We should not confuse this with general malware packing, where the goal is to hide malicious code from analysts and security tools. (Note: I use the terms packaging, packing, and bundling interchangeably.) The goal of packaging a python program is to create an executable that can run independently on an operating system. Unpacking and decompiling on Linux after python version 3.9ĭifferentiating between the older and newer python versions is important since a lot changed after python 3.9, both in how python bytecode is generated and how (and whether) the source code can be recovered.įirst of all, let’s discuss what python packaging is-and specifically, PyInstaller.Unpacking and decompiling on Windows below python version 3.9.In this blog post, we are going to go through the following topics:

But since then, new python versions have come out and the unpacking techniques have changed. And if we talk about malware, the question always come up, “how can we unpack and decompile the malware to look at its python source code?” I discussed this topic in a video I created two years ago. Python malware is also distributed as such packed executables. To help with that, a couple of projects were created that can bundle a python program with all its dependencies into an executable file: Portable Executable (PE) on Windows and Executable and Linkable Format (ELF) on Linux/Unix.

This is easy if one runs their own python code however, it is rather cumbersome to deliver commercial products this way. Traditional programs written in the python programming language are distributed as source code and the python interpreter is used to run them.

Pyinstaller windows