Simple Question About Reversing a Python

Question

So, detect it easy, shows that the .exe is a python 3.9 compiled on visual studio and the compiler was MS Visual C/C++. Trying to unpack it using pyinstxtractor fails, and shows me the error of

cookie missing etc.

That happens when you are trying to unpack a .NET application, but I'm kind of confused now. I can't unpack it and it's a python. How is that? Even on DnSpy, it only shows me the header. What should I do now?

Answer 1

1. If the executable is indeed a pyinstaller binary, then you generally need to make sure that you're running pyinstxractor inside the same version of python as produced the executable. Try to verify that is the case.
2. The executable might not be a pyinstaller binary, as there are multiple python "compiler" options. The other major one is py2exe (https://pypi.org/project/py2exe/), and there's another project unpy2exe for dealing with that format(https://pypi.org/project/unpy2exe/) Like pyinstxractor, I've found that it's generally better to run this project with the same python version.
3. If you want to ID what version of python it's using, you can use strings
4. DnSpy won't help you with python binaries. It only decompiles .NET CIL. Instead, once you've got the python executable unpacked into its requisite .pyc files, you'll want to run a separate decompiler utility like uncompyle6(https://pypi.org/project/uncompyle6/) or decompyle3 (https://github.com/rocky/python-decompile3). Then you can open the produced .py files in your favorite editor.

Here's another reference that's helpful if you aren't familiar with analyzing python: https://betterprogramming.pub/analysis-of-compiled-python-files-629d8adbe787