extremecoders-re / pyinstxtractor Goto Github PK
View Code? Open in Web Editor NEWPyInstaller Extractor
License: GNU General Public License v3.0
PyInstaller Extractor
License: GNU General Public License v3.0
Error is in the title. I have python 3.8.0 installed. pyinstxtractor says the python version of my file is 38. It also says pyinstaller version is 2.1+ I've also independently verified this exe was packaged by pyinstaller. I'm running the following command in an admin command shell in Win10:
python pyinstxtractor.py program.exe
Is it possible this is due to something the developer of the packaged script did in their file(s) or is this something on my end/pyinstxtractor?
Ok so basically the program i'm trying to mess with is from 3.9, using pyinstaller 4.8, i managed to extract it just fine, but since i can't decompile the files anyways, i just wanted to replace the cacert.pem from certifi to use my own fiddler signed cert, is there any way i can just replace that file on the .exe or any way to recompile the .exe with it replaced? (straight up running pyinstaller main.pyc throw me errors)
Change:
struct.unpack('!8siiii64s', self.fPtr.read(self.PYINST21_COOKIE_SIZE))
To:
struct.unpack('!8sIIII64s', self.fPtr.read(self.PYINST21_COOKIE_SIZE))
Will solve this error:
[+] Pyinstaller version: 2.1+
[+] Python version: 3.7
-2089571957
[+] Length of package: -2089571957 bytes
[+] Found 4480 files in CArchive
[+] Beginning extraction...please standby
Traceback (most recent call last):
File "pyinstxtractor.py", line 456, in
main()
File "pyinstxtractor.py", line 445, in main
arch.extractFiles()
File "pyinstxtractor.py", line 279, in extractFiles
data = zlib.decompress(data)
zlib.error: Error -5 while decompressing data: incomplete or truncated stream
And these place, change to unsign int
nameLen = struct.calcsize('!IIIIBc')
(entryPos, cmprsdDataSize, uncmprsdDataSize, cmprsFlag, typeCmprsData, name) =
struct.unpack(
'!IIIBc{0}s'.format(entrySize - nameLen),
self.fPtr.read(entrySize - 4))
Under the same typeCmprsData
('s') PyInstaller versions prior to 3.2 store Python source files (see issue 1847). They shouldn't be prefixed with pyc header.
I didn't (yet) find any way to detect if 's' file is compiled or not (PyInstaller version is unknown from file) - other than reading the first byte to check if it is marshalled code object ('c').
Suggest to use xdis.magics.versions for proper magic insertion in pyc files:
{b'\x02\x99\x99\x00': '1.0', b'\x03\x99\x99\x00': '1.1', b'\x89.\r\n': '1.3', b'\x04\x17\r\n': '1.4', b'\x99N\r\n': '1.5', b'\xfc\xc4\r\n': '1.6', b'\x87\xc6\r\n': '2.0', b'*\xeb\r\n': '2.1', b'-\xed\r\n': '2.2', b';\xf2\r\n': '2.3a0', b'E\xf2\r\n': '2.3a0', b'Y\xf2\r\n': '2.4a0', b'c\xf2\r\n': '2.4a3', b'm\xf2\r\n': '2.4b1', b'w\xf2\r\n': '2.5a0', b'\x81\xf2\r\n': '2.5a0', b'\x8b\xf2\r\n': '2.5a0', b'\x8c\xf2\r\n': '2.5a0', b'\x95\xf2\r\n': '2.5b3', b'\x9f\xf2\r\n': '2.5b3', b'\xa9\xf2\r\n': '2.5c1', b'\xb3\xf2\r\n': '2.5c2', b'\xb7\xf2\r\n': '2.5dropbox', b'\xc7\xf2\r\n': '2.6a0', b'\xd1\xf2\r\n': '2.6a1', b'\xdb\xf2\r\n': '2.7a0', b'\xe5\xf2\r\n': '2.7a0+1', b'\xef\xf2\r\n': '2.7a0+2', b'\xf9\xf2\r\n': '2.7a0+3', b'\x03\xf3\r\n': '2.7', b'a\n\r\n': '2.7pyston-0.6.1', b'\n\xf3\r\n': '2.7pypy', b'\xb8\x0b\r\n': '3.000', b'\xc2\x0b\r\n': '3.000+1', b'\xcc\x0b\r\n': '3.000+2', b'\xd6\x0b\r\n': '3.000+3', b'\xe0\x0b\r\n': '3.000+4', b'\xea\x0b\r\n': '3.000+5', b'\xf4\x0b\r\n': '3.000+6', b'\xf5\x0b\r\n': '3.000+7', b'\xff\x