BranchesTags

Latest commit

History

13 Commits

Folders and files

NameName
Last commit message
Last commit date
.gitattributes
.gitattributes
LICENSE
LICENSE
README.md
README.md

Repository files navigation

Awesome Python Reversing

A curated list of awesome Python reversing libraries, tools and resources.

Disassemblers

Python bytecode disassemblers.

  • dis - The built-in Python disassembler.
  • pyfalcon - A cross-version Python disassembler written in Rust. Has a web version.
  • xdis - A Python cross-version bytecode library and disassembler.
  • pycdas - A disassembler and decompiler written in C++ aiming to support all Python versions.

Decompilers

Python bytecode decompilers.

  • pylingual (web service) - An AI decompiler for multiple, more recent, Python versions. Has built-in output checking and is in general one of the better decompilers out there.
  • decompile3 - A Python decompiler aiming to support versions 3.7 - 3.8.
  • uncompyle6 - A Python decompiler aiming to support versions 1.0 - 3.8 (including Dropbox's Python 2.5 bytecode and some PyPy bytecodes).
  • pycdc - A disassembler and decompiler written in C++ aiming to support all Python versions. This decompiler is known to be unstable.
  • pycdc (snippet decompiler) - This tool decompiles individual snippets of Python bytecode as opposed to entire binary files, aiming to help manual decompilation of binaries that are unsupported by state-of-the-art Python decompilers.
  • unpyc3.7-3.10 - A fork of a decompiler which aims to support versions 3.7 - 3.10.

Debuggers

Python source code/bytecode debuggers.

  • pdb - The built-in Python interactive source debugger.
  • python3-trepan - A gdb-like debugger which supports both source code and bytecode debugging.
  • PyCharm's debugger - PyCharm has its own debugger which is considered to be one of the best.

Bytecode

Editors

Bytecode editors.

  • pySpy - This tool aims to make viewing and editing bytecode easier. Only works properly for version 3.9.
  • xdis - A Python cross-version bytecode library and disassembler. This library allows you to modify bytecode programmatically.

Manual analysis

Tools to assist with manual analysis of Python bytecode.

  • PyInjector - An injector for Windows that allows you to inject Python code into any Python process. It can be useful to expose variables, functions, grab code objects and many other things.
  • PythonForWindows - This library allows you to interact with windows but also lets you inject Python code into another Python process without needing to inject a dll yourself.
  • x-python - A Python implementation of the C interpreter. It can be useful to run bytecode instruction by instruction.
  • hypno - A cross-platform tool/library allowing to inject python code into a running python process. Can be installed through pip.

Python internals

Tools to inspect or modify Python internals.

  • inspect - A built-in library to inspect live objects. It gives information about objects like modules, classes, methods, functions, tracebacks, frame objects, and code objects. (Can be used along with Python injectors)
  • CPython - The CPython source code itself can often times be very useful to modify or trace.

Packers

Python packers that will package your Python project into an executable. This includes Python "compilers".

  • PyInstaller - PyInstaller is the most popular Python packager, supporting the platforms Windows, Linux and MacOS X.
  • py2exe - py2exe can package Python projects to an executable for Windows.
  • Cython - Cython is a superset of the Python language but can nonetheless compile Python code to a native program. It compiles the Python code to C code so any platform that has a C compiler should work.
  • Nuitka - This is also a compiler for Python that can generate executables. It officially supports Linux, FreeBSD, NetBSD, MacOS X, and Windows (32bits/64 bits/ARM).

Extractors

Tools that can extract packed Python executables.

  • pyinstxtractor - pyinstxtractor is the most popular extractor for PyInstaller. It supports almost all versions of PyInstaller. (pyinstxtractor-ng and pyinstxtractor-go might be worth checking out aswell.)
  • unpy2exe - unpy2exe is an extractor for py2exe but is not maintained anymore and likely will fail on newer versions of py2exe.
  • nuitka-extractor - An extractor for nuitka. This basically does the same thing as looking in the temp folder, but without actually running the executable.

Obfuscators

Python obfuscators.

  • Pyarmor - This is by far the most popular Python obfuscator. It supports Python 2 and 3 on Windows, Linux and MacOS X.
  • Nuitka - Nuitka isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand. The commercial version does have some extra protection features.
  • Cython - Cython isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand.
  • Hyperion - This obfuscator is unique since it's one of the only ones that actually transforms your Python code. Since it returns plain Python source code it can be used on any platform that has Python available.

The following obfuscators all work in similar ways: marshalling the original Python code and hiding it behind multiple layers of exec statements with potentionally some encryption/decryption.

Deobfuscators

Deobfuscators for Python obfuscators.

  • PyArmor-Unpacker - The most popular deobfuscator for the obfuscator Pyarmor. It only supports the free version of Pyarmor.
  • bonedensity - A deobfuscator for the obfuscator PyArmor. Supports both the free and the paid Super mode.
  • Pyarmor-Static-Unpack-1shot - A deobfuscator for the obfuscator Pyarmor 8.0 and above. Supports both free and pro versions.
  • Hyperion-deobfuscator - A deobfuscator for the obfuscator Hyperion.
  • nuitka-helper - Not a deobfuscator but a tool that does symbol recovery for Nuitka samples. Read the blog post linked in the README.

Resources

Educational resources for Python reverse engineering.

