extremecoders-re / pyinstxtractor

PyInstaller Extractor

PyInstaller Extractor

PyInstaller Extractor is a Python script to extract the contents of a PyInstaller generated executable file.

The header of the pyc files are automatically fixed so that a Python bytecode decompiler will recognize it. The script can run on both Python 2.x and 3.x. PyInstaller versions 2.0, 2.1, 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.5.1, 4.6, 4.7, 4.8, 4.9, 4.10, 5.0, 5.0.1, 5.1, 5.2, 5.3, 5.4, 5.4.1, 5.5, 5.6, 5.6.1, 5.6.2, 5.7.0, 5.8.0, 5.9.0, 5.10.0, 5.10.1, 5.11.0, 5.12.0, 5.13.0, 5.13.1, 5.13.2, 6.0.0, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.5.0, 6.6.0 are tested & supported. Probably will work with other versions too.

This project was originally hosted on SourceForge.

Usage

The script can be run by passing the name of the exe as an argument.

$ python pyinstxtractor.py <filename>
X:\>python pyinstxtractor.py <filename>

It is recommended to run the script in the same version of Python which was used to generate the executable. This is to prevent unmarshalling errors(if any) while extracting the PYZ archive.

Example

X:\> python pyinstxtractor.py test.exe
[+] Processing dist\test.exe
[+] Pyinstaller version: 2.1+
[+] Python version: 36
[+] Length of package: 5612452 bytes
[+] Found 59 files in CArchive
[+] Beginning extraction...please standby
[+] Possible entry point: pyiboot01_bootstrap.pyc
[+] Possible entry point: test.pyc
[+] Found 133 files in PYZ archive
[+] Successfully extracted pyinstaller archive: dist\test.exe

You can now use a python decompiler on the pyc files within the extracted directory

After extracting the pyc's you can use a Python decompiler like Uncompyle6 and Decompyle++.

X:\> uncompyle6.exe test.exe_extracted\test.pyc
X:\> uncompyle6.exe test.exe_extracted\PYZ-00.pyz_extracted\__future__.pyc

Extracting Linux ELF binaries

Pyinstxtractor can natively extract Linux ELF binaries without requiring other tools.

For other questions and information, please see the Wiki and the FAQ

See also

• pyinstxtractor-ng: A standalone binary version of pyinstxtractor. This tool doesn't require Python to run and can extract all supported versions of PyInstaller. It also supports encrypted pyinstaller executables.
• pyinstxtractor-web: pyinstxtractor running in the web browser, powered by Go & GopherJS.

License

GNU General Public License v3.0

pyinstxtractor's Issues

cant open exe

Hey so I ran the code and it didn't work for some reason it says can't open exe screenshot here

[!] Error : Missing cookie, unsupported pyinstaller version or not a pyinstaller archive

im having a error [!] Error : Missing cookie, unsupported pyinstaller version or not a pyinstaller archive does anyone have a fix for this?

Correct python version in pyc header

Hi,

When one launches pyinstxtractor with a python interpetor that has a different version than the one used in the packed python script, then the header of the current used python version is put in the pyc header instead of the version packed.

As this seems to be intentional, what is the reason for this?

It is checked here:

 if pyc_magic != pycHeader:
                print('[!] Warning: This script is running in a different Python version than the one used to build the executable.')
                print('[!] Please run this script in Python {0}.{1} to prevent extraction errors during unmarshalling'.format(self.pymaj, self.pymin))
                print('[!] Skipping pyz extraction')
                return

but when writing the file we could just put pycHeader instead of pyc_magic and it would solve the python version problem.

pycFile.write(pyc_magic)    #why not use pycHeader here?

I understand it may not be unmarshalled in some cases but at least the generated pyc file would be correct.

