Decompiling .pyc file to 0 byte .py file

Question

i am doing the CTF-like challenges. One of these tasks need us to decompiling Python bytecode 3.8 (.pyc file) into py file. However, the py file that generated by pyc file is 0 byte The original file's name is flag.py Here are my procedures.

1. Rename the file: flag.py -> flag.pyc

2. Use uncompyle6tool and type command: uncompyle6 flag.pyc > flag.py

3. It will generate flag.py file, however it is 0 byte. And after several hours, it is still 0 byte.

4. If i interrupt the command line tool by keyboard, the flag.py file will have the comment:

 uncompyle6 version 3.6.6
 Python bytecode 3.8 (3413)
 Decompiled from: Python 3.8.0 
 [GCC 4.2.1 Compatible Clang 4.0.1 (tags/RELEASE_401/final)]
 Embedded file name: flag.o.py
 Compiled at: 2020-04-24 16:09:51
 Size of source mod 2**32: 2476187 bytes

My environment is MacOS, Python 3.8.0.

The .pyc file is small and I've already checked the magic number of the file's header, it is Python 3.8.0. The unusual thing of this pyc file is that there are several thousands of ff 00 at the end of the file.

55 0d 0d 0a 00 00 00 00
...
ff 00 ff 00 ff 00 ff 00 
...
ff 00 ff 00 ff 00 ff 00 
b9 01 0c 06 0a 01 08 01

Any Suggestions?

Answer 1

It's possible that the pyc file is obfuscated/malformed in a way that it trips uncompyle6. Rather than decompiling you can try disassembling the file instead.

The dis module can disassemble Python bytecode. You can use it as follows.

import marshal, dis

f = open("flag.pyc", "rb")
f.seek(16) # Skip 16 byte header (for Python 3.8)
co = marshal.load(f)
print(dis.dis(co))

There also exists other Python disassemblers libraries like xdis. After installing the package (pip install xdis) you can simply run pydisasm flag.pyc to disassemble the pyc.

Once you have figured out the reason it trips uncompyle6, you can remove those parts and re-assemble a corrected pyc using xasm which can then be decompiled.