0b\r\n': '3.000+8', b'\t\x0c\r\n': '3.000+9', b'\x13\x0c\r\n': '3.000+10', b'\x1d\x0c\r\n': '3.000+11', b'\x1f\x0c\r\n': '3.000+12', b"'\x0c\r\n": '3.0a4', b';\x0c\r\n': '3.0a5', b'E\x0c\r\n': '3.1a0', b'O\x0c\r\n': '3.1a0+', b'X\x0c\r\n': '3.2a0', b'b\x0c\r\n': '3.2a1', b'l\x0c\r\n': '3.2a2', b's\x0c\r\n': '3.2pypy', b'v\x0c\r\n': '3.3a0', b'\x80\x0c\r\n': '3.3a0+', b'\x94\x0c\r\n': '3.3a1', b'\x8a\x0c\r\n': '3.3a2', b'\x9e\x0c\r\n': '3.3a4', b'\xb2\x0c\r\n': '3.4a1', b'\xbc\x0c\r\n': '3.4a1+1', b'\xc6\x0c\r\n': '3.4a1+2', b'\xd0\x0c\r\n': '3.4a1+3', b'\xda\x0c\r\n': '3.4a4', b'\xe4\x0c\r\n': '3.4a4+', b'\xee\x0c\r\n': '3.4rc2', b'\xf8\x0c\r\n': '3.5a0', b'\x02\r\r\n': '3.5b1', b'\x0c\r\r\n': '3.5b2', b'\x16\r\r\n': '3.5', b'\x17\r\r\n': '3.5.2', b' \r\r\n': '3.6a0', b'!\r\r\n': '3.6a0+1', b'*\r\r\n': '3.6a1', b'+\r\r\n': '3.6a1+1', b',\r\r\n': '3.6a1+2', b'-\r\r\n': '3.6b1', b'/\r\r\n': '3.6b1+1', b'0\r\r\n': '3.6b1+2', b'1\r\r\n': '3.6b1+3', b'2\r\r\n': '3.6b2', b'3\r\r\n': '3.6rc1', b'>\r\r\n': '3.7.0alpha0', b'?\r\r\n': '3.7.0alpha3', b'@\r\r\n': '3.7.0beta2', b'A\r\r\n': '3.7.0beta3', b'B\r\r\n': '3.7.0', b'H\r\r\n': '3.8.0a1', b'I\r\r\n': '3.8.0a3+', b'R\r\r\n': '3.8.0a1+', b'S\r\r\n': '3.8.0b2+', b'T\r\r\n': '3.8.0beta2', b'U\r\r\n': '3.8.0rc1+', b'\\\r\r\n': '3.9.0a0', b']\r\r\n': '3.9.0a0', b'^\r\r\n': '3.9.0alpha1', b'_\r\r\n': '3.9.0a0', b'`\r\r\n': '3.9.0a2', b'a\r\r\n': '3.9.0beta5', b'0\x00\r\n': '3.2a2', b'@\x00\r\n': '3.3pypy', b'p\x00\r\n': '3.5pypy', b'\xa0\x00\r\n': '3.6.1pypy', b'\xc0\x00\r\n': '3.6pypy', b'\xf3\x03\r\n': '2.7.1b3Jython', b'zV\r\n': '2.7.7Pyston'}
getting the following error on using uncompyle on the extracted pyc file:
Traceback (most recent call last):
File "D:\python\Scripts\uncompyle6-script.py", line 11, in <module>
load_entry_point('uncompyle6==3.7.4', 'console_scripts', 'uncompyle6')()
File "D:\python\lib\site-packages\uncompyle6\bin\uncompile.py", line 193, in main_bin
result = main(src_base, out_base, pyc_paths, source_paths, outfile,
File "D:\python\lib\site-packages\uncompyle6\main.py", line 316, in main
deparsed = decompile_file(
File "D:\python\lib\site-packages\uncompyle6\main.py", line 208, in decompile_file
decompile(
File "D:\python\lib\site-packages\uncompyle6\main.py", line 140, in decompile
deparsed = deparse_fn(
File "D:\python\lib\site-packages\uncompyle6\semantics\pysource.py", line 2572, in code_deparse
tokens, customize = scanner.ingest(
File "D:\python\lib\site-packages\uncompyle6\scanners\scanner38.py", line 45, in ingest
tokens, customize = super(Scanner38, self).ingest(
File "D:\python\lib\site-packages\uncompyle6\scanners\scanner37.py", line 42, in ingest
tokens, customize = Scanner37Base.ingest(self, co, classname, code_objects, show_asm)
File "D:\python\lib\site-packages\uncompyle6\scanners\scanner37base.py", line 209, in ingest
bytecode = self.build_instructions(co)
File "D:\python\lib\site-packages\uncompyle6\scanner.py", line 132, in build_instructions
self.insts = self.remove_extended_args(list(bytecode))
File "D:\python\lib\site-packages\xdis\bytecode.py", line 234, in get_instructions_bytes
argrepr = opc.opcode_arg_fmt[opc.opname[op]](arg)
File "D:\python\lib\site-packages\xdis\opcodes\opcode_37.py", line 121, in format_RAISE_VARARGS
assert 0 <= argc <= 2
AssertionError
use python 3.6.0 version, self.pyver
value is 306
, This causes to add the wrong magic number
with open(filename, 'wb+') as pycFile:
ValueError: embedded null character
Hello!