Unable to extract pyc files

Unable to extract pyc files for malware MD5: bbf630ca23976ddf8a561ccdb477c73d.
Seems like current script is not finding pyinstaller magic number which is there in file (one byte before in 2.1 offset). I tried to manually change the offset in the script but it is crashing in later code. Can you please check and confirm whether this is due to structure change or malware trick to bypass extraction of files.
Thanks in advance :)

Create release / tag on github

Hello! I'm package maintainer of Parrot OS and I want to create a Debian package of your tool on our repository. To make Debian package, it is easier for us if you have releases / tags that have source code in tarball files. So we can update newer version with uscan easily.

How can i decompile encrypted pyc files with key?

I have a key, but it seems that pyinstxtractor doesn't support it yet. Will it be created in future updates?

SyntaxError

Hi!
I got this error when I try to use this extractor:

E:\Temp\test>python.exe pyinstxtractor.py Cookie test.exe
File "pyinstxtractor.py", line 8

^
SyntaxError: invalid syntax

Deparsing stopped due to parse error

Hi there, thanks for your work.

Deparsing stopped due to parse error

I'm getting this error when trying to decode an .exe file via uncompyle6. What causes this issue?
I have uploaded the zip file here if you want to have a look: [link removed]

Installed python version: 3.8.0
OS: Windows 10

pyc magic maybe wrong

When I use python3.7 to run the script, it will get python 3.7's pyc magic.
The exe genereated by pyinstaller may use other python version.
Notice that the python version can be identified:

[+] Python version: 34

So maybe it's a good idea to change the pyc magic fix method.

Here is some pyc magic:
https://github.com/google/pytype/blob/master/pytype/pyc/magic.py

Here is a sample I used.
src.zip

extract failed

> python pyinstxtractor.py linux_x64
[+] Processing linux_x64
[+] Pyinstaller version: 2.1+
[+] Python version: 27
[+] Length of package: 55915 bytes
Traceback (most recent call last):
  File "pyinstxtractor.py", line 390, in <module>
    main()
  File "pyinstxtractor.py", line 378, in main
    arch.parseTOC()
  File "pyinstxtractor.py", line 210, in parseTOC
    self.fPtr.read(entrySize - 4))
struct.error: unpack requires a string argument of length 576508212

The binary may have been confusion

linux_x64.zip

HELP me pls with cookie

[!] Error : Missing cookie, unsupported pyinstaller version or not a pyinstaller archive

help meee :))

Not working on 4.0

[!] Error : Unsupported pyinstaller version or not a pyinstaller archive

pyinstaller --version
4.0

extraction fails with executable made with --onefile option.

first of all - thank you for this amazing tool!

script fails to extract anything from this executable (MALICIOUS), seemingly because it was compiled using the --onefile option. when run, it throws the following error.
[!] Error : Missing cookie, unsupported pyinstaller version or not a pyinstaller archive

if this is just user error on my end, then I'm sorry :/

Use xdis.magics.versions to obtain opcode for proper version of Python

Suggest to use xdis.magics.versions for proper magic insertion in pyc files:

