python逆向

# main.py

import check

if __name__ == '__main__':

    check.check_this()

# check.py

def check_this():

    str = input("plz enter your input:")

    if str=="123123":

        print("right")

    else:

        print("wrong")

PS D:\TRASHBIN\pyinstaller--key\dist\main.exe_extracted> uncompyle6.exe .\main.pyc

# uncompyle6 version 3.9.0

# Python bytecode version base 3.7.0 (3394)

# Decompiled from: Python 3.7.9 (tags/v3.7.9:13c94747c7, Aug 17 2020, 18:58:18) [MSC v.1900 64 bit (AMD64)]

# Embedded file name: main.py

import check

if __name__ == '__main__':

    check.check_this()

# okay decompiling .\main.pyc

PS D:\TRASHBIN\pyinstaller--key\dist\main.exe_extracted\PYZ-00.pyz_extracted> uncompyle6.exe .\check.pyc

# uncompyle6 version 3.9.0

# Python bytecode version base 3.7.0 (3394)

# Decompiled from: Python 3.7.9 (tags/v3.7.9:13c94747c7, Aug 17 2020, 18:58:18) [MSC v.1900 64 bit (AMD64)]

# Embedded file name: check.py

def check_this():

    str = input('plz enter your input:')

    if str == '123123':

        print('right')

    else:

        print('wrong')

# okay decompiling .\check.pyc

import marshal, dis

f = open("simple.pyc", "rb").read()

code = marshal.loads(f[16:])			#这边从 16 位开始取因为是 python3 python2 从 8 位开始取

dis.dis(code)

typedef struct {

    PyObject_HEAD

    int co_argcount;        /* 位置参数个数 */

    int co_nlocals;         /* 局部变量个数 */

    int co_stacksize;       /* 栈大小 */

    int co_flags;   

    PyObject *co_code;      /* 字节码指令序列 */

    PyObject *co_consts;    /* 所有常量集合 */

    PyObject *co_names;     /* 所有符号名称集合 */

    PyObject *co_varnames;  /* 局部变量名称集合 */

    PyObject *co_freevars;  /* 闭包用的的变量名集合 */

    PyObject *co_cellvars;  /* 内部嵌套函数引用的变量名集合 */

    /* The rest doesn’t count for hash/cmp */

    PyObject *co_filename;  /* 代码所在文件名 */

    PyObject *co_name;      /* 模块名|函数名|类名 */

    int co_firstlineno;     /* 代码块在文件中的起始行号 */

    PyObject *co_lnotab;    /* 字节码指令和行号的对应关系 */

    void *co_zombieframe;   /* for optimization only (see frameobject.c) */

} PyCodeObject;

# copied from https://github.com/google/pytype/blob/main/pytype/pyc/magic.py

"""Python version numbers and their encoding ("magic number")."""

