Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what pyarmor looks like. Its infuriating to reverse however I think I might be onto a method for completely reversing pyarmor. Wanted to get some thoughts on this idea. (Sorry for all the screwed up images, im working on getting a hang of the markdown)
Once you unpack your python executable your left with a ton of unimportant files, however some of these files are interesting. Something that is important for the self unpacking is pytransform.
Part of what I was thinking is that you could call your functions normally from the included pyarmor dll as shown here.
Now whats interesting is that if you crack it open with something such as IDA you can call some of the readable functions without issue and it will return data.
Our dll entry point is pretty uneventful, its not packed or anything which makes our job a bit easier. It makes a simple computational check and decides whether it should end itself or to decrypt our file. Still playing around with the dll and seeing what each functions does.
One last final thing I found that for sure is interesting is this:
If we decompile our pytransform.pyc file we are left with some of our keygen source, which I am pretty sure can be found all on the github anyways. However since this is a paid version I still figured cracking it open wouldn't hurt.
Anyways, thoughts on calling functions from our dll and trying to pass it args? If that doesn't work ill try dumping it at runtime however that gets messy.
