beginning of the marshal'd code, usually at offset 8 from the beginning of the .pyc file, you can use python's built-in dis and marshal libraries:

import dis
import marshal
f = open("file.pyc","rb")
f.seek(8) #assuming there are magic numbers at the beginning
code = marshal.load(f)
dis.dis(code)

Inconveniently, it prints the code to stdout instead of returning it as text to the caller.

Make sure you run the code from the python version that the .pyc is originally compiled for.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.