HOW TO REVERSE PYARMOR
ANYONE THAT DOESN'T LIKE WILL BE REPORTED FOR LEECHING!
ANYONE THAT DOESN'T LIKE WILL BE REPORTED FOR LEECHING!
[ Hidden Content! ]
1. Use pyinstxtractor.py to extract the executable in Python 3.7
2. Using the extracted files, create the following directory structure
.
|-- martisor.pyc
`-- pytransform
|-- __init__.py
|-- _pytransform.dll
|-- license.lic
`-- pytransform.key
1 directory, 5 filesFor running on Linux, you need _pytransform.so downloadable from https://pyarmor.dashingsoft.com/platforms.html
3. Install psutil using pip (Required for pyarmor). From now on, you can just run (your program).pyc.
4. pyarmor encrypts the code objects on disk and they are only decrypted at runtime just before they are executed. The entire logic is implemented in _pytransform.dll. There are anti-debugging/timing checks to prevent us from using a debugger to dump code objects from memory. But there's no need to use a debugger at all when CPython itself is open source.![[Image: default_smile.png]](https://patched.to/pbb-proxy/UUNCQ0JeTUoCWEMQDEtNQBJEVk5XRRdWXF5ORRZcWQRdRBlWXAsWDAdYXxZOAVxTB0IOQ2dDVFxfVk9ACFc-/default_smile.png)
5. Compile Python 3.7 from source. Modify the _PyEval_EvalFrameDefault function such that it dumps the code object to disk. By doing so we do not need to bother about all the anti-debugging and encrypted stuff. This is because pyarmor decrypts the code object in memory before it hands it to the Python VM for execution.
6. Run strings on the dumped code object. We get many base64 strings. Like this one: CkdFTkVSQVRFLUtFWS0wWDcyR09ELVVOUEFDS01FCg==
7. Base64 decode and profit!
2. Using the extracted files, create the following directory structure
.
|-- martisor.pyc
`-- pytransform
|-- __init__.py
|-- _pytransform.dll
|-- license.lic
`-- pytransform.key
1 directory, 5 filesFor running on Linux, you need _pytransform.so downloadable from https://pyarmor.dashingsoft.com/platforms.html
3. Install psutil using pip (Required for pyarmor). From now on, you can just run (your program).pyc.
4. pyarmor encrypts the code objects on disk and they are only decrypted at runtime just before they are executed. The entire logic is implemented in _pytransform.dll. There are anti-debugging/timing checks to prevent us from using a debugger to dump code objects from memory. But there's no need to use a debugger at all when CPython itself is open source.
5. Compile Python 3.7 from source. Modify the _PyEval_EvalFrameDefault function such that it dumps the code object to disk. By doing so we do not need to bother about all the anti-debugging and encrypted stuff. This is because pyarmor decrypts the code object in memory before it hands it to the Python VM for execution.
6. Run strings on the dumped code object. We get many base64 strings. Like this one: CkdFTkVSQVRFLUtFWS0wWDcyR09ELVVOUEFDS01FCg==
7. Base64 decode and profit!