Skip to content

Instantly share code, notes, and snippets.

View keyvanvafaee's full-sized avatar
💭
I may be slow to respond.

K.V keyvanvafaee

💭
I may be slow to respond.
View GitHub Profile
@stecman
stecman / dump-pyc-with-gdb.md
Last active March 25, 2024 09:20
Dumping all bytecode from a packaged Python application

This is a technique for extracting all imported modules from a packaged Python application as .pyc files, then decompiling them. The target program needs to be run from scratch, but no debugging symbols are necessary (assuming an unmodified build of Python is being used).

This was originally performed on 64-bit Linux with a Python 3.6 target. The Python scripts have since been updated to handle pyc files for Python 2.7 - 3.9.

Theory

In Python we can leverage the fact that any module import involving a .py* file will eventually arrive as ready-to-execute Python code object at this function:

PyObject* PyEval_EvalCode(PyObject *co, PyObject *globals, PyObject *locals);