{b'\x02\x99\x99\x00': '1.0', b'\x03\x99\x99\x00': '1.1', b'\x89.\r\n': '1.3', b'\x04\x17\r\n': '1.4', b'\x99N\r\n': '1.5', b'\xfc\xc4\r\n': '1.6', b'\x87\xc6\r\n': '2.0', b'*\xeb\r\n': '2.1', b'-\xed\r\n': '2.2', b';\xf2\r\n': '2.3a0', b'E\xf2\r\n': '2.3a0', b'Y\xf2\r\n': '2.4a0', b'c\xf2\r\n': '2.4a3', b'm\xf2\r\n': '2.4b1', b'w\xf2\r\n': '2.5a0', b'\x81\xf2\r\n': '2.5a0', b'\x8b\xf2\r\n': '2.5a0', b'\x8c\xf2\r\n': '2.5a0', b'\x95\xf2\r\n': '2.5b3', b'\x9f\xf2\r\n': '2.5b3', b'\xa9\xf2\r\n': '2.5c1', b'\xb3\xf2\r\n': '2.5c2', b'\xb7\xf2\r\n': '2.5dropbox', b'\xc7\xf2\r\n': '2.6a0', b'\xd1\xf2\r\n': '2.6a1', b'\xdb\xf2\r\n': '2.7a0', b'\xe5\xf2\r\n': '2.7a0+1', b'\xef\xf2\r\n': '2.7a0+2', b'\xf9\xf2\r\n': '2.7a0+3', b'\x03\xf3\r\n': '2.7', b'a\n\r\n': '2.7pyston-0.6.1', b'\n\xf3\r\n': '2.7pypy', b'\xb8\x0b\r\n': '3.000', b'\xc2\x0b\r\n': '3.000+1', b'\xcc\x0b\r\n': '3.000+2', b'\xd6\x0b\r\n': '3.000+3', b'\xe0\x0b\r\n': '3.000+4', b'\xea\x0b\r\n': '3.000+5', b'\xf4\x0b\r\n': '3.000+6', b'\xf5\x0b\r\n': '3.000+7', b'\xff\x0b\r\n': '3.000+8', b'\t\x0c\r\n': '3.000+9', b'\x13\x0c\r\n': '3.000+10', b'\x1d\x0c\r\n': '3.000+11', b'\x1f\x0c\r\n': '3.000+12', b"'\x0c\r\n": '3.0a4', b';\x0c\r\n': '3.0a5', b'E\x0c\r\n': '3.1a0', b'O\x0c\r\n': '3.1a0+', b'X\x0c\r\n': '3.2a0', b'b\x0c\r\n': '3.2a1', b'l\x0c\r\n': '3.2a2', b's\x0c\r\n': '3.2pypy', b'v\x0c\r\n': '3.3a0', b'\x80\x0c\r\n': '3.3a0+', b'\x94\x0c\r\n': '3.3a1', b'\x8a\x0c\r\n': '3.3a2', b'\x9e\x0c\r\n': '3.3a4', b'\xb2\x0c\r\n': '3.4a1', b'\xbc\x0c\r\n': '3.4a1+1', b'\xc6\x0c\r\n': '3.4a1+2', b'\xd0\x0c\r\n': '3.4a1+3', b'\xda\x0c\r\n': '3.4a4', b'\xe4\x0c\r\n': '3.4a4+', b'\xee\x0c\r\n': '3.4rc2', b'\xf8\x0c\r\n': '3.5a0', b'\x02\r\r\n': '3.5b1', b'\x0c\r\r\n': '3.5b2', b'\x16\r\r\n': '3.5', b'\x17\r\r\n': '3.5.2', b' \r\r\n': '3.6a0', b'!\r\r\n': '3.6a0+1', b'*\r\r\n': '3.6a1', b'+\r\r\n': '3.6a1+1', b',\r\r\n': '3.6a1+2', b'-\r\r\n': '3.6b1', b'/\r\r\n': '3.6b1+1', b'0\r\r\n': '3.6b1+2', b'1\r\r\n': '3.6b1+3', b'2\r\r\n': '3.6b2', b'3\r\r\n': '3.6rc1', b'>\r\r\n': '3.7.0alpha0', b'?\r\r\n': '3.7.0alpha3', b'@\r\r\n': '3.7.0beta2', b'A\r\r\n': '3.7.0beta3', b'B\r\r\n': '3.7.0', b'H\r\r\n': '3.8.0a1', b'I\r\r\n': '3.8.0a3+', b'R\r\r\n': '3.8.0a1+', b'S\r\r\n': '3.8.0b2+', b'T\r\r\n': '3.8.0beta2', b'U\r\r\n': '3.8.0rc1+', b'\\\r\r\n': '3.9.0a0', b']\r\r\n': '3.9.0a0', b'^\r\r\n': '3.9.0alpha1', b'_\r\r\n': '3.9.0a0', b'`\r\r\n': '3.9.0a2', b'a\r\r\n': '3.9.0beta5', b'0\x00\r\n': '3.2a2', b'@\x00\r\n': '3.3pypy', b'p\x00\r\n': '3.5pypy', b'\xa0\x00\r\n': '3.6.1pypy', b'\xc0\x00\r\n': '3.6pypy', b'\xf3\x03\r\n': '2.7.1b3Jython', b'zV\r\n': '2.7.7Pyston'}

Error : Missing cookie - Need file detection

Sorry to bother you with basic things - but I assume the attached exe should be packed with pyinstaller - but the xtractor does not accept it.

