Svenskithesource / PyArmor-Unpacker

A deobfuscator for PyArmor.
GNU General Public License v3.0
493 stars 73 forks source link

restrict bypass not working anymore #28

Closed motebaya closed 1 year ago

motebaya commented 1 year ago

when i'm trying to bypass bootstrap restrict mode in python3.8, why always failed ? on cmd show like this:

Python 3.8.10 (tags/v3.8.10:3d8993a, May  3 2021, 11:48:03) [MSC v.1928 64 bit (AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import restrict_bypass
[+] _pytransform.dll loaded at 0x70a00000
[+] Setting memory permissions
[+] Patching bootstrap restrict mode
[+] Restoring memory permission
[+] All done! Pyarmor bootstrap restrict mode disabled
>>> from pytransform import pyarmor_runtime
>>> pyarmor_runtime()
Check bootstrap restrict mode failed

nothing error but not working.

i find other way, using pdb its posible call pyarmor function without running the file.. like this:

D:\armor>python3.8 -m pdb wp.py
> d:\armor\wp.py(4)<module>()
-> from pytransform import pyarmor_runtime
(Pdb) n
> d:\armor\wp.py(5)<module>()
-> pyarmor_runtime()
(Pdb) n
> d:\armor\wp.py(6)<module>()
-> __pyarmor__(__name__, __file__, b'PYARMOR\x00\x00.....)
(Pdb) locals()
{'__name__': '__main__', ............... , '__armor__': <built-in function __armor__>, '__wraparmor__': <built-in function __wraparmor__>, '__pyarmor__': <built-in function __pyarmor__>, '__armor_enter__': <built-in function __armor_enter__>, '__armor_exit__': <built-in function __armor_exit__>, '__armor_wrap__': <built-in function __armor_wrap__>}, 'pyarmor_runtime': <function pyarmor_runtime at 0x000002735D03BF70>}
(Pdb) __armor_enter__
<built-in function __armor_enter__>

but how to get currenrt frame list like in file code.py even i'm trying to calll

sys._current_frames().values()

on pdb console, the file i called with pdb will going to running. do you have any other idea ? thanks.

motebaya commented 1 year ago

closed, using method 2 still work.