About

A curated list of awesome Python reverse engineering libraries, tools and resources

Resources

Readme
MIT license
Activity

Stars

89 stars

Watchers

2 watching

Forks

14 forks
Report repository

Releases

Packages

Contributors

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
BranchesTags
Latest commit
History
13 Commits
Folders and files
NameName
Last commit message
Last commit date
.gitattributes
.gitattributes
LICENSE
LICENSE
README.md
README.md
Repository files navigation
Awesome Python Reversing
A curated list of awesome Python reversing libraries, tools and resources.
Disassemblers
Python bytecode disassemblers.
  • dis - The built-in Python disassembler.
  • pyfalcon - A cross-version Python disassembler written in Rust. Has a web version.
  • xdis - A Python cross-version bytecode library and disassembler.
  • pycdas - A disassembler and decompiler written in C++ aiming to support all Python versions.
Decompilers
Python bytecode decompilers.
  • pylingual (web service) - An AI decompiler for multiple, more recent, Python versions. Has built-in output checking and is in general one of the better decompilers out there.
  • decompile3 - A Python decompiler aiming to support versions 3.7 - 3.8.
  • uncompyle6 - A Python decompiler aiming to support versions 1.0 - 3.8 (including Dropbox's Python 2.5 bytecode and some PyPy bytecodes).
  • pycdc - A disassembler and decompiler written in C++ aiming to support all Python versions. This decompiler is known to be unstable.
  • pycdc (snippet decompiler) - This tool decompiles individual snippets of Python bytecode as opposed to entire binary files, aiming to help manual decompilation of binaries that are unsupported by state-of-the-art Python decompilers.
  • unpyc3.7-3.10 - A fork of a decompiler which aims to support versions 3.7 - 3.10.
Debuggers
Python source code/bytecode debuggers.
  • pdb - The built-in Python interactive source debugger.
  • python3-trepan - A gdb-like debugger which supports both source code and bytecode debugging.
  • PyCharm's debugger - PyCharm has its own debugger which is considered to be one of the best.
Bytecode
Editors
Bytecode editors.
  • pySpy - This tool aims to make viewing and editing bytecode easier. Only works properly for version 3.9.
  • xdis - A Python cross-version bytecode library and disassembler. This library allows you to modify bytecode programmatically.
Manual analysis
Tools to assist with manual analysis of Python bytecode.
  • PyInjector - An injector for Windows that allows you to inject Python code into any Python process. It can be useful to expose variables, functions, grab code objects and many other things.
  • PythonForWindows - This library allows you to interact with windows but also lets you inject Python code into another Python process without needing to inject a dll yourself.
  • x-python - A Python implementation of the C interpreter. It can be useful to run bytecode instruction by instruction.
  • hypno - A cross-platform tool/library allowing to inject python code into a running python process. Can be installed through pip.
Python internals
Tools to inspect or modify Python internals.
  • inspect - A built-in library to inspect live objects. It gives information about objects like modules, classes, methods, functions, tracebacks, frame objects, and code objects. (Can be used along with Python injectors)
  • CPython - The CPython source code itself can often times be very useful to modify or trace.
Packers
Python packers that will package your Python project into an executable. This includes Python "compilers".
  • PyInstaller - PyInstaller is the most popular Python packager, supporting the platforms Windows, Linux and MacOS X.
  • py2exe - py2exe can package Python projects to an executable for Windows.
  • Cython - Cython is a superset of the Python language but can nonetheless compile Python code to a native program. It compiles the Python code to C code so any platform that has a C compiler should work.
  • Nuitka - This is also a compiler for Python that can generate executables. It officially supports Linux, FreeBSD, NetBSD, MacOS X, and Windows (32bits/64 bits/ARM).
Extractors
Tools that can extract packed Python executables.
  • pyinstxtractor - pyinstxtractor is the most popular extractor for PyInstaller. It supports almost all versions of PyInstaller. (pyinstxtractor-ng and pyinstxtractor-go might be worth checking out aswell.)
  • unpy2exe - unpy2exe is an extractor for py2exe but is not maintained anymore and likely will fail on newer versions of py2exe.
  • nuitka-extractor - An extractor for nuitka. This basically does the same thing as looking in the temp folder, but without actually running the executable.
Obfuscators
Python obfuscators.
  • Pyarmor - This is by far the most popular Python obfuscator. It supports Python 2 and 3 on Windows, Linux and MacOS X.
  • Nuitka - Nuitka isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand. The commercial version does have some extra protection features.
  • Cython - Cython isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand.
  • Hyperion - This obfuscator is unique since it's one of the only ones that actually transforms your Python code. Since it returns plain Python source code it can be used on any platform that has Python available.
The following obfuscators all work in similar ways: marshalling the original Python code and hiding it behind multiple layers of exec statements with potentionally some encryption/decryption.
Deobfuscators
Deobfuscators for Python obfuscators.
  • PyArmor-Unpacker - The most popular deobfuscator for the obfuscator Pyarmor. It only supports the free version of Pyarmor.
  • bonedensity - A deobfuscator for the obfuscator PyArmor. Supports both the free and the paid Super mode.
  • Pyarmor-Static-Unpack-1shot - A deobfuscator for the obfuscator Pyarmor 8.0 and above. Supports both free and pro versions.
  • Hyperion-deobfuscator - A deobfuscator for the obfuscator Hyperion.
  • nuitka-helper - Not a deobfuscator but a tool that does symbol recovery for Nuitka samples. Read the blog post linked in the README.
Resources
Educational resources for Python reverse engineering.
About
A curated list of awesome Python reverse engineering libraries, tools and resources
Resources
Readme
MIT license
Activity
Stars
89 stars
Watchers
2 watching
Forks
14 forks
Report repository
Releases
Packages
Contributors

