Svenskithesource / PyArmor-Unpacker

A deobfuscator for PyArmor.
GNU General Public License v3.0
493 stars 73 forks source link

Check license failed - bypass error #33

Closed aero-pro closed 1 year ago

aero-pro commented 1 year ago

Hi, first of all thank you for sharing your work!

I´m trying to reverse engineer an executable for windows. I found out its using python3.10 after analyzing its behavior with Process Hacker. So i went ahead and unpacked the .exe with pyinstxtractor ( https://github.com/extremecoders-re/pyinstxtractor ). I found my entry point called main.pyc which i then decompiled using pycdc ( https://github.com/zrax/pycdc ). So far so good, the code is somewhat readable and i found out, its obfuscated with pyarmor. image At this point i came across your tool and thought about giving it a shot and... here i am. Unfortunately i got some errors. At first missing module pytransform.py and after copying it into the same directory this was fixed. Sadly then i got the error missing file _pytransform.so. I got the _pytransoform.so from the pyarmor´s core library for my x64 system ( https://github.com/dashingsoft/pyarmor-core ).

Now running the code again i´m stuck here: image

It turns out, the file(main.pyc) i try to deobfuscate does´nt run at all, because it gives back the same error as before - Check license failed, invalid input packet.

Any ideas on how to proceed here now?

Svenskithesource commented 1 year ago

Does the program work if you run it like a normal script?

aero-pro commented 1 year ago

If i run it as a normal script i get the same error. I also tried switching to windows and then my problems shift to missing modules again.

Svenskithesource commented 1 year ago

If you get the same error when you run it, it means the license has expired. You can patch the _pytransform.dll to skip the license check. This will require some native patching knowledge.