Could you take a closer look?

python pyinstxtractor.py app.exe
[+] Processing app.exe
[!] Error : Missing cookie, unsupported pyinstaller version or not a pyinstaller archive

https://www.mediafire.com/file/mg5dgslaiatp0o3/app.exe/file

Or is kind ob obfuscated to trick the xtractor?

Can't decompile

I tried to decompile a exe via pyinstxtractor but it resulted in an error.

If you want to take a look at it here is the file:

https://www.mediafire.com/file/1mdv3imid2bxskd/Wanting_to_decompile.exe/file

python 3.9.x not work

please add support python 3.9.x

Failed to create process

[+] Processing slime.exe
[+] Pyinstaller version: 2.1+
[+] Python version: 39
[+] Length of package: 7711006 bytes
[+] Found 76 files in CArchive
[+] Beginning extraction...please standby
[+] Possible entry point: pyiboot01_bootstrap.pyc
[+] Possible entry point: pyi_rth_pkgutil.pyc
[+] Possible entry point: pyi_rth_multiprocessing.pyc
[+] Possible entry point: pyi_rth_inspect.pyc
[+] Possible entry point: pyi_rth_certifi.pyc
[+] Possible entry point: slime.pyc
[+] Found 341 files in PYZ archive
[*] Successfully extracted pyinstaller archive: slime.exe

[>] Decompyle...

failed to create process.

Modified pyinstaller

Hello!

I have modified pyinstaller ELF. Can you take a look please?
Thanks!

https://1drv.ms/u/s!AhPkgOPZ3CoFgbNCKsqJ08aaNjBlPg?e=hWQGtt

Filed to unpack linux executable file

[+] Processing .\LaunchProggram
[+] Pyinstaller version: 2.0
[+] Python version: 309
[+] Length of package: 10842163 bytes
Traceback (most recent call last):
File "C:\Users\csord\Downloads\pyinstxtractor-master\pyinstxtractor.py", line 417, in
main()
File "C:\Users\csord\Downloads\pyinstxtractor-master\pyinstxtractor.py", line 405, in main
arch.parseTOC()
File "C:\Users\csord\Downloads\pyinstxtractor-master\pyinstxtractor.py", line 235, in parseTOC
struct.unpack(
struct.error: unpack requires a buffer of 6925863 bytes

The correct Python version was not obtained

use python 3.6.0 version, self.pyver value is 306, This causes to add the wrong magic number

Any way to replace a file?

Ok so basically the program i'm trying to mess with is from 3.9, using pyinstaller 4.8, i managed to extract it just fine, but since i can't decompile the files anyways, i just wanted to replace the cacert.pem from certifi to use my own fiddler signed cert, is there any way i can just replace that file on the .exe or any way to recompile the .exe with it replaced? (straight up running pyinstaller main.pyc throw me errors)

Missing encrypted files after successful extract

I’m trying to extract a PYZ that I know it should contains *.pyc.encrypted files. The extraction finished without any errors but those files are missing, what could be the reason for that?

cant decompile

with open(filename, 'wb+') as pycFile:

ValueError: embedded null character

Nothing can saw after running command

problem when finding cookie pos

it should be like this, not a fixed pos.
search_end should be start of signature info or file end.

bootloader code: pyi_archive.c
static int
pyi_arch_find_cookie(ARCHIVE_STATUS *status, int search_end)
{
    int search_start = search_end - SEARCH_SIZE;
    char buf[SEARCH_SIZE];
    char * search_ptr = buf + SEARCH_SIZE - sizeof(COOKIE);

    if (fseek(status->fp, search_start, SEEK_SET)) {
        return -1;
    }

    /* Read the entire search space */
    if (fread(buf, SEARCH_SIZE, 1, status->fp) < 1) {
        return -1;
    }