I have modified pyinstaller ELF. Can you take a look please?
Thanks!
I have an exe that was formatted in pyinstaller 4.9 and need it to be decompiled and it is saying that I cannot because of version or mising cookie
I’m trying to extract a PYZ that I know it should contains *.pyc.encrypted files. The extraction finished without any errors but those files are missing, what could be the reason for that?
The problem is that when i trying to extract exe gives error
Evey time
Im on kali linux
Is there any missing commands to do
Requirements ??
it should be like this, not a fixed pos.
search_end should be start of signature info or file end.
bootloader code: pyi_archive.c
static int
pyi_arch_find_cookie(ARCHIVE_STATUS *status, int search_end)
{
int search_start = search_end - SEARCH_SIZE;
char buf[SEARCH_SIZE];
char * search_ptr = buf + SEARCH_SIZE - sizeof(COOKIE);
if (fseek(status->fp, search_start, SEEK_SET)) {
return -1;
}
/* Read the entire search space */
if (fread(buf, SEARCH_SIZE, 1, status->fp) < 1) {
return -1;
}
/* Search for MAGIC within search space */
while(search_ptr >= buf) {
if(0 == strncmp(MAGIC, search_ptr, strlen(MAGIC))) {
/* MAGIC found - Copy COOKIE to status->cookie */
memcpy(&status->cookie, search_ptr, sizeof(COOKIE));
/* From the cookie, calculate the archive start */
status->pkgstart = search_start + sizeof(COOKIE) + (search_ptr - buf) - ntohl(status->cookie.len);
return 0;
}
search_ptr--;
}
return -1;
}
your scripts may fail due to several tailing junk bytes while bootloader still works.
PS C:\git\ActiveIQManager0603> uncompyle6 .\ActiveIQHealthManager.exe_extracted\ActiveIQHealthManager.pyc
Traceback (most recent call last):
File "c:\python27\lib\runpy.py", line 174, in _run_module_as_main
"main", fname, loader, pkg_name)
File "c:\python27\lib\runpy.py", line 72, in run_code
exec code in run_globals
File "C:\Python27\Scripts\uncompyle6.exe_main.py", line 7, in
File "c:\python27\lib\site-packages\uncompyle6\bin\uncompile.py", line 194, in main_bin
**options)
File "c:\python27\lib\site-packages\uncompyle6\main.py", line 324, in main
do_fragments,
File "c:\python27\lib\site-packages\uncompyle6\main.py", line 222, in decompile_file
do_fragments=do_fragments,
File "c:\python27\lib\site-packages\uncompyle6\main.py", line 141, in decompile
co, out, bytecode_version, debug_opts=debug_opts, is_pypy=is_pypy
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 2643, in code_deparse
deparsed.gen_source(deparsed.ast, co.co_name, customize)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 2461, in gen_source
self.text = self.traverse(ast, is_lambda=is_lambda)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 426, in traverse
self.preorder(node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 404, in preorder
super(SourceWalker, self).preorder(node)
File "c:\python27\lib\site-packages\spark_parser\ast.py", line 117, in preorder
self.preorder(kid)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 404, in preorder
super(SourceWalker, self).preorder(node)
File "c:\python27\lib\site-packages\spark_parser\ast.py", line 110, in preorder
func(node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 1448, in n_classdef
self.n_classdef36(node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\customize36.py", line 230, in n_classdef36
self.build_class(subclass_code)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 2437, in build_class
self.gen_source(ast, code.co_name, code._customize)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 2461, in gen_source
self.text = self.traverse(ast, is_lambda=is_lambda)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 426, in traverse
self.preorder(node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 404, in preorder
