Git Product home page Git Product logo

lookinsidethebox's Introduction

Look inside the box

This tool is just the latest implementation that breaks the encryption and obfuscation layers that Dropbox applies to their modified Python interpreter. It's based on work the author did many, many moons ago as well as public work done by others. For more information please see the blogpost.

Updates

May, 2019

Initial release.

October, 2019

The code was updated to regenerate the opcode database using Python 3.7. It now also checks for the version of uncompyle6 being installed (>= 3.5.x) such that it gives an error when uncompyle6 is installed but is very outdated. Several bugs were fixed in the generation of the opcode mapping. Thanks to @slinkinone for sending me e-mails and helping me out with debugging some of the issues.

Requirements

  • Have a recent Python 3.x installation for the unpacking.
  • Make sure that uncompyle6 is installed. You can do this with:
pip3 install uncompyle6
  • For regenerating the opcode database make sure that the Python version installed is 3.7. Please note that there's already a version of this opcode database mapping included so it shouldn't be necessary to rerun it.

Usage

  • Run the included fetchdeps.sh bash script. This will fetch the Python source code as well as download the latest version of the Dropbox for Linux tarball. The Python source code is only needed if one wants to regenerate the opcode database.

  • Execute the following to unpack, decrypt and decompile most of the Dropbox Python source code. It will extract to a default directory named out:

python3 unpacker.py --dropbox-zip `find . -name python-packages-37.zip`
  • To regenerate the opcode mapping database use something like this. Please note that Python 3.7 is a requirement for this to work.
find . -name python-packages-37.zip | xargs python3.7 gendb.py --python-dir tmp/Python-3.7.4/ --db opcode.db --dropbox-zip
  • To patch the ZIP file in the Dropbox distribution and rewrite the pyc files such that the SHA-256 hashes in there are known SHA-256 hashes use the following to rewrite and inject code into the zip.
python3 patchzip.py --dropbox-zip `find . -name python-packages-37.zip` --output-zip out.zip
mv out.zip ~/.dropbox-dist/dropbox-lnx_64-71.4.108/python-packages-37.zip
~/.dropbox-dist/dropbox-lnx_64-71.4.108/dropbox
  • To dump the contents of the opcode mapping run the following.
python3 checkdb.py --db opcodemap.db

That will yield something like the following:

...
| ============================== | ======= | ======= |
| OPCODE                         |  PYTHON | DROPBOX |
| ============================== | ======= | ======= |
| POP_TOP                        |       1 |      24 |
| ROT_TWO                        |       2 |       1 |
| ROT_THREE                      |       3 |      83 |
| DUP_TOP                        |       4 |      66 |
| UNARY_POSITIVE                 |      10 |      77 |
...
  • To set the environment variables to enable hidden Dropbox functionality see the setenv.py script. For more information on this please see the blogpost again. Modify at will and then use it like this to setup the environment and run dropbox.
eval `python3 setenv.py`
~/.dropbox-dist/dropbox-lnx_64-71.4.108/dropbox

lookinsidethebox's People

Contributors

gvb84 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.