    /* Search for MAGIC within search space */

    while(search_ptr >= buf) {
        if(0 == strncmp(MAGIC, search_ptr, strlen(MAGIC))) {
            /* MAGIC found - Copy COOKIE to status->cookie */
            memcpy(&status->cookie, search_ptr, sizeof(COOKIE));

            /* From the cookie, calculate the archive start */
            status->pkgstart = search_start + sizeof(COOKIE) + (search_ptr - buf) - ntohl(status->cookie.len);

            return 0;
        }
        search_ptr--;
    }

    return -1;
}

your scripts may fail due to several tailing junk bytes while bootloader still works.

Error : Missing cookie, unsupported pyinstaller version or not a pyinstaller archive

Error : Missing cookie, unsupported pyinstaller version or not a pyinstaller archive

aarch64 ELF binaries

aarch64 ELF binaries can't extract
dna.zip

Correct Python Version

What Is The Python Version And How To Download It
Python version: 309

C:\Users\xapao\Desktop>python pyinstxtractor.py MEGATRON.exe
[+] Processing MEGATRON.exe
[+] Pyinstaller version: 2.1+
[+] Python version: 309
[+] Length of package: 19589023 bytes
[+] Found 75 files in CArchive
[+] Beginning extraction...please standby
[+] Possible entry point: pyiboot01_bootstrap.pyc
[+] Possible entry point: pyi_rth_subprocess.pyc
[+] Possible entry point: pyi_rth_pkgutil.pyc
[+] Possible entry point: pyi_rth_inspect.pyc
[+] Possible entry point: pyi_rth_multiprocessing.pyc
[+] Possible entry point: pyi_rth_win32api.pyc
[+] Possible entry point: pyi_rth_win32comgenpy.pyc
[+] Possible entry point: MEGATRON.pyc
[!] Warning: This script is running in a different Python version than the one used to build the executable.
[!] Please run this script in Python309 to prevent extraction errors during unmarshalling
[!] Skipping pyz extraction
[+] Successfully extracted pyinstaller archive: MEGATRON.exe

You can now use a python decompiler on the pyc files within the extracted directory

I have error with pyinstxtractor

The problem is that when i trying to extract exe gives error
Evey time
Im on kali linux
Is there any missing commands to do
Requirements ??

The behavior of finding magic pattern didn't match the original one.

According to the source code of pyinstaller, the bootloader find the MAGIC pattren by searching from end to front but not the fixed end-of-file offset.

This Script Works also For Linux executables created with PyInstaller!

Decompiling larger projects

I'm trying to extract one executable, which had arguments that linked an entire project. Ex: It imports api from utils.api. Where can i find this data?

Help!

i have a problem pls help

unsupported pyinstaller i installed every single ver and still this problem

PYZ file didnt extract

I used the script to some exe but the "PYZ-00.pyz_extracted" folder is empty and i dont really know what to do about it

这份代码似乎依然在一些 exe 的反编译上有问题

当我使用最新版本的 pyinstxtractor.py 时，我得到的 1.pyc 似乎依然没有一个正确的文件头，以至于当我使用 uncompyle6 时会报错：

~ uncompyle6 1.pyc 
Unknown type 0
Traceback (most recent call last):
  File "/home/temp/.local/bin/uncompyle6", line 11, in <module>
    sys.exit(main_bin())
  File "/home/temp/.local/lib/python2.7/site-packages/uncompyle6/bin/uncompile.py", line 194, in main_bin
    **options)
  File "/home/temp/.local/lib/python2.7/site-packages/uncompyle6/main.py", line 328, in main
    do_fragments,
  File "/home/temp/.local/lib/python2.7/site-packages/uncompyle6/main.py", line 230, in decompile_file
    do_fragments=do_fragments,
  File "/home/temp/.local/lib/python2.7/site-packages/uncompyle6/main.py", line 78, in decompile
    assert iscode(co), ("%s does not smell like code" % co)
AssertionError: None does not smell like code