super(SourceWalker, self).preorder(node)
File "c:\python27\lib\site-packages\spark_parser\ast.py", line 117, in preorder
self.preorder(kid)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 404, in preorder
super(SourceWalker, self).preorder(node)
File "c:\python27\lib\site-packages\spark_parser\ast.py", line 110, in preorder
func(node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\customize35.py", line 215, in n_function_def
self.default(node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 2181, in default
self.template_engine(table[key.kind], node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 2087, in template_engine
self.preorder(node[index])
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 404, in preorder
super(SourceWalker, self).preorder(node)
File "c:\python27\lib\site-packages\spark_parser\ast.py", line 110, in preorder
func(node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 870, in n_mkfunc
self.make_function(node, is_lambda=False, code_node=code_node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 887, in make_function
make_function36(self, node, is_lambda, nested, code_node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\make_function36.py", line 160, in make_function36
scanner_code = Code(code, self.scanner, self.currentclass)
File "c:\python27\lib\site-packages\uncompyle6\scanner.py", line 97, in init
self._tokens, self._customize = scanner.ingest(co, classname)
File "c:\python27\lib\site-packages\uncompyle6\scanners\scanner38.py", line 103, in ingest
jump_back_index = self.offset2tok_index[jump_target]
KeyError: 1830
PS C:\git\ActiveIQManager0603>
[!] Error : Unsupported pyinstaller version or not a pyinstaller archive
pyinstaller --version
4.0
[+] Processing .\LaunchProggram
[+] Pyinstaller version: 2.0
[+] Python version: 309
[+] Length of package: 10842163 bytes
Traceback (most recent call last):
File "C:\Users\csord\Downloads\pyinstxtractor-master\pyinstxtractor.py", line 417, in
main()
File "C:\Users\csord\Downloads\pyinstxtractor-master\pyinstxtractor.py", line 405, in main
arch.parseTOC()
File "C:\Users\csord\Downloads\pyinstxtractor-master\pyinstxtractor.py", line 235, in parseTOC
struct.unpack(
struct.error: unpack requires a buffer of 6925863 bytes
[+] Processing slime.exe
[+] Pyinstaller version: 2.1+
[+] Python version: 39
[+] Length of package: 7711006 bytes
[+] Found 76 files in CArchive
[+] Beginning extraction...please standby
[+] Possible entry point: pyiboot01_bootstrap.pyc
[+] Possible entry point: pyi_rth_pkgutil.pyc
[+] Possible entry point: pyi_rth_multiprocessing.pyc
[+] Possible entry point: pyi_rth_inspect.pyc
[+] Possible entry point: pyi_rth_certifi.pyc
[+] Possible entry point: slime.pyc
[+] Found 341 files in PYZ archive
[*] Successfully extracted pyinstaller archive: slime.exe
[>] Decompyle...
failed to create process.
Error : Missing cookie, unsupported pyinstaller version or not a pyinstaller archive
What Is The Python Version And How To Download It
Python version: 309
C:\Users\xapao\Desktop>python pyinstxtractor.py MEGATRON.exe
[+] Processing MEGATRON.exe
[+] Pyinstaller version: 2.1+
[+] Python version: 309
[+] Length of package: 19589023 bytes
[+] Found 75 files in CArchive
[+] Beginning extraction...please standby
[+] Possible entry point: pyiboot01_bootstrap.pyc
[+] Possible entry point: pyi_rth_subprocess.pyc
[+] Possible entry point: pyi_rth_pkgutil.pyc
[+] Possible entry point: pyi_rth_inspect.pyc
[+] Possible entry point: pyi_rth_multiprocessing.pyc
[+] Possible entry point: pyi_rth_win32api.pyc
[+] Possible entry point: pyi_rth_win32comgenpy.pyc
[+] Possible entry point: MEGATRON.pyc
[!] Warning: This script is running in a different Python version than the one used to build the executable.