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Latest commit
History
13 Commits
Folders and files
NameName
Last commit message
Last commit date
.gitattributes
.gitattributes
LICENSE
LICENSE
README.md
README.md
Repository files navigation
Awesome Python Reversing
A curated list of awesome Python reversing libraries, tools and resources.
Disassemblers
Python bytecode disassemblers.
  • dis - The built-in Python disassembler.
  • pyfalcon - A cross-version Python disassembler written in Rust. Has a web version.
  • xdis - A Python cross-version bytecode library and disassembler.
  • pycdas - A disassembler and decompiler written in C++ aiming to support all Python versions.
Decompilers
Python bytecode decompilers.
  • pylingual (web service) - An AI decompiler for multiple, more recent, Python versions. Has built-in output checking and is in general one of the better decompilers out there.
  • decompile3 - A Python decompiler aiming to support versions 3.7 - 3.8.
  • uncompyle6 - A Python decompiler aiming to support versions 1.0 - 3.8 (including Dropbox's Python 2.5 bytecode and some PyPy bytecodes).
  • pycdc - A disassembler and decompiler written in C++ aiming to support all Python versions. This decompiler is known to be unstable.
  • pycdc (snippet decompiler) - This tool decompiles individual snippets of Python bytecode as opposed to entire binary files, aiming to help manual decompilation of binaries that are unsupported by state-of-the-art Python decompilers.
  • unpyc3.7-3.10 - A fork of a decompiler which aims to support versions 3.7 - 3.10.
Debuggers
Python source code/bytecode debuggers.
  • pdb - The built-in Python interactive source debugger.
  • python3-trepan - A gdb-like debugger which supports both source code and bytecode debugging.
  • PyCharm's debugger - PyCharm has its own debugger which is considered to be one of the best.
Bytecode
Editors
Bytecode editors.
  • pySpy - This tool aims to make viewing and editing bytecode easier. Only works properly for version 3.9.
  • xdis - A Python cross-version bytecode library and disassembler. This library allows you to modify bytecode programmatically.
Manual analysis
Tools to assist with manual analysis of Python bytecode.
  • PyInjector - An injector for Windows that allows you to inject Python code into any Python process. It can be useful to expose variables, functions, grab code objects and many other things.
  • PythonForWindows - This library allows you to interact with windows but also lets you inject Python code into another Python process without needing to inject a dll yourself.
  • x-python - A Python implementation of the C interpreter. It can be useful to run bytecode instruction by instruction.
  • hypno - A cross-platform tool/library allowing to inject python code into a running python process. Can be installed through pip.
Python internals
Tools to inspect or modify Python internals.
  • inspect - A built-in library to inspect live objects. It gives information about objects like modules, classes, methods, functions, tracebacks, frame objects, and code objects. (Can be used along with Python injectors)
  • CPython - The CPython source code itself can often times be very useful to modify or trace.
Packers
Python packers that will package your Python project into an executable. This includes Python "compilers".
  • PyInstaller - PyInstaller is the most popular Python packager, supporting the platforms Windows, Linux and MacOS X.
  • py2exe - py2exe can package Python projects to an executable for Windows.
  • Cython - Cython is a superset of the Python language but can nonetheless compile Python code to a native program. It compiles the Python code to C code so any platform that has a C compiler should work.
  • Nuitka - This is also a compiler for Python that can generate executables. It officially supports Linux, FreeBSD, NetBSD, MacOS X, and Windows (32bits/64 bits/ARM).
Extractors
Tools that can extract packed Python executables.
  • pyinstxtractor - pyinstxtractor is the most popular extractor for PyInstaller. It supports almost all versions of PyInstaller. (pyinstxtractor-ng and pyinstxtractor-go might be worth checking out aswell.)
  • unpy2exe - unpy2exe is an extractor for py2exe but is not maintained anymore and likely will fail on newer versions of py2exe.
  • nuitka-extractor - An extractor for nuitka. This basically does the same thing as looking in the temp folder, but without actually running the executable.
Obfuscators
Python obfuscators.
  • Pyarmor - This is by far the most popular Python obfuscator. It supports Python 2 and 3 on Windows, Linux and MacOS X.
  • Nuitka - Nuitka isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand. The commercial version does have some extra protection features.
  • Cython - Cython isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand.
  • Hyperion - This obfuscator is unique since it's one of the only ones that actually transforms your Python code. Since it returns plain Python source code it can be used on any platform that has Python available.
The following obfuscators all work in similar ways: marshalling the original Python code and hiding it behind multiple layers of exec statements with potentionally some encryption/decryption.
Deobfuscators
Deobfuscators for Python obfuscators.
  • PyArmor-Unpacker - The most popular deobfuscator for the obfuscator Pyarmor. It only supports the free version of Pyarmor.
  • bonedensity - A deobfuscator for the obfuscator PyArmor. Supports both the free and the paid Super mode.
  • Pyarmor-Static-Unpack-1shot - A deobfuscator for the obfuscator Pyarmor 8.0 and above. Supports both free and pro versions.
  • Hyperion-deobfuscator - A deobfuscator for the obfuscator Hyperion.
  • nuitka-helper - Not a deobfuscator but a tool that does symbol recovery for Nuitka samples. Read the blog post linked in the README.
Resources
Educational resources for Python reverse engineering.
About
A curated list of awesome Python reverse engineering libraries, tools and resources
Resources
Readme
MIT license
Activity
Stars
89 stars
Watchers
2 watching
Forks
14 forks
Report repository
Releases
Packages
Contributors

