1

Created an application, protected by PyArmor and used pyinstaller. I'm trying to reverse engineer it. So far I've decompiled the exe into pyc files but it's still pyarmor encrypted I can only see the loading of the encrypted bytes.

  1. Is there a way to decrypt PyArmor?
  2. If not, it's my understanding it decrypts at runtime, how could I catch the unencrypted portion? I've been trying to use Ollydbg but can't figure out exactly how it works.
  3. The program prints a Hello World but I can't seem to even find the instruction or the string in reference strings, any idea why or how to do it?
1
  • 2
    In my opinion to find where your code is, Don't just use simple print hello world! instead use an API function and set break-point on that particular api. if you use an unique API function you will stop on your real-original API code that will return to your code. – arman Jun 4 '20 at 10:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.