Comments (4)
rocky
commented on May 17, 2024
2
I'll guess your file since that's the easier of the two paths. Quite frankly, I personally am not all that interested in this.
And given all the number of open tickets and volunteers for these kinds of problems or other work on the other kinds of problems, I don't think anyone else is either.
from python-decompile3.
graysuit
commented on May 17, 2024
Respected developer @rocky
Description
I got an suspicious python compiled file which I want to decompile and get source code. I extracted the *.pyc files using pyinstxtractor. After that I installed python-decompile3 and tried to decompile targeted pyc file but it says ImportError: Ill-formed bytecode file C:\Users\gray\Desktop\abc\Google_Update.bin_extracted\Google_Update.pyc <class 'ValueError'>; bad marshal data (unknown type code).
How to Reproduce
$ decompyle3 "C:\Users\gray\Desktop\abc\Google_Update.bin_extracted\Google_Update.pyc"
Traceback (most recent call last):
File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\lib\site-packages\xdis\load.py", line 293, in load_module_from_file_object
co = marshal.loads(bytecode)
ValueError: bad marshal data (unknown type code)
Traceback (most recent call last):
File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\lib\site-packages\xdis\load.py", line 293, in load_module_from_file_object
co = marshal.loads(bytecode)
ValueError: bad marshal data (unknown type code)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\Scripts\decompyle3-script.py", line 11, in <module>
load_entry_point('decompyle3==3.3.2', 'console_scripts', 'decompyle3')()
File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\lib\site-packages\decompyle3-3.3.2-py3.7.egg\decompyle3\bin\decompile.py", line 190, in main_bin
File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\lib\site-packages\decompyle3-3.3.2-py3.7.egg\decompyle3\main.py", line 304, in main
File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\lib\site-packages\decompyle3-3.3.2-py3.7.egg\decompyle3\main.py", line 183, in decompile_file
File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\lib\site-packages\xdis\load.py", line 168, in load_module
get_code=get_code,
File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\lib\site-packages\xdis\load.py", line 307, in load_module_from_file_object
"Ill-formed bytecode file %s\n%s; %s" % (filename, kind, msg)
ImportError: Ill-formed bytecode file C:\Users\gray\Desktop\abc\Google_Update.bin_extracted\Google_Update.pyc
<class 'ValueError'>; bad marshal data (unknown type code)
Expected behavior
I expected it would deliver python code. Obfucticated, mangled, or discordered code doesn't matter. I need just code to check whats inside.
Environment
Python 3.7.3
Version: 3.3.2
Summary: Python cross-version byte-code decompiler
Home-page: https://github.com/rocky/python-decompyle3/
Author: Rocky Bernstein, Hartmut Goebel, John Aycock, and others
Author-email: [email protected]
License: GPL3
Location: c:\users\gray\appdata\local\programs\python\python37-32\lib\site-packages\decompyle3-3.3.2-py3.7.egg
Requires: spark-parser, xdis
Required-by:
3.7.3 (v3.7.3:ef4ec6ed12, Mar 25 2019, 21:26:53) [MSC v.1916 32 bit (Intel)]
windows 10 pro 32 bit 10.0.15063 N/A Build 15063
I am not sure whether I can get its python bytecode without source code or not. But I do have some testing malware file. Its same which I am using. Please let me know, if anything unclear or missing. I would surely corporate.
Regards.
Only Pyc File :
Google_Update.zip
All extracted files:
https://filebin.net/rxj0h6kj07wa7ylc
Virustotal report:
https://www.virustotal.com/gui/file/e968e6cb3e74f73ae90c4d691c777aebe7e43d500bb7c447d4a83da78aa300d5/detection
from python-decompile3.
rocky
commented on May 17, 2024
This kind of thing feels like something you should pay someone to help you with.
if you make a contribution to the project under the support page, I'll consider looking into to this. (The larger the donation, the more llikely I'll do it.) But it for me it has to be done on the weekend.
I also mention elsewhere someone else you might contact.
from python-decompile3.
graysuit
commented on May 17, 2024
This kind of thing feels like something you should pay someone to help you with.
Sure, donation is your right.
I also mention elsewhere someone else you might contact.
No need, owner knows about his code more than any other. lol
By the way, is this problem is in decompile3 or in my file ? Can you shortly describe it ?
from python-decompile3.
Related Issues (20)
- Another nested try-finally parse error
- decompilation failed when returning a constant in `except`/`finally` block HOT 1
- python-decompile3-master HOT 3
- Decompiled failed with assetion error at `assert expr[0] == "LOAD_STR"` in customize37.py HOT 2
- Got error "Deparsing stopped due to parse error" HOT 1
- Decompiled failed with Parse error at or near `COME_FROM' instruction at offset 2024_0 HOT 1
- Decompilation of example.pyc fails with error message "Parse error at or near `CALL_METHOD_1'"
- Parse error at or near `END_FINALLY'
- Decompile failed with Parse error at or near `COME_FROM'
- Exception has occurred: AttributeError 'Instruction' object has no attribute 'tos_str' HOT 3
- Decompiler can execute arbitrary code HOT 4
- TypeError: argument of type 'int' is not iterable HOT 5
- Exception: 'Instruction' object has no attribute 'tos_str' HOT 4
- decompyle failure HOT 1
- Decompile mistake with nested if/else + and conditions HOT 3
- Error when i try to decompile a .pyc file HOT 1
- KeyError: 67660 HOT 1
- TypeError: __new__() got an unexpected keyword argument 'positions' HOT 1
- Unsupported Python version, 3.11, for decompilation HOT 2
- use randomly generate source code to test decompyle3 HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from python-decompile3.