Bundles all this with a stub that first unpacks these files to disk or memory and then executes the original python code with the included interpreter.

libpython3.9.so.1.0 on Linux or python37.dll on Windows)

Includes the operating system-dependent python interpreter (i.e.

Collects all python compiled source code and python dependencies.

When we bundle a python program, the tool that we use for packaging, such as PyInstaller, does the following: It is only a side-effect of the packaging.

Python packaging does not intend to provide any security or obfuscation. We should not confuse this with general malware packing, where the goal is to hide malicious code from analysts and security tools. (Note: I use the terms packaging, packing, and bundling interchangeably.) The goal of packaging a python program is to create an executable that can run independently on an operating system. Unpacking and decompiling on Linux after python version 3.9ĭifferentiating between the older and newer python versions is important since a lot changed after python 3.9, both in how python bytecode is generated and how (and whether) the source code can be recovered.įirst of all, let’s discuss what python packaging is-and specifically, PyInstaller.Unpacking and decompiling on Windows below python version 3.9.In this blog post, we are going to go through the following topics: But since then, new python versions have come out and the unpacking techniques have changed. And if we talk about malware, the question always come up, “how can we unpack and decompile the malware to look at its python source code?” I discussed this topic in a video I created two years ago.

Python malware is also distributed as such packed executables. To help with that, a couple of projects were created that can bundle a python program with all its dependencies into an executable file: Portable Executable (PE) on Windows and Executable and Linkable Format (ELF) on Linux/Unix. This is easy if one runs their own python code however, it is rather cumbersome to deliver commercial products this way.

Traditional programs written in the python programming language are distributed as source code and the python interpreter is used to run them.

Windows py