Svenskithesource / PyArmor-Unpacker

A deobfuscator for PyArmor.
GNU General Public License v3.0
536 stars 75 forks source link

Unsafe way of stopping the marshal.loads hook #9

Closed Svenskithesource closed 2 years ago

Svenskithesource commented 2 years ago

Right now we use a pretty bad way of detecting if the marshal.loads should be ran or stopped. We check if the dump folder exists, this is an issue because when the folder is left over from a previous run it will cause the hook to never stop the execution of the obfuscated program, which is the whole point of the static unpacker.