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Latest commit
History
13 Commits
Folders and files
NameName
Last commit message
Last commit date
.gitattributes
.gitattributes
LICENSE
LICENSE
README.md
README.md
Repository files navigation
Awesome Python Reversing
A curated list of awesome Python reversing libraries, tools and resources.
Disassemblers
Python bytecode disassemblers.
  • dis - The built-in Python disassembler.
  • pyfalcon - A cross-version Python disassembler written in Rust. Has a web version.
  • xdis - A Python cross-version bytecode library and disassembler.
  • pycdas - A disassembler and decompiler written in C++ aiming to support all Python versions.
Decompilers
Python bytecode decompilers.
  • pylingual (web service) - An AI decompiler for multiple, more recent, Python versions. Has built-in output checking and is in general one of the better decompilers out there.
  • decompile3 - A Python decompiler aiming to support versions 3.7 - 3.8.
  • uncompyle6 - A Python decompiler aiming to support versions 1.0 - 3.8 (including Dropbox's Python 2.5 bytecode and some PyPy bytecodes).
  • pycdc - A disassembler and decompiler written in C++ aiming to support all Python versions. This decompiler is known to be unstable.
  • pycdc (snippet decompiler) - This tool decompiles individual snippets of Python bytecode as opposed to entire binary files, aiming to help manual decompilation of binaries that are unsupported by state-of-the-art Python decompilers.
  • unpyc3.7-3.10 - A fork of a decompiler which aims to support versions 3.7 - 3.10.
Debuggers
Python source code/bytecode debuggers.
  • pdb - The built-in Python interactive source debugger.
  • python3-trepan - A gdb-like debugger which supports both source code and bytecode debugging.
  • PyCharm's debugger - PyCharm has its own debugger which is considered to be one of the best.
Bytecode
Editors
Bytecode editors.
  • pySpy - This tool aims to make viewing and editing bytecode easier. Only works properly for version 3.9.
  • xdis - A Python cross-version bytecode library and disassembler. This library allows you to modify bytecode programmatically.
Manual analysis
Tools to assist with manual analysis of Python bytecode.
  • PyInjector - An injector for Windows that allows you to inject Python code into any Python process. It can be useful to expose variables, functions, grab code objects and many other things.
  • PythonForWindows - This library allows you to interact with windows but also lets you inject Python code into another Python process without needing to inject a dll yourself.
  • x-python - A Python implementation of the C interpreter. It can be useful to run bytecode instruction by instruction.
  • hypno - A cross-platform tool/library allowing to inject python code into a running python process. Can be installed through pip.
Python internals
Tools to inspect or modify Python internals.
  • inspect - A built-in library to inspect live objects. It gives information about objects like modules, classes, methods, functions, tracebacks, frame objects, and code objects. (Can be used along with Python injectors)
  • CPython - The CPython source code itself can often times be very useful to modify or trace.
Packers
Python packers that will package your Python project into an executable. This includes Python "compilers".
  • PyInstaller - PyInstaller is the most popular Python packager, supporting the platforms Windows, Linux and MacOS X.
  • py2exe - py2exe can package Python projects to an executable for Windows.
  • Cython - Cython is a superset of the Python language but can nonetheless compile Python code to a native program. It compiles the Python code to C code so any platform that has a C compiler should work.
  • Nuitka - This is also a compiler for Python that can generate executables. It officially supports Linux, FreeBSD, NetBSD, MacOS X, and Windows (32bits/64 bits/ARM).
Extractors
Tools that can extract packed Python executables.
  • pyinstxtractor - pyinstxtractor is the most popular extractor for PyInstaller. It supports almost all versions of PyInstaller. (pyinstxtractor-ng and pyinstxtractor-go might be worth checking out aswell.)
  • unpy2exe - unpy2exe is an extractor for py2exe but is not maintained anymore and likely will fail on newer versions of py2exe.
  • nuitka-extractor - An extractor for nuitka. This basically does the same thing as looking in the temp folder, but without actually running the executable.
Obfuscators
Python obfuscators.
  • Pyarmor - This is by far the most popular Python obfuscator. It supports Python 2 and 3 on Windows, Linux and MacOS X.
  • Nuitka - Nuitka isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand. The commercial version does have some extra protection features.
  • Cython - Cython isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand.
  • Hyperion - This obfuscator is unique since it's one of the only ones that actually transforms your Python code. Since it returns plain Python source code it can be used on any platform that has Python available.
The following obfuscators all work in similar ways: marshalling the original Python code and hiding it behind multiple layers of exec statements with potentionally some encryption/decryption.
Deobfuscators
Deobfuscators for Python obfuscators.
  • PyArmor-Unpacker - The most popular deobfuscator for the obfuscator Pyarmor. It only supports the free version of Pyarmor.
  • bonedensity - A deobfuscator for the obfuscator PyArmor. Supports both the free and the paid Super mode.
  • Pyarmor-Static-Unpack-1shot - A deobfuscator for the obfuscator Pyarmor 8.0 and above. Supports both free and pro versions.
  • Hyperion-deobfuscator - A deobfuscator for the obfuscator Hyperion.
  • nuitka-helper - Not a deobfuscator but a tool that does symbol recovery for Nuitka samples. Read the blog post linked in the README.
Resources
Educational resources for Python reverse engineering.
About
A curated list of awesome Python reverse engineering libraries, tools and resources
Resources
Readme
MIT license
Activity
Stars
89 stars
Watchers
2 watching
Forks
14 forks
Report repository
Releases
Packages
Contributors

