3

i am doing the CTF-like challenges. One of these tasks need us to decompiling Python bytecode 3.8 (.pyc file) into py file. However, the py file that generated by pyc file is 0 byte The original file's name is flag.py Here are my procedures.

  1. Rename the file: flag.py -> flag.pyc

  2. Use uncompyle6tool and type command: uncompyle6 flag.pyc > flag.py

  3. It will generate flag.py file, however it is 0 byte. And after several hours, it is still 0 byte.

  4. If i interrupt the command line tool by keyboard, the flag.py file will have the comment:

 uncompyle6 version 3.6.6
 Python bytecode 3.8 (3413)
 Decompiled from: Python 3.8.0 
 [GCC 4.2.1 Compatible Clang 4.0.1 (tags/RELEASE_401/final)]
 Embedded file name: flag.o.py
 Compiled at: 2020-04-24 16:09:51
 Size of source mod 2**32: 2476187 bytes

My environment is MacOS, Python 3.8.0.

The .pyc file is small and I've already checked the magic number of the file's header, it is Python 3.8.0. The unusual thing of this pyc file is that there are several thousands of ff 00 at the end of the file.

55 0d 0d 0a 00 00 00 00
...
ff 00 ff 00 ff 00 ff 00 
...
ff 00 ff 00 ff 00 ff 00 
b9 01 0c 06 0a 01 08 01

Any Suggestions?

3

It's possible that the pyc file is obfuscated/malformed in a way that it trips uncompyle6. Rather than decompiling you can try disassembling the file instead.

The dis module can disassemble Python bytecode. You can use it as follows.

import marshal, dis

f = open("flag.pyc", "rb")
f.seek(16) # Skip 16 byte header (for Python 3.8)
co = marshal.load(f)
print(dis.dis(co))

There also exists other Python disassemblers libraries like xdis. After installing the package (pip install xdis) you can simply run pydisasm flag.pyc to disassemble the pyc.

Once you have figured out the reason it trips uncompyle6, you can remove those parts and re-assemble a corrected pyc using xasm which can then be decompiled.

2
  • Hi, @0xec.Thanks for your answer! I have disassembled the .pyc file. However, i am not sure how to figure out the reason. Could you give me a hint? Thank you so much! Apr 27 '20 at 0:36
  • 2
    @FRANKfisher Please add the disassembled code or the pyc file to the question. Without that it's difficult to answer.
    – 0xec
    Apr 27 '20 at 5:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.