-2

I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with PyInstaller. I have tried multiple attempts at finding the source code, such as:

  • Using CheatEngine to read the memory
  • Using IDA to read assembler code
  • Using multiple PyInstaller unpackers to get source code

But all of them, to no avail. Is there any way I can get the source code of this file, and if so, how?

Here's the Stack Trace I got when I terminated the program with CTRL + C:

Traceback (most recent call last):
  File "<dist/obf\bot.py>", line 3, in <module>
  File "<frozen bot>", line 798, in <module>
  File "<frozen keyvalidation>", line 243, in checkStuff
  File "<frozen keyvalidation>", line 150, in checkKey
  File "site-packages\requests\api.py", line 116, in post
  File "site-packages\requests\api.py", line 60, in request
  File "site-packages\requests\sessions.py", line 533, in request
  File "site-packages\requests\sessions.py", line 646, in send
  File "site-packages\requests\adapters.py", line 449, in send
  File "site-packages\urllib3\connectionpool.py", line 672, in urlopen
  File "site-packages\urllib3\connectionpool.py", line 376, in _make_request
  File "site-packages\urllib3\connectionpool.py", line 994, in _validate_conn
  File "site-packages\urllib3\connection.py", line 360, in connect
  File "site-packages\urllib3\util\ssl_.py", line 370, in ssl_wrap_socket
  File "ssl.py", line 412, in wrap_socket
  File "ssl.py", line 850, in _create
  File "ssl.py", line 1108, in do_handshake
KeyboardInterrupt
[36076] Failed to execute script bot
  • it's more likely that it only contains no source code but instead python bytecode that you will need to find and decompile – ratchet freak Feb 21 at 12:37
  • How exactly did you deduce that "it was originally programmed in Python"? – Igor Skochinsky Feb 21 at 16:02
  • Using CTRL + C, I managed to crash the program. The error message matches that of one Python would spit out. – Xiddoc Feb 21 at 19:58
  • i think the possible way it's dump process with "Windows Process Explorer". But i don't know how extract deobfuscated bytecode from dump – Freedom Evolution Mar 20 at 13:25
1

From the “frozen” text in the stack trace, it was probably processed with cx_Freeze or a similar tool. Usually they put the compiled Python files into a zip file embedded into the executable, so try looking for one (e.g. with binwalk)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.