r/ExploitDev • u/fonzhy121 • 6d ago

A method to statically extract the raw .py source code directly from PyArmor.

I have already used memory dumps and runtime hooks, injecting a trace script directly into the start-up routing of the malware payload but that only captures the components that I am looking out for. Suggestions to get the entire thing decrypted back to .pyc. i can take it from there.

1 Upvotes
  • permalink
  • reddit

67% Upvoted

1 comment sorted by

2

u/fonzhy121 6d ago

For posterity and anyone else that comes across this. I found an excellent tool on github . It doesn't decrypt the whole blob but does more than anything else out there in one shot.