You don't always get a text file with source code when you extract Python code from a PyInstaller-produced EXE. I produced the following Python code including shellcode, and generated an EXE with PyInstaller: Then I extract the Python code: This time, the extracted shellcode file doesn't contain Python source code: It's actually compiled Python bytecode. Add the following 8 bytes to the beginning of the file and save it as shellcode.pyc: Now you can use a Python bytecode decompiler like Easy Python Decompiler: Here is the recovered source code (shellcode.pyc_dis): Didier Stevens |
DidierStevens 533 Posts ISC Handler Jul 25th 2016 |
Thread locked Subscribe |
Jul 25th 2016 4 years ago |
Sign Up for Free or Log In to start participating in the conversation!