What Python version you're decompiling? Py3k is not well supported, but there are quite a few decompilers for 2.x. One of the latest projects is this:
https://github.com/Mysterie/uncompyle2
It runs on Python 2.7 but supports decompiling 2.5 to 2.7.
Note that some commercial projects has been known to use modified Python interpreters. Modifications can include:
- bytecode files encryption
- changed opcode values or additional opcodes
- a heavily customized runtime (e.g. Stackless Python)
If you need to handle this, one approach is to convert non-standard bytecode to standard one and then use the usual decompilers (this apparently was used by the people from above project to decompile Dropbox code). Another is to change the decompiler to directly support the variations.
Answer from Igor Skochinsky on Stack ExchangeEncrypt Python .py file
tools - Decompiling .pyc files - Reverse Engineering Stack Exchange
Make your python script safety?
python - PyInstaller Encryption --key - Stack Overflow
Videos
Knowledge grows with sharing and I am truly believer. With same beliefs I shared my python script with my colleague because he wanted it. He shared with more people who made that program with commercial glaze and claimed some benefits which I found recently. Now they are asking more scripts because I have many programs to automate lots of tasks. How can I encrypt my scripts so people can use but not copy source code for own benefits.
What Python version you're decompiling? Py3k is not well supported, but there are quite a few decompilers for 2.x. One of the latest projects is this:
https://github.com/Mysterie/uncompyle2
It runs on Python 2.7 but supports decompiling 2.5 to 2.7.
Note that some commercial projects has been known to use modified Python interpreters. Modifications can include:
- bytecode files encryption
- changed opcode values or additional opcodes
- a heavily customized runtime (e.g. Stackless Python)
If you need to handle this, one approach is to convert non-standard bytecode to standard one and then use the usual decompilers (this apparently was used by the people from above project to decompile Dropbox code). Another is to change the decompiler to directly support the variations.
You might find pyREtic from Immunity to be useful. The presentation from BlackHat USA 2010 on pyREtic is here (YouTube).
pyREtic
Reverse Engineer Obfuscated Python Bytecode This toolkit allows you to take a object in memory back to source code, without needing access to the bytecode directly on disk. This can be useful if the applictions pyc's on disk are obfuscated in one of many ways.
Pyinstaller optionally encrypts the python sources with a very strong method.
Of course without the key it is nearly impossible to extract the files.
BUT the sources still need to be accessed at run time or the program couldn't work (or someone would have to provide the password each time, like protected excel files for instance).
It means that the key lies somewhere embedded in the installed software. And since all this stuff is open source, looking at the source code tells you where PyInstaller embeds the key. Of course, it's not trivial, but not an encryption-breaking problem, just reverse engineering with - added - the source available.
Jean-Francois' answer above is correct - the encryption key has to be distributed with the executable somewhere or it couldn't self-decrypt when running.
According to a reverse engineering blog, the key is distributed in one of the .pyc files which is generated when building the executable. De-compiling this file may allow access to the key, which could then be used to decrypt the code at rest. (Since that blog is from 2017, the location he talks about may have changed, but it remains the case that the key has to be in there somewhere)
» pip install uncompyle6
You just need to search online. Anyways here are some python 2.4 decompilers worth trying,
- decompyle - http://murphey.org/code/decompyle-2.4.tgz
- pycdc - https://github.com/zrax/pycdc
- depython - http://depython.com/
- decompyle service - http://www.crazy-compilers.com/decompyle/
- Python-Decompiler - https://gitorious.org/python-decompiler
Note : Easy Python Decompiler (written by me) uses pycdc as the backend.
There is a perfect open-source Python (.PYC) decompiler, called Decompyle++ https://github.com/zrax/pycdc/
Decompyle++ aims to translate compiled Python byte-code back into valid and human-readable Python source code. While other projects have achieved this with varied success, Decompyle++ is unique in that it seeks to support byte-code from any version of Python.
Online version is also available: http://www.javadecompilers.com/pyc (currently non-functional)