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
BranchesTags
Latest commit
History
13 Commits
Folders and files
NameName
Last commit message
Last commit date
.gitattributes
.gitattributes
LICENSE
LICENSE
README.md
README.md
Repository files navigation
Awesome Python Reversing
A curated list of awesome Python reversing libraries, tools and resources.
Disassemblers
Python bytecode disassemblers.
  • dis - The built-in Python disassembler.
  • pyfalcon - A cross-version Python disassembler written in Rust. Has a web version.
  • xdis - A Python cross-version bytecode library and disassembler.
  • pycdas - A disassembler and decompiler written in C++ aiming to support all Python versions.
Decompilers
Python bytecode decompilers.
  • pylingual (web service) - An AI decompiler for multiple, more recent, Python versions. Has built-in output checking and is in general one of the better decompilers out there.
  • decompile3 - A Python decompiler aiming to support versions 3.7 - 3.8.
  • uncompyle6 - A Python decompiler aiming to support versions 1.0 - 3.8 (including Dropbox's Python 2.5 bytecode and some PyPy bytecodes).
  • pycdc - A disassembler and decompiler written in C++ aiming to support all Python versions. This decompiler is known to be unstable.
  • pycdc (snippet decompiler) - This tool decompiles individual snippets of Python bytecode as opposed to entire binary files, aiming to help manual decompilation of binaries that are unsupported by state-of-the-art Python decompilers.
  • unpyc3.7-3.10 - A fork of a decompiler which aims to support versions 3.7 - 3.10.
Debuggers
Python source code/bytecode debuggers.
  • pdb - The built-in Python interactive source debugger.
  • python3-trepan - A gdb-like debugger which supports both source code and bytecode debugging.
  • PyCharm's debugger - PyCharm has its own debugger which is considered to be one of the best.
Bytecode
Editors
Bytecode editors.
  • pySpy - This tool aims to make viewing and editing bytecode easier. Only works properly for version 3.9.
  • xdis - A Python cross-version bytecode library and disassembler. This library allows you to modify bytecode programmatically.
Manual analysis
Tools to assist with manual analysis of Python bytecode.
  • PyInjector - An injector for Windows that allows you to inject Python code into any Python process. It can be useful to expose variables, functions, grab code objects and many other things.
  • PythonForWindows - This library allows you to interact with windows but also lets you inject Python code into another Python process without needing to inject a dll yourself.
  • x-python - A Python implementation of the C interpreter. It can be useful to run bytecode instruction by instruction.
  • hypno - A cross-platform tool/library allowing to inject python code into a running python process. Can be installed through pip.
Python internals
Tools to inspect or modify Python internals.
  • inspect - A built-in library to inspect live objects. It gives information about objects like modules, classes, methods, functions, tracebacks, frame objects, and code objects. (Can be used along with Python injectors)
  • CPython - The CPython source code itself can often times be very useful to modify or trace.
Packers
Python packers that will package your Python project into an executable. This includes Python "compilers".
  • PyInstaller - PyInstaller is the most popular Python packager, supporting the platforms Windows, Linux and MacOS X.
  • py2exe - py2exe can package Python projects to an executable for Windows.
  • Cython - Cython is a superset of the Python language but can nonetheless compile Python code to a native program. It compiles the Python code to C code so any platform that has a C compiler should work.
  • Nuitka - This is also a compiler for Python that can generate executables. It officially supports Linux, FreeBSD, NetBSD, MacOS X, and Windows (32bits/64 bits/ARM).
Extractors
Tools that can extract packed Python executables.
  • pyinstxtractor - pyinstxtractor is the most popular extractor for PyInstaller. It supports almost all versions of PyInstaller. (pyinstxtractor-ng and pyinstxtractor-go might be worth checking out aswell.)
  • unpy2exe - unpy2exe is an extractor for py2exe but is not maintained anymore and likely will fail on newer versions of py2exe.
  • nuitka-extractor - An extractor for nuitka. This basically does the same thing as looking in the temp folder, but without actually running the executable.
Obfuscators
Python obfuscators.
  • Pyarmor - This is by far the most popular Python obfuscator. It supports Python 2 and 3 on Windows, Linux and MacOS X.
  • Nuitka - Nuitka isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand. The commercial version does have some extra protection features.
  • Cython - Cython isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand.
  • Hyperion - This obfuscator is unique since it's one of the only ones that actually transforms your Python code. Since it returns plain Python source code it can be used on any platform that has Python available.
The following obfuscators all work in similar ways: marshalling the original Python code and hiding it behind multiple layers of exec statements with potentionally some encryption/decryption.
Deobfuscators
Deobfuscators for Python obfuscators.
  • PyArmor-Unpacker - The most popular deobfuscator for the obfuscator Pyarmor. It only supports the free version of Pyarmor.
  • bonedensity - A deobfuscator for the obfuscator PyArmor. Supports both the free and the paid Super mode.
  • Pyarmor-Static-Unpack-1shot - A deobfuscator for the obfuscator Pyarmor 8.0 and above. Supports both free and pro versions.
  • Hyperion-deobfuscator - A deobfuscator for the obfuscator Hyperion.
  • nuitka-helper - Not a deobfuscator but a tool that does symbol recovery for Nuitka samples. Read the blog post linked in the README.
Resources
Educational resources for Python reverse engineering.
About
A curated list of awesome Python reverse engineering libraries, tools and resources
Resources
Readme
MIT license
Activity
Stars
89 stars
Watchers
2 watching
Forks
14 forks
Report repository
Releases
Packages
Contributors

