├── PyArmorDeobfuscator.py └── README.md /PyArmorDeobfuscator.py: -------------------------------------------------------------------------------- 1 | import argparse,sys,os,uncompyle6,py_compile 2 | 3 | def find_pytransform__init__file(file): # please make sure you have _pytransform.dll and __init__.py in /dist/pytransform/ directory !!! 4 | if os.path.isfile(file): 5 | dir = os.path.dirname(os.path.realpath(file)) 6 | if os.path.isfile(dir + '/dist/pytransform/_pytransform.dll'): 7 | if os.path.isfile(dir + '/dist/pytransform/__init__.py'): 8 | return "True" 9 | else: 10 | return "[-] __init__.py file not found [-]" 11 | else: 12 | return "[-] _pytransform.dll file not found [-]" 13 | 14 | parser = argparse.ArgumentParser(description="[+] PyArmor Deobfuscator by u0pattern (Mohammed Muteb) [+]") 15 | parser.add_argument('-f', required=True, default=None, help='Add the Armor file [ex: obfuscated.py]') 16 | parser.add_argument('-o', required=True, default=None, help='Add the Output file [ex: deobfuscated.py]') 17 | args = vars(parser.parse_args()) 18 | result = find_pytransform__init__file(args['f']) 19 | if result == "True": 20 | # Compile to Byte Code 21 | # https://docs.python.org/2/library/py_compile.html 22 | # https://docs.python.org/3/library/py_compile.html 23 | py_compile.compile(args['f']) 24 | 25 | with open(args['o'], 'w') as output: 26 | # decompile the bytecode file using uncompyle6 27 | # https://pypi.org/project/uncompyle6/ 28 | # decompile_file function :- 29 | # https://github.com/rocky/python-uncompyle6/blob/master/uncompyle6/main.py#L166 30 | theDecompiler = uncompyle6.decompile_file(args['f']+'c', output) 31 | os.remove(args['f']+'c') 32 | print("[+] the deobfuscated code saved here "+os.path.dirname(os.path.realpath(args['o']))+"/"+args['o']+" [+]") 33 | 34 | else: 35 | print(result) 36 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # PyArmor Deobfuscator 2 | PyArmor Deobfuscator is a tool that helps to deobfuscate [PyArmor](https://pypi.org/project/pyarmor/)-based obfuscated python scripts. 3 | 4 | # Requirements 5 | install [uncompyle6](https://pypi.org/project/uncompyle6/):
6 | `pip install uncompyle6` 7 | 8 | # Usage 9 | ``` 10 | ~$ ./PyArmorDeobfuscator.py -f [Obfuscated File] -o [Output file] 11 | ~$ ./PyArmorDeobfuscator.py -f obfuscatedFile.py -o deobfuscatedFile.py 12 | --------------------------------------------------------------------------------