import struct

# These constants are from Python-3.x.x/Lib/importlib/_bootstrap_external.py

PYTHON_MAGIC = {

    # Python 1

    20121: (1, 5),

    50428: (1, 6),

    # Python 2

    50823: (2, 0),

    60202: (2, 1),

    60717: (2, 2),

    62011: (2, 3),  # a0

    62021: (2, 3),  # a0

    62041: (2, 4),  # a0

    62051: (2, 4),  # a3

    62061: (2, 4),  # b1

    62071: (2, 5),  # a0

    62081: (2, 5),  # a0

    62091: (2, 5),  # a0

    62092: (2, 5),  # a0

    62101: (2, 5),  # b3

    62111: (2, 5),  # b3

    62121: (2, 5),  # c1

    62131: (2, 5),  # c2

    62151: (2, 6),  # a0

    62161: (2, 6),  # a1

    62171: (2, 7),  # a0

    62181: (2, 7),  # a0

    62191: (2, 7),  # a0

    62201: (2, 7),  # a0

    62211: (2, 7),  # a0

    # Python 3

    3000: (3, 0),

    3010: (3, 0),

    3020: (3, 0),

    3030: (3, 0),

    3040: (3, 0),

    3050: (3, 0),

    3060: (3, 0),

    3061: (3, 0),

    3071: (3, 0),

    3081: (3, 0),

    3091: (3, 0),

    3101: (3, 0),

    3103: (3, 0),

    3111: (3, 0),  # a4

    3131: (3, 0),  # a5

    # Python 3.1

    3141: (3, 1),  # a0

    3151: (3, 1),  # a0

    # Python 3.2

    3160: (3, 2),  # a0

    3170: (3, 2),  # a1

    3180: (3, 2),  # a2

    # Python 3.3

    3190: (3, 3),  # a0

    3200: (3, 3),  # a0

    3220: (3, 3),  # a1

    3230: (3, 3),  # a4

    # Python 3.4

    3250: (3, 4),  # a1

    3260: (3, 4),  # a1

    3270: (3, 4),  # a1

    3280: (3, 4),  # a1

    3290: (3, 4),  # a4

    3300: (3, 4),  # a4

    3310: (3, 4),  # rc2

    # Python 3.5

    3320: (3, 5),  # a0

    3330: (3, 5),  # b1

    3340: (3, 5),  # b2

    3350: (3, 5),  # b2

    3351: (3, 5),  # 3.5.2

    # Python 3.6

    3360: (3, 6),  # a0

    3361: (3, 6),  # a0

    3370: (3, 6),  # a1

    3371: (3, 6),  # a1

    3372: (3, 6),  # a1

    3373: (3, 6),  # b1

    3375: (3, 6),  # b1

    3376: (3, 6),  # b1

    3377: (3, 6),  # b1

    3378: (3, 6),  # b2

    3379: (3, 6),  # rc1

    # Python 3.7

    3390: (3, 7),  # a1

    3391: (3, 7),  # a2

    3392: (3, 7),  # a4

    3393: (3, 7),  # b1

    3394: (3, 7),  # b5

    # Python 3.8

    3400: (3, 8),  # a1

    3401: (3, 8),  # a1

    3410: (3, 8),  # a1

    3411: (3, 8),  # b2

    3412: (3, 8),  # b2

    3413: (3, 8),  # b4

    # Python 3.9

    3420: (3, 9),  # a0

    3421: (3, 9),  # a0

    3422: (3, 9),  # a0

    3423: (3, 9),  # a2

    3424: (3, 9),  # a2

    3425: (3, 9),  # a2

    # Python 3.10

    3430: (3, 10),  # a1

    3431: (3, 10),  # a1

    3432: (3, 10),  # a2

    3433: (3, 10),  # a2

    3434: (3, 10),  # a6

    3435: (3, 10),  # a7

    3436: (3, 10),  # b1

    3437: (3, 10),  # b1

    3438: (3, 10),  # b1

    3439: (3, 10),  # b1

    # Python 3.11

    3450: (3, 11),  # a1

    3451: (3, 11),  # a1

    3452: (3, 11),  # a1

    3453: (3, 11),  # a1

    3454: (3, 11),  # a1

    3455: (3, 11),  # a1

    3456: (3, 11),  # a1

    3457: (3, 11),  # a1

    3458: (3, 11),  # a1

    3459: (3, 11),  # a1

    3460: (3, 11),  # a1

    3461: (3, 11),  # a1

    3462: (3, 11),  # a2

    3463: (3, 11),  # a3

    3464: (3, 11),  # a3

    3465: (3, 11),  # a3

    3466: (3, 11),  # a4

    3467: (3, 11),  # a4

    3468: (3, 11),  # a4

    3469: (3, 11),  # a4

    3470: (3, 11),  # a4

    3471: (3, 11),  # a4

    3472: (3, 11),  # a4

    3473: (3, 11),  # a4

    3474: (3, 11),  # a4

    3475: (3, 11),  # a5

    3476: (3, 11),  # a5

    3477: (3, 11),  # a5

    3478: (3, 11),  # a5

    3479: (3, 11),  # a5

    3480: (3, 11),  # a5

    3481: (3, 11),  # a5

    3482: (3, 11),  # a5

    3483: (3, 11),  # a5

    3484: (3, 11),  # a5

    3485: (3, 11),  # a5

    3486: (3, 11),  # a6

    3487: (3, 11),  # a6

    3488: (3, 11),  # a6

    3489: (3, 11),  # a6

    3490: (3, 11),  # a6

    3491: (3, 11),  # a6

    3492: (3, 11),  # a7

    3493: (3, 11),  # a7

    3494: (3, 11),  # a7

    3495: (3, 11),  # b4

}

def magic_word_to_version(magic_word):

  """Return the Python version belonging to the magic number in the pyc head.

  The magic number is encoded in the first two bytes of a .pyc file.

  It translates to a (major, minor) version. It never has a "micro" version,

  because Python bytecode encoding doesn't change between micro version.

  Arguments:

    magic_word: A 16 bit number, either as an integer or little-endian encoded

      as a string.

  Returns:

    A tuple (major, minor), e.g. (3, 7).

  """

  if not isinstance(magic_word, int):

    magic_word = struct.unpack("<H", magic_word)[0]

  return PYTHON_MAGIC[magic_word]