search

extremecoders-re / bytecode_simplifier

A generic deobfuscator for PjOrion obfuscated python scripts
https://0xec.blogspot.com/2017/07/deobfuscating-pjorion-using-bytecode.html
102 stars 38 forks source link

EXTENDED_ ARG instruction not supported #9

Open hasikill opened 3 years ago

hasikill commented 3 years ago

Exception: EXTENDED_ARG not yet implemented

abel1502 commented 3 years ago

Duplicate of #2.

Brielfy: I've fixed it here, but those changes weren't yet incorporated into the original repo

AGPonomarev commented 2 years ago

Duplicate of #2.

Brielfy: I've fixed it here, but those changes weren't yet incorporated into the original repo

Hello, did you manage to unpack the mod WoT?

abel1502 commented 2 years ago

Duplicate of #2. Brielfy: I've fixed it here, but those changes weren't yet incorporated into the original repo

Hello, did you manage to unpack the mod WoT?

I actually found out that I had been dealing with a combined use of several obfuscators, so this tool wasn't sufficient. I ended up extracting the mod from the imported modules cache directly, via another mod

AGPonomarev commented 2 years ago

I ended up extracting the mod from the imported modules cache directly, via another mod

Is there a guide or article on how to do this?

abel1502 commented 2 years ago

I ended up extracting the mod from the imported modules cache directly, via another mod

Is there a guide or article on how to do this?

Nope, I don't think there is. At least I don't know of one. I just experimented with what I can get from inside the same pyton interpreter as the mod. If you'd like to have a go at this yourself, good points to get started at are sys.modules and gc.get_objects(). Another strategy is to overwrite some library functions/classes and then go up the traceback via inspect's methods. I'm sorry, but I don't have spare time in the foreseeable future to get into greater details or write a tutorial, but I had some plans to encapsulate it into some sort of toolkit. Don't expect it to be soon neither, though

UPD: Also, I just came up with another idea of using sys.addaudithook() for this cause. It might actually be the simplest one, now that I think of it