How to to decompile a pyinstaller exe, back to source code?

Question

Python versions, this method has been tried on: 3.7.5, 3.6.0, 3.5.0, 2.7.17? (I know, I'm just too desperate to get my source back.)

I have problem with decompiling an exe. I kind of deleted the wrong folder and now I'm left with the .exe, made by pyinstaller and nothing else. So basically I googled how to decompile pyinstaller exes and I found that first I use this: https://github.com/countercept/python-exe-unpacker/blob/master/pyinstxtractor.py to dissasemble to .pyc files and then uncompyle6 to get the source. The problem is that pyinstxtractor doesn't return the source code in .pyc format so I basically had to convert it myself and then add the "magic numbers" to it so that uncompyle6 sees it as .pyc. If you are wondering how I got the magic numbers, well I just used a hex editor to see the magic numbers of another .pyc, that pyinstxtractor spat out and then I just pasted them in the main file. So after that, I write

uncompyle63 name_of_pyc.pyc

and I get this error:

Traceback (most recent call last):
  File "c:\python\lib\site-packages\xdis\load.py", line 208, in load_module_from_file_object
    co = marshal.loads(bytecode)
ValueError: bad marshal data (unknown type code)
Traceback (most recent call last):
  File "c:\python\lib\site-packages\xdis\load.py", line 208, in load_module_from_file_object
    co = marshal.loads(bytecode)
ValueError: bad marshal data (unknown type code)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "c:\python\lib\runpy.py", line 193, in _run_module_as_main
    "__main__", mod_spec)
  File "c:\python\lib\runpy.py", line 85, in _run_code
    exec(code, run_globals)
  File "C:\Python\Scripts\uncompyle6.exe\__main__.py", line 9, in <module>
  File "c:\python\lib\site-packages\uncompyle6\bin\uncompile.py", line 194, in main_bin
    **options)
  File "c:\python\lib\site-packages\uncompyle6\main.py", line 261, in main
    source_encoding, linemap_stream, do_fragments)
  File "c:\python\lib\site-packages\uncompyle6\main.py", line 161, in decompile_file
    source_size) = load_module(filename, code_objects)
  File "c:\python\lib\site-packages\xdis\load.py", line 116, in load_module
    get_code=get_code,
  File "c:\python\lib\site-packages\xdis\load.py", line 222, in load_module_from_file_object
    "Ill-formed bytecode file %s\n%s; %s" % (filename, kind, msg)
ImportError: Ill-formed bytecode file Bot.pyc
<class 'ValueError'>; bad marshal data (unknown type code)

What are some other ways to decompile pyinstaller executables (If this one is useless)?

Answer 1

As you said, .pyc files begin with a magic (per python version)+timestamp. The tools sometimes fail reading these files despite them being correctly structured. Anyhow, this metadata is not required for decompiling.

If you can get to the beginning of the marshal'd code, usually at offset 8 from the beginning of the .pyc file, you can use python's built-in dis and marshal libraries:

import dis
import marshal
f = open("file.pyc","rb")
f.seek(8) #assuming there are magic numbers at the beginning
code = marshal.load(f)
dis.dis(code)

Inconveniently, it prints the code to stdout instead of returning it as text to the caller.

Make sure you run the code from the python version that the .pyc is originally compiled for.