[!] Please run this script in Python309 to prevent extraction errors during unmarshalling
[!] Skipping pyz extraction
[+] Successfully extracted pyinstaller archive: MEGATRON.exe
You can now use a python decompiler on the pyc files within the extracted directory
When used on a Mac binary, I get this error.
High Sierra 10.13.6
~/.pyenv/shims/python3 pyinstxtractor.py ./lights.app/Contents/MacOS/lights
[+] Processing ./lights.app/Contents/MacOS/lights
[+] Pyinstaller version: 2.0
[+] Python version: 36
[+] Length of package: 6690129 bytes
Traceback (most recent call last):
File "pyinstxtractor.py", line 423, in <module>
main()
File "pyinstxtractor.py", line 411, in main
arch.parseTOC()
File "pyinstxtractor.py", line 237, in parseTOC
self.fPtr.read(entrySize - 4))
ValueError: read length must be positive or -1
$~/.pyenv/shims/python3 --version
Python 3.6.5
Hi there, thanks for your work.
Deparsing stopped due to parse error
I'm getting this error when trying to decode an .exe file via uncompyle6. What causes this issue?
I have uploaded the zip file here if you want to have a look: [link removed]
Installed python version: 3.8.0
OS: Windows 10
I'm trying to extract one executable, which had arguments that linked an entire project. Ex: It imports api from utils.api. Where can i find this data?
Hi,
When one launches pyinstxtractor with a python interpetor that has a different version than the one used in the packed python script, then the header of the current used python version is put in the pyc header instead of the version packed.
As this seems to be intentional, what is the reason for this?
It is checked here:
if pyc_magic != pycHeader:
print('[!] Warning: This script is running in a different Python version than the one used to build the executable.')
print('[!] Please run this script in Python {0}.{1} to prevent extraction errors during unmarshalling'.format(self.pymaj, self.pymin))
print('[!] Skipping pyz extraction')
return
but when writing the file we could just put pycHeader instead of pyc_magic and it would solve the python version problem.
pycFile.write(pyc_magic) #why not use pycHeader here?
I understand it may not be unmarshalled in some cases but at least the generated pyc file would be correct.
unsupported pyinstaller i installed every single ver and still this problem
aarch64 ELF binaries can't extract
dna.zip
According to the source code of pyinstaller, the bootloader find the MAGIC pattren by searching from end to front but not the fixed end-of-file offset.
Sorry to bother you with basic things - but I assume the attached exe should be packed with pyinstaller - but the xtractor does not accept it.
Could you take a closer look?
python pyinstxtractor.py app.exe
[+] Processing app.exe
[!] Error : Missing cookie, unsupported pyinstaller version or not a pyinstaller archive
https://www.mediafire.com/file/mg5dgslaiatp0o3/app.exe/file
Or is kind ob obfuscated to trick the xtractor?
When using the code in wiki and changing the password
import glob
import zlib
import tinyaes
from pathlib import Path
CRYPT_BLOCK_SIZE = 16
# key obtained from pyimod00_crypto_key
key = bytes('MySup3rS3cr3tK3y', 'utf-8')
for p in Path("PYZ-00.pyz_extracted").glob("**/*.pyc.encrypted"):
inf = open(p, 'rb') # encrypted file input
outf = open(p.with_name(p.stem), 'wb') # output file
# Initialization vector
iv = inf.read(CRYPT_BLOCK_SIZE)
cipher = tinyaes.AES(key, iv)
# Decrypt and decompress
plaintext = zlib.decompress(cipher.CTR_xcrypt_buffer(inf.read()))
# Write pyc header
# The header below is for Python 3.8
outf.write(b'\x55\x0d\x0d\x0a\0\0\0\0\0\0\0\0\0\0\0\0')
# Write decrypted data
outf.write(plaintext)
inf.close()
outf.close()
# Delete .pyc.encrypted file
p.unlink()
I get the following
Traceback (most recent call last):
File "decrypt.py", line 21, in <module>
plaintext = zlib.decompress(cipher.CTR_xcrypt_buffer(inf.read()))
zlib.error: Error -3 while decompressing data: incorrect header check
the environment is as below
Python 3.8.13
tinyaes 1.0.3
Hello, i got fail of unpacking.
Maybe pyinstaller 2.0 unpacker is broken
[!] Error : Missing cookie, unsupported pyinstaller version or not a pyinstaller archive
help meee :))
please add support python 3.9.x
Hello! I'm package maintainer of Parrot OS and I want to create a Debian package of your tool on our repository. To make Debian package, it is easier for us if you have releases / tags that have source code in tarball files. So we can update newer version with uscan easily.