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Latest commit
History
13 Commits
Folders and files
NameName
Last commit message
Last commit date
.gitattributes
.gitattributes
LICENSE
LICENSE
README.md
README.md
Repository files navigation
Awesome Python Reversing
A curated list of awesome Python reversing libraries, tools and resources.
Disassemblers
Python bytecode disassemblers.
  • dis - The built-in Python disassembler.
  • pyfalcon - A cross-version Python disassembler written in Rust. Has a web version.
  • xdis - A Python cross-version bytecode library and disassembler.
  • pycdas - A disassembler and decompiler written in C++ aiming to support all Python versions.
Decompilers
Python bytecode decompilers.
  • pylingual (web service) - An AI decompiler for multiple, more recent, Python versions. Has built-in output checking and is in general one of the better decompilers out there.
  • decompile3 - A Python decompiler aiming to support versions 3.7 - 3.8.
  • uncompyle6 - A Python decompiler aiming to support versions 1.0 - 3.8 (including Dropbox's Python 2.5 bytecode and some PyPy bytecodes).
  • pycdc - A disassembler and decompiler written in C++ aiming to support all Python versions. This decompiler is known to be unstable.
  • pycdc (snippet decompiler) - This tool decompiles individual snippets of Python bytecode as opposed to entire binary files, aiming to help manual decompilation of binaries that are unsupported by state-of-the-art Python decompilers.
  • unpyc3.7-3.10 - A fork of a decompiler which aims to support versions 3.7 - 3.10.
Debuggers
Python source code/bytecode debuggers.
  • pdb - The built-in Python interactive source debugger.
  • python3-trepan - A gdb-like debugger which supports both source code and bytecode debugging.
  • PyCharm's debugger - PyCharm has its own debugger which is considered to be one of the best.
Bytecode
Editors
Bytecode editors.
  • pySpy - This tool aims to make viewing and editing bytecode easier. Only works properly for version 3.9.
  • xdis - A Python cross-version bytecode library and disassembler. This library allows you to modify bytecode programmatically.
Manual analysis
Tools to assist with manual analysis of Python bytecode.
  • PyInjector - An injector for Windows that allows you to inject Python code into any Python process. It can be useful to expose variables, functions, grab code objects and many other things.
  • PythonForWindows - This library allows you to interact with windows but also lets you inject Python code into another Python process without needing to inject a dll yourself.
  • x-python - A Python implementation of the C interpreter. It can be useful to run bytecode instruction by instruction.
  • hypno - A cross-platform tool/library allowing to inject python code into a running python process. Can be installed through pip.
Python internals
Tools to inspect or modify Python internals.
  • inspect - A built-in library to inspect live objects. It gives information about objects like modules, classes, methods, functions, tracebacks, frame objects, and code objects. (Can be used along with Python injectors)
  • CPython - The CPython source code itself can often times be very useful to modify or trace.
Packers
Python packers that will package your Python project into an executable. This includes Python "compilers".
  • PyInstaller - PyInstaller is the most popular Python packager, supporting the platforms Windows, Linux and MacOS X.
  • py2exe - py2exe can package Python projects to an executable for Windows.
  • Cython - Cython is a superset of the Python language but can nonetheless compile Python code to a native program. It compiles the Python code to C code so any platform that has a C compiler should work.
  • Nuitka - This is also a compiler for Python that can generate executables. It officially supports Linux, FreeBSD, NetBSD, MacOS X, and Windows (32bits/64 bits/ARM).
Extractors
Tools that can extract packed Python executables.
  • pyinstxtractor - pyinstxtractor is the most popular extractor for PyInstaller. It supports almost all versions of PyInstaller. (pyinstxtractor-ng and pyinstxtractor-go might be worth checking out aswell.)
  • unpy2exe - unpy2exe is an extractor for py2exe but is not maintained anymore and likely will fail on newer versions of py2exe.
  • nuitka-extractor - An extractor for nuitka. This basically does the same thing as looking in the temp folder, but without actually running the executable.
Obfuscators
Python obfuscators.
  • Pyarmor - This is by far the most popular Python obfuscator. It supports Python 2 and 3 on Windows, Linux and MacOS X.
  • Nuitka - Nuitka isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand. The commercial version does have some extra protection features.
  • Cython - Cython isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand.
  • Hyperion - This obfuscator is unique since it's one of the only ones that actually transforms your Python code. Since it returns plain Python source code it can be used on any platform that has Python available.
The following obfuscators all work in similar ways: marshalling the original Python code and hiding it behind multiple layers of exec statements with potentionally some encryption/decryption.
Deobfuscators
Deobfuscators for Python obfuscators.
  • PyArmor-Unpacker - The most popular deobfuscator for the obfuscator Pyarmor. It only supports the free version of Pyarmor.
  • bonedensity - A deobfuscator for the obfuscator PyArmor. Supports both the free and the paid Super mode.
  • Pyarmor-Static-Unpack-1shot - A deobfuscator for the obfuscator Pyarmor 8.0 and above. Supports both free and pro versions.
  • Hyperion-deobfuscator - A deobfuscator for the obfuscator Hyperion.
  • nuitka-helper - Not a deobfuscator but a tool that does symbol recovery for Nuitka samples. Read the blog post linked in the README.
Resources
Educational resources for Python reverse engineering.
About
A curated list of awesome Python reverse engineering libraries, tools and resources
Resources
Readme
MIT license
Activity
Stars
89 stars
Watchers
2 watching
Forks
14 forks
Report repository
Releases
Packages
Contributors