我使用的 exe 文件可以在这里下载（ github 的 issue 似乎无法上传 exe 文件）

按照我的设想，根据 struct.pyc 的文件头可知正确的文件头应当是：

但使用此脚本反编译得到的 1.pyc 的文件头却是：

我使用的反编译命令是：python3 pyinstxtractor.py pyre.exe，它看起来很正常。

我使用 010editor 这个16进制编辑器查看了这两个 pyc 文件，上面的两种图片即来自于此。

PyInstaller versions prior to 3.2 do not pre-compile ARCHIVE_ITEM_PYSOURCE

Under the same typeCmprsData ('s') PyInstaller versions prior to 3.2 store Python source files (see issue 1847). They shouldn't be prefixed with pyc header.

I didn't (yet) find any way to detect if 's' file is compiled or not (PyInstaller version is unknown from file) - other than reading the first byte to check if it is marshalled code object ('c').

pack extract folder to exe again

is it possible to pack extract folder to exe again ?

use pyinstaller 4.3 and python 3.7 to build hello exectuable app,but pyinstxtractor extract failed

output message:[!] Error : Unsupported pyinstaller version or not a pyinstaller archive ,does pyinstractor support 4.3?

jump_back_index = self.offset2tok_index[jump_target]

PS C:\git\ActiveIQManager0603> uncompyle6 .\ActiveIQHealthManager.exe_extracted\ActiveIQHealthManager.pyc

uncompyle6 version 3.7.4

Python bytecode 3.8 (3413)

Decompiled from: Python 2.7.18 (v2.7.18:8d21aa21f2, Apr 20 2020, 13:25:05) [MSC v.1500 64 bit (AMD64)]

Warning: this version of Python has problems handling the Python 3 "byte" type in constants properly.

Embedded file name: ActiveIQHealthManager.py

Compiled at: 1995-09-28 00:18:56

Size of source mod 2**32: 272 bytes

Traceback (most recent call last):
File "c:\python27\lib\runpy.py", line 174, in _run_module_as_main
"main", fname, loader, pkg_name)
File "c:\python27\lib\runpy.py", line 72, in run_code
exec code in run_globals
File "C:\Python27\Scripts\uncompyle6.exe_main.py", line 7, in
File "c:\python27\lib\site-packages\uncompyle6\bin\uncompile.py", line 194, in main_bin
**options)
File "c:\python27\lib\site-packages\uncompyle6\main.py", line 324, in main
do_fragments,
File "c:\python27\lib\site-packages\uncompyle6\main.py", line 222, in decompile_file
do_fragments=do_fragments,
File "c:\python27\lib\site-packages\uncompyle6\main.py", line 141, in decompile
co, out, bytecode_version, debug_opts=debug_opts, is_pypy=is_pypy
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 2643, in code_deparse
deparsed.gen_source(deparsed.ast, co.co_name, customize)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 2461, in gen_source
self.text = self.traverse(ast, is_lambda=is_lambda)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 426, in traverse
self.preorder(node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 404, in preorder
super(SourceWalker, self).preorder(node)
File "c:\python27\lib\site-packages\spark_parser\ast.py", line 117, in preorder
self.preorder(kid)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 404, in preorder
super(SourceWalker, self).preorder(node)
File "c:\python27\lib\site-packages\spark_parser\ast.py", line 110, in preorder
func(node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 1448, in n_classdef
self.n_classdef36(node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\customize36.py", line 230, in n_classdef36
self.build_class(subclass_code)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 2437, in build_class
self.gen_source(ast, code.co_name, code._customize)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 2461, in gen_source
self.text = self.traverse(ast, is_lambda=is_lambda)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 426, in traverse
self.preorder(node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 404, in preorder
super(SourceWalker, self).preorder(node)
File "c:\python27\lib\site-packages\spark_parser\ast.py", line 117, in preorder
self.preorder(kid)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 404, in preorder
super(SourceWalker, self).preorder(node)
File "c:\python27\lib\site-packages\spark_parser\ast.py", line 110, in preorder
func(node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\customize35.py", line 215, in n_function_def
self.default(node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 2181, in default
self.template_engine(table[key.kind], node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 2087, in template_engine
self.preorder(node[index])
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 404, in preorder
super(SourceWalker, self).preorder(node)
File "c:\python27\lib\site-packages\spark_parser\ast.py", line 110, in preorder
func(node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 870, in n_mkfunc
self.make_function(node, is_lambda=False, code_node=code_node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\pysource.py", line 887, in make_function
make_function36(self, node, is_lambda, nested, code_node)
File "c:\python27\lib\site-packages\uncompyle6\semantics\make_function36.py", line 160, in make_function36
scanner_code = Code(code, self.scanner, self.currentclass)
File "c:\python27\lib\site-packages\uncompyle6\scanner.py", line 97, in init
self._tokens, self._customize = scanner.ingest(co, classname)
File "c:\python27\lib\site-packages\uncompyle6\scanners\scanner38.py", line 103, in ingest
jump_back_index = self.offset2tok_index[jump_target]
KeyError: 1830
PS C:\git\ActiveIQManager0603>