I used the script to some exe but the "PYZ-00.pyz_extracted" folder is empty and i dont really know what to do about it
当我使用最新版本的 pyinstxtractor.py 时,我得到的 1.pyc 似乎依然没有一个正确的文件头,以至于当我使用 uncompyle6 时会报错:
~ uncompyle6 1.pyc
Unknown type 0
Traceback (most recent call last):
File "/home/temp/.local/bin/uncompyle6", line 11, in <module>
sys.exit(main_bin())
File "/home/temp/.local/lib/python2.7/site-packages/uncompyle6/bin/uncompile.py", line 194, in main_bin
**options)
File "/home/temp/.local/lib/python2.7/site-packages/uncompyle6/main.py", line 328, in main
do_fragments,
File "/home/temp/.local/lib/python2.7/site-packages/uncompyle6/main.py", line 230, in decompile_file
do_fragments=do_fragments,
File "/home/temp/.local/lib/python2.7/site-packages/uncompyle6/main.py", line 78, in decompile
assert iscode(co), ("%s does not smell like code" % co)
AssertionError: None does not smell like code
我使用的 exe 文件可以在这里下载( github 的 issue 似乎无法上传 exe 文件)
按照我的设想,根据 struct.pyc 的文件头可知正确的文件头应当是:
但使用此脚本反编译得到的 1.pyc 的文件头却是:
我使用的反编译命令是:python3 pyinstxtractor.py pyre.exe
,它看起来很正常。
我使用 010editor 这个16进制编辑器查看了这两个 pyc 文件,上面的两种图片即来自于此。
> python pyinstxtractor.py linux_x64
[+] Processing linux_x64
[+] Pyinstaller version: 2.1+
[+] Python version: 27
[+] Length of package: 55915 bytes
Traceback (most recent call last):
File "pyinstxtractor.py", line 390, in <module>
main()
File "pyinstxtractor.py", line 378, in main
arch.parseTOC()
File "pyinstxtractor.py", line 210, in parseTOC
self.fPtr.read(entrySize - 4))
struct.error: unpack requires a string argument of length 576508212
The binary may have been confusion
Unable to extract pyc files for malware MD5: bbf630ca23976ddf8a561ccdb477c73d.
Seems like current script is not finding pyinstaller magic number which is there in file (one byte before in 2.1 offset). I tried to manually change the offset in the script but it is crashing in later code. Can you please check and confirm whether this is due to structure change or malware trick to bypass extraction of files.
Thanks in advance :)
I tried to decompile a exe via pyinstxtractor but it resulted in an error.
If you want to take a look at it here is the file:
https://www.mediafire.com/file/1mdv3imid2bxskd/Wanting_to_decompile.exe/file
When I use python3.7 to run the script, it will get python 3.7's pyc magic.
The exe genereated by pyinstaller may use other python version.
Notice that the python version can be identified:
[+] Python version: 34
So maybe it's a good idea to change the pyc magic fix method.
Here is some pyc magic:
https://github.com/google/pytype/blob/master/pytype/pyc/magic.py
Here is a sample I used.
src.zip
is it possible to pack extract folder to exe again ?
Hey so I ran the code and it didn't work for some reason it says can't open exe screenshot here
[+] Processing gen.exe
[!] Error : Missing cookie, unsupported pyinstaller version or not a pyinstaller archive
when i try with unpy2exe it say its a pyinstaller so im out of idea
first of all - thank you for this amazing tool!
script fails to extract anything from this executable (MALICIOUS), seemingly because it was compiled using the --onefile option. when run, it throws the following error.
[!] Error : Missing cookie, unsupported pyinstaller version or not a pyinstaller archive
if this is just user error on my end, then I'm sorry :/
output message:[!] Error : Unsupported pyinstaller version or not a pyinstaller archive ,does pyinstractor support 4.3?
I have a key, but it seems that pyinstxtractor doesn't support it yet. Will it be created in future updates?
Hi!
I got this error when I try to use this extractor:
E:\Temp\test>python.exe pyinstxtractor.py Cookie test.exe
File "pyinstxtractor.py", line 8
^
SyntaxError: invalid syntax
im having a error [!] Error : Missing cookie, unsupported pyinstaller version or not a pyinstaller archive does anyone have a fix for this?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.