Miscellaneous Backend Intermediate Pyarmor-Static-Unpack

[ZenithPulse]

Pyarmor Static Unpack 1shot
Pyarmor is a popular tool to protect Python source code. It turns Python scripts into binary data, which can be regarded as an encrypted variant of `.pyc` files. They can be decrypted by a shared library (`pyarmor_runtime`) and then executed by the Python interpreter.
This project aims to convert armored data back to bytecode assembly and, experimentally, source code. We forked the awesome Decompyle++ (aka pycdc) and added some processes to it, such as modifying the abstract syntax tree.

Important​

This tool should only be used on scripts you own or have permission to analyze. Please respect software licenses and terms of service. The author is not responsible for any misuse or damage caused by this tool.

Note​

Like other decompilers, this tool is intended for professional users. You should have a basic understanding of Python bytecode. If not, you may need to ask for help from someone who does.

Warning​

Disassembly results are accurate, but decompiled code can be incomplete and incorrect. See

You must be registered for see links

.

Features​

Static​

You don't need to execute the encrypted script. We decrypt the data using the same algorithm as `pyarmor_runtime`. This is useful when the scripts cannot be trusted.

Universal​

Currently, we are trying to support:

• Pyarmor 8.0 to 9.2.x (latest)
• Python 3.7 - 3.13
• All operating systems
• As many obfuscating options as possible

However, we only have limited tests. You can run this tool in any environment. It does not need to be the same environment as the obfuscated scripts or runtime.

Note​

If the data starts with `PY` followed by six digits, it is supported. Otherwise, if it starts with `PYARMOR`, it was generated by Pyarmor 7 or earlier and is not supported.

Easy to Use​

The only thing you need to do is specify where your obfuscated scripts are located. The tool does everything, including detecting armored data, parsing, disassembling, and decompiling. See the Usage section below.

Build​

mkdir build
cd build
cmake ../pycdc
cmake --build .
cmake --install .

You can also download prebuilt binary files from the

You must be registered for see links

releases page.

Usage​

python /path/to/oneshot/shot.py /path/to/scripts

Before running `shot.py`, make sure the executable `pyarmor-1shot` (`pyarmor-1shot.exe` on Windows) exists in the `oneshot` directory.
You only need to specify the directory that contains all armored data and `pyarmor_runtime`. The tool finds and handles them recursively as much as possible.
When necessary, specify a `pyarmor_runtime` executable with:

-r path/to/pyarmor_runtime[.pyd|.so|.dylib]

All files generated by this tool have `.1shot.` in their filenames. If you want to save them in another directory instead of in-place, use:

-o another/path/

The folder structure will remain unchanged.

Note​

Subdirectories will not be touched if:

• The folder name is exactly **pycache**.
• The folder name is site-packages.
• The folder directly contains a file named .no1shot.

Symbolic links will not be followed, to avoid repeated processing or infinite loops and to save time. If you really need to process these directories, run the script later in those directories and specify the runtime.
Archives, executables generated by PyInstaller, and similar files must be unpacked by other tools before decrypting. Otherwise, you may encounter undefined behavior.

Feedback​

Feel free to open an issue if you have any questions, suggestions, or problems. Don't forget to attach the armored data and the `pyarmor_runtime` executable if possible.

Project Status​

Current​

Bug fixes and minor improvements.
The author is trying to design and implement a new `.pyc` decompiler. After that, we can rewrite this tool with the new decompiler.
We will discard the current codebase based on pycdc. After the new code becomes stable, expected in 2027, we will reach version 1.0.0.

Before v1.0.0​

The project is already functioning well, so there is no need to wait for v1.0.0. The public API is still subject to change.
These are the features we are planning to implement before v1.0.0:

• Rewriting the codebase based on a new pyc decompiler. It will be more stable, maintainable, and extendable.
• A wiki about the Pyarmor decryption algorithm, including how we analyzed it and implemented it in this tool.
• The last piece of the puzzle: an analysis tool for the native part of BCC Mode, the hardest obfuscating option in Pyarmor.
• Packaging and distribution of the tool for installation from package managers such as pip.

Maybe there are not many things to do after v1.0.0. We will maintain the project and fix bugs if necessary.

Original Intention​

There are not many code protection tools for Python that are publicly available, and Pyarmor is one of the most popular ones.
However, when I (Lil-Ran) was analyzing some specific Pyarmor-protected scripts, I found it was not as difficult as I had imagined.
Just encrypting the code objects is not as irreversible as the project claims. To be honest, Python bytecode-based protection is much less secure than native-code-based protection.
We definitely do not make profits by cracking. We ourselves had no other uses for this tool, so we published it, hoping to let people know that Pyarmor with the default configuration is not as secure as they may think.
The Pyarmor algorithm has not been changed, even a year after this unpacking tool was released. Perhaps this is due to considerations of backward compatibility.
We guarantee that once the Pyarmor project changes the algorithm, we will not update this tool to support the new algorithm.
Currently existing code generated by supported versions of Pyarmor can always be decrypted by this tool.

For CTF Challenge Makers​

Please don't make CTF (Capture The Flag) REVERSE challenges that are about finding and using existing tools. It is not fun for anyone. It is more like a game of hide-and-seek rather than a test of skill and ingenuity.
It is more meaningful to understand how Pyarmor or this tool works and then try to improve them.

SRC​

You must be registered for see links

 

[encrypted]

you are boring with ur ai slop

 

[calloc0x75]

you are boring with ur ai slop

i agree + this is kinda useless

 

[ZenithPulse]

this is not mine

 

[Noumanxyohaan]

The static approach is probably the most interesting part here. Being able to analyze the armored data without executing the script makes it much safer for reverse-engineering work. The Pyarmor 8–9 support is pretty useful too.