24 ms·
Not to deobfuscate, but Rizin[1][2] supports disassembling the Python bytecode for both 2.x and 3.x versions out of the box. [1] https://rizin.re https://rizin
by xvilka 5y ago
Not to deobfuscate, but Rizin[1][2] supports disassembling the Python bytecode for both 2.x and 3.x versions out of the box.
[1] https://rizin.re https://rizin.re
[2] https://github.com/rizinorg/rizin https://github.com/rizinorg/rizin
- landr0id 5y agoI haven't heard of this tool before, but I don't think it would work for obfuscated code. Check out the graph image on my wiki [1]. While this image doesn't show the exact scenario, imagine that the first instruction is a `JUMP_ABSOLUTE 100` and the rest of the instructions between offset [3,100) are just garbage or invalid. A naive disassembler (like the `dis` module in python) interprets the bytecode linearly -- i.e. one instruction after another. Rizin's diassembler [2] seems to take the same approach. The way I do disassembly is to only disassemble code paths that are potentially executed by queueing non-conditional jumps, both targets of a conditional jump, and the next instruction when the current instruction is non-jumping instruction. [1] https://github.com/landaire/unfuck/wiki/Obfuscation-Tricks https://github.com/landaire/unfuck/wiki/Obfuscation-Tricks [2] https://github.com/rizinorg/rizin/blob/e3d1b967854c33cf9dfbbfa58e9da16b2525a881/librz/asm/arch/pyc/pyc_dis.c#L35 https://github.com/rizinorg/rizin/blob/e3d1b967854c33cf9dfbb...
- sharikone 5y agoRizin is basically the name of a fork of Radare2 disassembler after the community had particularly nasty "value" disagreements.
- xvilka 5y agoWe have diverged quite a lot already, it's not a simple rename etc. See https://news.ycombinator.com/item?id=27830230 https://news.ycombinator.com/item?id=27830230
- xvilka 5y agoThanks for the details, we will look into that.