Author: In Ming Loh (inming.loh@countercept.com - @tantaryu) <br />
Company: Countercept (@countercept) <br />
Website: https://www.countercept.com <br />
## Introduction
A script that helps researcher to unpack and decompile executable written in python. However, right now this only supports executable created with py2exe and pyinstaller.
This script glues together several tools available to the community. Hopefully, this can help people in their daily job. Several YARA rules are available to determine if the executable is written in python (This script also confirms if the executable is created with either py2exe or pyinstaller).
## Requirements
- Python 2.7 or later.
- Install all the dependency needed:<br/>
`pip2 install --user -r requirements.txt`<br/>
or if you fancy to have your dependency installed with root permission<br/>
`sudo pip2 install -r requirements.txt`
## Getting Started
- python python_exe_unpack.py -i [malware.exe]
* pyinstaller
* A folder will be created with the original filename concatenated with "_extracted". For example: "malware.exe_extracted".
* The main python file that contains the logic will usually be the file without any extension (In the folder that concatenated with "_extracted"). In the following example, "hello" is the one that contains the main python logic:<br/>
`-rw-rw-r-- 1 testuser testuser 70K Nov 14 13:08 bz2.pyd`<br/>
`-rw-rw-r-- 1 testuser testuser 993K Nov 14 13:08 _hashlib.pyd`<br/>
`-rw-rw-r-- 1 testuser testuser 111 Nov 14 13:08 hello`<br/>
`-rw-rw-r-- 1 testuser testuser 1009 Nov 14 13:08 hello.exe.manifest`<br/>
`-rw-rw-r-- 1 testuser testuser 1.1K Nov 14 13:08 Microsoft.VC90.CRT.manifest`<br/>
`-rw-rw-r-- 1 testuser testuser 220K Nov 14 13:08 msvcm90.dll`<br/>
`-rw-rw-r-- 1 testuser testuser 557K Nov 14 13:08 msvcp90.dll`<br/>
`-rw-rw-r-- 1 testuser testuser 638K Nov 14 13:08 msvcr90.dll`<br/>
`-rw-rw-r-- 1 testuser testuser 628K Nov 14 13:08 out00-PYZ.pyz`<br/>
`drwxrwxr-x 2 testuser testuser 12K Nov 14 13:08 out00-PYZ.pyz_extracted`<br/>
`-rw-rw-r-- 1 testuser testuser 5.2K Nov 14 13:08 pyiboot01_bootstrap`<br/>
`-rw-rw-r-- 1 testuser testuser 2.5K Nov 14 13:08 pyimod01_os_path`<br/>
`-rw-rw-r-- 1 testuser testuser 12K Nov 14 13:08 pyimod02_archive`<br/>
`-rw-rw-r-- 1 testuser testuser 22K Nov 14 13:08 pyimod03_importers`<br/>
`-rw-rw-r-- 1 testuser testuser 0 Nov 14 13:08 pyi-windows-manifest-filename hello.exe.manifest`<br/>
`-rw-rw-r-- 1 testuser testuser 2.6M Nov 14 13:08 python27.dll`<br/>
`-rw-rw-r-- 1 testuser testuser 10K Nov 14 13:08 select.pyd`<br/>
`-rw-rw-r-- 1 testuser testuser 234 Nov 14 13:08 struct`<br/>
`-rw-rw-r-- 1 testuser testuser 671K Nov 14 13:08 unicodedata.pyd`<br/>
* pyinstaller has an option that can encrypt python bytecode. This script will try to decrypt it and decompile the decrypted code.
* py2exe
* The result of unpacking and decompiling will be located in folder "unpacked" or the location you specify.
* If error like this shows "Error in unpacking the exe. Probably due to version incompability (exe created using python 2 and run this script with python 3)", try setting your python to a different version than the one you are using. Eg: "alias python=python2" or "alias python=python3"
- python python_exe_unpack.py -p [pyc file]
* In the above example, sometimes the python file that contains the main logic will not be in the format that uncompyle6 accept (Missing python magic numbers). The above command will prepend magic numbers and decompile it (If magic number is already preprended it will not add it and just proceed with decompiling).
## Credits
- Extreme Coders for their pyinstxtractor.py script to help unpack pyinstaller executable.
- Extreme Coders for their instruction on how to decrypt encrypted python byte code: https://0xec.blogspot.sg/2017/02/extracting-encrypted-pyinstaller.html
- unpy2exe
- uncompyle6
没有合适的资源?快使用搜索试试~ 我知道了~
温馨提示
作者:在( @countercept.com-@tantaryu) 公司:Countercept(@countercept) 网站: : 介绍 该脚本可帮助研究人员解压和反编译以python编写的可执行文件。 但是,现在这仅支持使用py2exe和pyinstaller创建的可执行文件。 该脚本将社区可用的几种工具粘合在一起。 希望这可以对人们的日常工作有所帮助。 有几个YARA规则可用于确定可执行文件是否用python编写(此脚本还确认是否使用py2exe或pyinstaller创建了可执行文件)。 要求 Python 2.7或更高版本。 安装所需的所有依赖项: pip2 install --user -r requirements.txt 或者如果您希望通过root权限安装依赖项sudo pip2 install -r requirements.txt 入门 python py
资源详情
资源评论
资源推荐
收起资源包目录
python-exe-unpacker-master.zip (5个子文件)
python-exe-unpacker-master
python_exe_unpack.py 15KB
LICENSE 34KB
pyinstxtractor.py 12KB
requirements.txt 97B
README.md 4KB
共 5 条
- 1
看起来很年长的一条鱼
- 粉丝: 38
- 资源: 4611
上传资源 快速赚钱
- 我的内容管理 展开
- 我的资源 快来上传第一个资源
- 我的收益 登录查看自己的收益
- 我的积分 登录查看自己的积分
- 我的C币 登录后查看C币余额
- 我的收藏
- 我的下载
- 下载帮助
最新资源
- whl@pip install pyaudio ERROR: Failed building wheel for pyaudio
- Constantsfd密钥和权限集合.kt
- 基于Java的财务报销管理系统后端开发源码
- 基于Python核心技术的cola项目设计源码介绍
- 基于Python及多语言集成的TSDT软件过程改进设计源码
- 基于Java语言的歌唱比赛评分系统设计源码
- 基于JavaEE技术的课程项目答辩源码设计——杨晔萌、李知林、岳圣杰、张俊范小组作品
- 基于Java原生安卓开发的蔚蓝档案娱乐应用设计源码
- 基于Java、Vue、JavaScript、CSS、HTML的毕设设计源码
- 基于Java和HTML的CMS看点咨询系统设计源码
资源上传下载、课程学习等过程中有任何疑问或建议,欢迎提出宝贵意见哦~我们会及时处理!
点击此处反馈
安全验证
文档复制为VIP权益,开通VIP直接复制
信息提交成功
评论0