cant decompile

[+] Processing gen.exe
[!] Error : Missing cookie, unsupported pyinstaller version or not a pyinstaller archive

when i try with unpy2exe it say its a pyinstaller so im out of idea

Unable to decrypt using script in wiki

When using the code in wiki and changing the password

import glob
import zlib
import tinyaes
from pathlib import Path

CRYPT_BLOCK_SIZE = 16

# key obtained from pyimod00_crypto_key
key = bytes('MySup3rS3cr3tK3y', 'utf-8')

for p in Path("PYZ-00.pyz_extracted").glob("**/*.pyc.encrypted"):
	inf = open(p, 'rb') # encrypted file input
	outf = open(p.with_name(p.stem), 'wb') # output file 

	# Initialization vector
	iv = inf.read(CRYPT_BLOCK_SIZE)

	cipher = tinyaes.AES(key, iv)

	# Decrypt and decompress
	plaintext = zlib.decompress(cipher.CTR_xcrypt_buffer(inf.read()))

	# Write pyc header
	# The header below is for Python 3.8
	outf.write(b'\x55\x0d\x0d\x0a\0\0\0\0\0\0\0\0\0\0\0\0')

	# Write decrypted data
	outf.write(plaintext)

	inf.close()
	outf.close()

	# Delete .pyc.encrypted file
	p.unlink()

I get the following

Traceback (most recent call last):
  File "decrypt.py", line 21, in <module>
    plaintext = zlib.decompress(cipher.CTR_xcrypt_buffer(inf.read()))
zlib.error: Error -3 while decompressing data: incorrect header check

the environment is as below
Python 3.8.13
tinyaes 1.0.3

OSError: [WinError 123] The filename, directory name, or volume label syntax is incorrect: 'pyd-runtime-tmpdir C:'

Error is in the title. I have python 3.8.0 installed. pyinstxtractor says the python version of my file is 38. It also says pyinstaller version is 2.1+ I've also independently verified this exe was packaged by pyinstaller. I'm running the following command in an admin command shell in Win10:

python pyinstxtractor.py program.exe

Here is the traceback info:

Is it possible this is due to something the developer of the packaged script did in their file(s) or is this something on my end/pyinstxtractor?