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Latest commit
History
13 Commits
Folders and files
NameName
Last commit message
Last commit date
.gitattributes
.gitattributes
LICENSE
LICENSE
README.md
README.md
Repository files navigation
Awesome Python Reversing
A curated list of awesome Python reversing libraries, tools and resources.
Disassemblers
Python bytecode disassemblers.
  • dis - The built-in Python disassembler.
  • pyfalcon - A cross-version Python disassembler written in Rust. Has a web version.
  • xdis - A Python cross-version bytecode library and disassembler.
  • pycdas - A disassembler and decompiler written in C++ aiming to support all Python versions.
Decompilers
Python bytecode decompilers.
  • pylingual (web service) - An AI decompiler for multiple, more recent, Python versions. Has built-in output checking and is in general one of the better decompilers out there.
  • decompile3 - A Python decompiler aiming to support versions 3.7 - 3.8.
  • uncompyle6 - A Python decompiler aiming to support versions 1.0 - 3.8 (including Dropbox's Python 2.5 bytecode and some PyPy bytecodes).
  • pycdc - A disassembler and decompiler written in C++ aiming to support all Python versions. This decompiler is known to be unstable.
  • pycdc (snippet decompiler) - This tool decompiles individual snippets of Python bytecode as opposed to entire binary files, aiming to help manual decompilation of binaries that are unsupported by state-of-the-art Python decompilers.
  • unpyc3.7-3.10 - A fork of a decompiler which aims to support versions 3.7 - 3.10.
Debuggers
Python source code/bytecode debuggers.
  • pdb - The built-in Python interactive source debugger.
  • python3-trepan - A gdb-like debugger which supports both source code and bytecode debugging.
  • PyCharm's debugger - PyCharm has its own debugger which is considered to be one of the best.
Bytecode
Editors
Bytecode editors.
  • pySpy - This tool aims to make viewing and editing bytecode easier. Only works properly for version 3.9.
  • xdis - A Python cross-version bytecode library and disassembler. This library allows you to modify bytecode programmatically.
Manual analysis
Tools to assist with manual analysis of Python bytecode.
  • PyInjector - An injector for Windows that allows you to inject Python code into any Python process. It can be useful to expose variables, functions, grab code objects and many other things.
  • PythonForWindows - This library allows you to interact with windows but also lets you inject Python code into another Python process without needing to inject a dll yourself.
  • x-python - A Python implementation of the C interpreter. It can be useful to run bytecode instruction by instruction.
  • hypno - A cross-platform tool/library allowing to inject python code into a running python process. Can be installed through pip.
Python internals
Tools to inspect or modify Python internals.
  • inspect - A built-in library to inspect live objects. It gives information about objects like modules, classes, methods, functions, tracebacks, frame objects, and code objects. (Can be used along with Python injectors)
  • CPython - The CPython source code itself can often times be very useful to modify or trace.
Packers
Python packers that will package your Python project into an executable. This includes Python "compilers".
  • PyInstaller - PyInstaller is the most popular Python packager, supporting the platforms Windows, Linux and MacOS X.
  • py2exe - py2exe can package Python projects to an executable for Windows.
  • Cython - Cython is a superset of the Python language but can nonetheless compile Python code to a native program. It compiles the Python code to C code so any platform that has a C compiler should work.
  • Nuitka - This is also a compiler for Python that can generate executables. It officially supports Linux, FreeBSD, NetBSD, MacOS X, and Windows (32bits/64 bits/ARM).
Extractors
Tools that can extract packed Python executables.
  • pyinstxtractor - pyinstxtractor is the most popular extractor for PyInstaller. It supports almost all versions of PyInstaller. (pyinstxtractor-ng and pyinstxtractor-go might be worth checking out aswell.)
  • unpy2exe - unpy2exe is an extractor for py2exe but is not maintained anymore and likely will fail on newer versions of py2exe.
  • nuitka-extractor - An extractor for nuitka. This basically does the same thing as looking in the temp folder, but without actually running the executable.
Obfuscators
Python obfuscators.
  • Pyarmor - This is by far the most popular Python obfuscator. It supports Python 2 and 3 on Windows, Linux and MacOS X.
  • Nuitka - Nuitka isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand. The commercial version does have some extra protection features.
  • Cython - Cython isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand.
  • Hyperion - This obfuscator is unique since it's one of the only ones that actually transforms your Python code. Since it returns plain Python source code it can be used on any platform that has Python available.
The following obfuscators all work in similar ways: marshalling the original Python code and hiding it behind multiple layers of exec statements with potentionally some encryption/decryption.
Deobfuscators
Deobfuscators for Python obfuscators.
  • PyArmor-Unpacker - The most popular deobfuscator for the obfuscator Pyarmor. It only supports the free version of Pyarmor.
  • bonedensity - A deobfuscator for the obfuscator PyArmor. Supports both the free and the paid Super mode.
  • Pyarmor-Static-Unpack-1shot - A deobfuscator for the obfuscator Pyarmor 8.0 and above. Supports both free and pro versions.
  • Hyperion-deobfuscator - A deobfuscator for the obfuscator Hyperion.
  • nuitka-helper - Not a deobfuscator but a tool that does symbol recovery for Nuitka samples. Read the blog post linked in the README.
Resources
Educational resources for Python reverse engineering.
About
A curated list of awesome Python reverse engineering libraries, tools and resources
Resources
Readme
MIT license
Activity
Stars
89 stars
Watchers
2 watching
Forks
14 forks
Report repository
Releases
Packages
Contributors

