I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with PyInstaller. I have tried multiple attempts at finding the source code, such as:

  • Using CheatEngine to read the memory
  • Using IDA to read assembler code
  • Using multiple PyInstaller unpackers to get source code

But all of them, to no avail. Is there any way I can get the source code of this file, and if so, how?

Here's the Stack Trace I got when I terminated the program with CTRL + C:

Traceback (most recent call last):
  File "<dist/obf\bot.py>", line 3, in <module>
  File "<frozen bot>", line 798, in <module>
  File "<frozen keyvalidation>", line 243, in checkStuff
  File "<frozen keyvalidation>", line 150, in checkKey
  File "site-packages\requests\api.py", line 116, in post
  File "site-packages\requests\api.py", line 60, in request
  File "site-packages\requests\sessions.py", line 533, in request
  File "site-packages\requests\sessions.py", line 646, in send
  File "site-packages\requests\adapters.py", line 449, in send
  File "site-packages\urllib3\connectionpool.py", line 672, in urlopen
  File "site-packages\urllib3\connectionpool.py", line 376, in _make_request
  File "site-packages\urllib3\connectionpool.py", line 994, in _validate_conn
  File "site-packages\urllib3\connection.py", line 360, in connect
  File "site-packages\urllib3\util\ssl_.py", line 370, in ssl_wrap_socket
  File "ssl.py", line 412, in wrap_socket
  File "ssl.py", line 850, in _create
  File "ssl.py", line 1108, in do_handshake
[36076] Failed to execute script bot
  • it's more likely that it only contains no source code but instead python bytecode that you will need to find and decompile Feb 21 '20 at 12:37
  • How exactly did you deduce that "it was originally programmed in Python"?
    – Igor Skochinsky
    Feb 21 '20 at 16:02
  • Using CTRL + C, I managed to crash the program. The error message matches that of one Python would spit out.
    – Xiddoc
    Feb 21 '20 at 19:58
  • i think the possible way it's dump process with "Windows Process Explorer". But i don't know how extract deobfuscated bytecode from dump Mar 20 '20 at 13:25

From the “frozen” text in the stack trace, it was probably processed with cx_Freeze or a similar tool. Usually they put the compiled Python files into a zip file embedded into the executable, so try looking for one (e.g. with binwalk)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.