Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what pyarmor looks like. Its infuriating to reverse however I think I might be onto a method for completely reversing pyarmor. Wanted to get some thoughts on this idea. (Sorry for all the screwed up images, im working on getting a hang of the markdown)


Once you unpack your python executable your left with a ton of unimportant files, however some of these files are interesting. Something that is important for the self unpacking is pytransform.

enter image description here

Part of what I was thinking is that you could call your functions normally from the included pyarmor dll as shown here.

enter image description here

Now whats interesting is that if you crack it open with something such as IDA you can call some of the readable functions without issue and it will return data.

enter image description here

Our dll entry point is pretty uneventful, its not packed or anything which makes our job a bit easier. It makes a simple computational check and decides whether it should end itself or to decrypt our file. Still playing around with the dll and seeing what each functions does.


One last final thing I found that for sure is interesting is this:

enter image description here

If we decompile our pytransform.pyc file we are left with some of our keygen source, which I am pretty sure can be found all on the github anyways. However since this is a paid version I still figured cracking it open wouldn't hurt.

Anyways, thoughts on calling functions from our dll and trying to pass it args? If that doesn't work ill try dumping it at runtime however that gets messy.

  • Great research. Have you had any further success?
    – fpena06
    Commented Feb 23, 2021 at 2:38


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.