Cannot get pyinstxtractor to work

I have an exe that was formatted in pyinstaller 4.9 and need it to be decompiled and it is saying that I cannot because of version or mising cookie

How to get the pyc of the submodule, I didn't see that I only saw the main module

ValueError: read length must be positive or -1

When used on a Mac binary, I get this error.
High Sierra 10.13.6

~/.pyenv/shims/python3 pyinstxtractor.py ./lights.app/Contents/MacOS/lights
[+] Processing ./lights.app/Contents/MacOS/lights
[+] Pyinstaller version: 2.0
[+] Python version: 36
[+] Length of package: 6690129 bytes
Traceback (most recent call last):
  File "pyinstxtractor.py", line 423, in <module>
    main()
  File "pyinstxtractor.py", line 411, in main
    arch.parseTOC()
  File "pyinstxtractor.py", line 237, in parseTOC
    self.fPtr.read(entrySize - 4))
ValueError: read length must be positive or -1

$~/.pyenv/shims/python3 --version
Python 3.6.5

Length of package more than 2147483647 bytes

Change:

struct.unpack('!8siiii64s', self.fPtr.read(self.PYINST21_COOKIE_SIZE))

To:

struct.unpack('!8sIIII64s', self.fPtr.read(self.PYINST21_COOKIE_SIZE))

Will solve this error:

[+] Pyinstaller version: 2.1+
[+] Python version: 3.7
-2089571957
[+] Length of package: -2089571957 bytes
[+] Found 4480 files in CArchive
[+] Beginning extraction...please standby
Traceback (most recent call last):
File "pyinstxtractor.py", line 456, in
main()
File "pyinstxtractor.py", line 445, in main
arch.extractFiles()
File "pyinstxtractor.py", line 279, in extractFiles
data = zlib.decompress(data)
zlib.error: Error -5 while decompressing data: incomplete or truncated stream

And these place, change to unsign int

nameLen = struct.calcsize('!IIIIBc')

(entryPos, cmprsdDataSize, uncmprsdDataSize, cmprsFlag, typeCmprsData, name) =
struct.unpack(
'!IIIBc{0}s'.format(entrySize - nameLen),
self.fPtr.read(entrySize - 4))

Failed to unpack exe

Hello, i got fail of unpacking.
Maybe pyinstaller 2.0 unpacker is broken

Getting assertion error after on uncompyle6

getting the following error on using uncompyle on the extracted pyc file:

Traceback (most recent call last):
  File "D:\python\Scripts\uncompyle6-script.py", line 11, in <module>
    load_entry_point('uncompyle6==3.7.4', 'console_scripts', 'uncompyle6')()
  File "D:\python\lib\site-packages\uncompyle6\bin\uncompile.py", line 193, in main_bin
    result = main(src_base, out_base, pyc_paths, source_paths, outfile,
  File "D:\python\lib\site-packages\uncompyle6\main.py", line 316, in main
    deparsed = decompile_file(
  File "D:\python\lib\site-packages\uncompyle6\main.py", line 208, in decompile_file
    decompile(
  File "D:\python\lib\site-packages\uncompyle6\main.py", line 140, in decompile
    deparsed = deparse_fn(
  File "D:\python\lib\site-packages\uncompyle6\semantics\pysource.py", line 2572, in code_deparse
    tokens, customize = scanner.ingest(
  File "D:\python\lib\site-packages\uncompyle6\scanners\scanner38.py", line 45, in ingest
    tokens, customize = super(Scanner38, self).ingest(
  File "D:\python\lib\site-packages\uncompyle6\scanners\scanner37.py", line 42, in ingest
    tokens, customize = Scanner37Base.ingest(self, co, classname, code_objects, show_asm)
  File "D:\python\lib\site-packages\uncompyle6\scanners\scanner37base.py", line 209, in ingest
    bytecode = self.build_instructions(co)
  File "D:\python\lib\site-packages\uncompyle6\scanner.py", line 132, in build_instructions
    self.insts = self.remove_extended_args(list(bytecode))
  File "D:\python\lib\site-packages\xdis\bytecode.py", line 234, in get_instructions_bytes
    argrepr = opc.opcode_arg_fmt[opc.opname[op]](arg)
  File "D:\python\lib\site-packages\xdis\opcodes\opcode_37.py", line 121, in format_RAISE_VARARGS
    assert 0 <= argc <= 2
AssertionError