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
BranchesTags
Latest commit
History
13 Commits
Folders and files
NameName
Last commit message
Last commit date
.gitattributes
.gitattributes
LICENSE
LICENSE
README.md
README.md
Repository files navigation
Awesome Python Reversing
A curated list of awesome Python reversing libraries, tools and resources.
Disassemblers
Python bytecode disassemblers.
  • dis - The built-in Python disassembler.
  • pyfalcon - A cross-version Python disassembler written in Rust. Has a web version.
  • xdis - A Python cross-version bytecode library and disassembler.
  • pycdas - A disassembler and decompiler written in C++ aiming to support all Python versions.
Decompilers
Python bytecode decompilers.
  • pylingual (web service) - An AI decompiler for multiple, more recent, Python versions. Has built-in output checking and is in general one of the better decompilers out there.
  • decompile3 - A Python decompiler aiming to support versions 3.7 - 3.8.
  • uncompyle6 - A Python decompiler aiming to support versions 1.0 - 3.8 (including Dropbox's Python 2.5 bytecode and some PyPy bytecodes).
  • pycdc - A disassembler and decompiler written in C++ aiming to support all Python versions. This decompiler is known to be unstable.
  • pycdc (snippet decompiler) - This tool decompiles individual snippets of Python bytecode as opposed to entire binary files, aiming to help manual decompilation of binaries that are unsupported by state-of-the-art Python decompilers.
  • unpyc3.7-3.10 - A fork of a decompiler which aims to support versions 3.7 - 3.10.
Debuggers
Python source code/bytecode debuggers.
  • pdb - The built-in Python interactive source debugger.
  • python3-trepan - A gdb-like debugger which supports both source code and bytecode debugging.
  • PyCharm's debugger - PyCharm has its own debugger which is considered to be one of the best.
Bytecode
Editors
Bytecode editors.
  • pySpy - This tool aims to make viewing and editing bytecode easier. Only works properly for version 3.9.
  • xdis - A Python cross-version bytecode library and disassembler. This library allows you to modify bytecode programmatically.
Manual analysis
Tools to assist with manual analysis of Python bytecode.
  • PyInjector - An injector for Windows that allows you to inject Python code into any Python process. It can be useful to expose variables, functions, grab code objects and many other things.
  • PythonForWindows - This library allows you to interact with windows but also lets you inject Python code into another Python process without needing to inject a dll yourself.
  • x-python - A Python implementation of the C interpreter. It can be useful to run bytecode instruction by instruction.
  • hypno - A cross-platform tool/library allowing to inject python code into a running python process. Can be installed through pip.
Python internals
Tools to inspect or modify Python internals.
  • inspect - A built-in library to inspect live objects. It gives information about objects like modules, classes, methods, functions, tracebacks, frame objects, and code objects. (Can be used along with Python injectors)
  • CPython - The CPython source code itself can often times be very useful to modify or trace.
Packers
Python packers that will package your Python project into an executable. This includes Python "compilers".
  • PyInstaller - PyInstaller is the most popular Python packager, supporting the platforms Windows, Linux and MacOS X.
  • py2exe - py2exe can package Python projects to an executable for Windows.
  • Cython - Cython is a superset of the Python language but can nonetheless compile Python code to a native program. It compiles the Python code to C code so any platform that has a C compiler should work.
  • Nuitka - This is also a compiler for Python that can generate executables. It officially supports Linux, FreeBSD, NetBSD, MacOS X, and Windows (32bits/64 bits/ARM).
Extractors
Tools that can extract packed Python executables.
  • pyinstxtractor - pyinstxtractor is the most popular extractor for PyInstaller. It supports almost all versions of PyInstaller. (pyinstxtractor-ng and pyinstxtractor-go might be worth checking out aswell.)
  • unpy2exe - unpy2exe is an extractor for py2exe but is not maintained anymore and likely will fail on newer versions of py2exe.
  • nuitka-extractor - An extractor for nuitka. This basically does the same thing as looking in the temp folder, but without actually running the executable.
Obfuscators
Python obfuscators.
  • Pyarmor - This is by far the most popular Python obfuscator. It supports Python 2 and 3 on Windows, Linux and MacOS X.
  • Nuitka - Nuitka isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand. The commercial version does have some extra protection features.
  • Cython - Cython isn't officially seen as an obfuscator but because it compiles Python code to C code it definitely helps with making the code harder to understand.
  • Hyperion - This obfuscator is unique since it's one of the only ones that actually transforms your Python code. Since it returns plain Python source code it can be used on any platform that has Python available.
The following obfuscators all work in similar ways: marshalling the original Python code and hiding it behind multiple layers of exec statements with potentionally some encryption/decryption.
Deobfuscators
Deobfuscators for Python obfuscators.
  • PyArmor-Unpacker - The most popular deobfuscator for the obfuscator Pyarmor. It only supports the free version of Pyarmor.
  • bonedensity - A deobfuscator for the obfuscator PyArmor. Supports both the free and the paid Super mode.
  • Pyarmor-Static-Unpack-1shot - A deobfuscator for the obfuscator Pyarmor 8.0 and above. Supports both free and pro versions.
  • Hyperion-deobfuscator - A deobfuscator for the obfuscator Hyperion.
  • nuitka-helper - Not a deobfuscator but a tool that does symbol recovery for Nuitka samples. Read the blog post linked in the README.
Resources
Educational resources for Python reverse engineering.
About
A curated list of awesome Python reverse engineering libraries, tools and resources
Resources
Readme
MIT license
Activity
Stars
89 stars
Watchers
2 watching
Forks
14 forks
Report repository
Releases
Packages
Contributors