Jump to content
Tuts 4 You
0x72

Python Pyarmor + My Protector

Recommended Posts

0x72
Posted (edited)

Language : Python
Platform : Windows
OS Version : All 
Packer / Protector : Pyarmor  + My Protector

Description :

Want to see if someone can unpack it, want to use this obfuscator for my future aplications in python

Screenshot : 

Spoiler

 xgiEYc.png

Download : 

Virustotal: https://www.virustotal.com/gui/file/fec987a11c8bdd47355529389d75f1f2cb0f980a763efa21e796dd1a21619989/detection
Download: https://anonfile.com/3fn5o8gdo5/UnpackME_by_0x72_rar

UnpackME by 0x72.rar

Edited by Teddy Rogers
Please use correct formatting and attach your file to the topic (do not use external file host) (see edit history)

Share this post


Link to post
CodeExplorer

The program is a 64 bit executable! (Portable Executable 64)
Did you code this UnpackMe yourself?
 

Share this post


Link to post
0x72
Posted (edited)
10 minutes ago, CodeExplorer said:

The program is a 64 bit executable! (Portable Executable 64)
Did you code this UnpackMe yourself?
 

Half of obfuscation is made manually and for the rest i used pyarmor

To make it Executable i used pyinstaller 

Edited by 0x72 (see edit history)

Share this post


Link to post
Extreme Coders

Not necessary to unpack to get the key.

Key:

Spoiler

image.png.2846c516e23d847e927c7c7fd1ad3dd6.png

GENERATE-KEY-0X72GOD-UNPACKME

Converted it to run on Linux because it's easier to compile CPython on Linux and also because I don't have Visual Studio installed in the Windows VM.
This also explains why "title" and "cls" commands were not found.

Steps :

Spoiler

 

1. Use pyinstxtractor.py to extract the executable in Python 3.7

2. Using the extracted files, create the following directory structure


.
|-- martisor.pyc
`-- pytransform
    |-- __init__.py
    |-- _pytransform.dll
    |-- license.lic
    `-- pytransform.key

1 directory, 5 files

For running on Linux, you need _pytransform.so downloadable from https://pyarmor.dashingsoft.com/platforms.html

3. Install psutil using pip (Required for pyarmor). From now on, you can just run python3.7 martisor.pyc instead of the unpackme executable.

4. pyarmor encrypts the code objects on disk and they are only decrypted at runtime just before they are executed. The entire logic is implemented in _pytransform.dll. There are anti-debugging/timing checks to prevent us from using a debugger to dump code objects from memory. But there's no need to use a debugger at all when CPython itself is open source. :)

5. Compile Python 3.7 from source. Modify the _PyEval_EvalFrameDefault function such that it dumps the code object to disk. By doing so we do not need to bother about all the anti-debugging and encrypted stuff. This is because pyarmor decrypts the code object in memory before it hands it to the Python VM for execution.

6. Run strings on the dumped code  object. We get many base64 strings. Like this one: CkdFTkVSQVRFLUtFWS0wWDcyR09ELVVOUEFDS01FCg==

7. Base64 decode and profit!

 

 

  • Like 4

Share this post


Link to post
0x72
Posted (edited)

5. Compile Python 3.7 from source. Modify the _PyEval_EvalFrameDefault function such that it dumps the code object to disk. By doing so we do not need to bother about all the anti-debugging and encrypted stuff. This is because pyarmor decrypts the code object in memory before it hands it to the Python VM for execution.

 

I don't understand this step at all

Edited by 0x72 (see edit history)

Share this post


Link to post
Powante
On 3/29/2020 at 9:50 PM, Extreme Coders said:

5. Compile Python 3.7 from source. Modify the _PyEval_EvalFrameDefault function such that it dumps the code object to disk. By doing so we do not need to bother about all the anti-debugging and encrypted stuff. This is because pyarmor decrypts the code object in memory before it hands it to the Python VM for execution.

Hi Extreme, im trying to do this, but the code is unredable after dumped!

How you do it?

Which function you have used?

 

Thanks in advance :)

 

Share this post


Link to post
Extreme Coders
3 hours ago, Powante said:

Hi Extreme, im trying to do this, but the code is unredable after dumped!

The code will be unreadable as it's encrypted. But at least for this challenge that is not an issue. You can simply run strings on the dumped file.

Share this post


Link to post
Powante
Posted (edited)

I need to do the same, research for a string, but with "unredable" i means that the dumped code it is not binary.

I think i did not write the function for dumping correctly, do you have a sample or the function you have write for dumping?

 

Thank you very much! 

Edited by Powante (see edit history)

Share this post


Link to post
OdieWan

Thanks to "Extreme Coders", I've never programmed in python before, but after reading all your public material and following the recommended steps in this thread I've been able to desofuscate the code.
If they tell you how to do it you will understand it, but if they guide you and you have to discover how to do it you will learn

martisor_unpacked.py

  • Like 2

Share this post


Link to post
shadow.Walker
Posted (edited)
On 3/29/2020 at 10:50 PM, Extreme Coders said:

5. Compile Python 3.7 from source. Modify the _PyEval_EvalFrameDefault function such that it dumps the code object to disk. By doing so we do not need to bother about all the anti-debugging and encrypted stuff. This is because pyarmor decrypts the code object in memory before it hands it to the Python VM for execution.

Quote

Modify the _PyEval_EvalFrameDefault function such that it dumps the code object to disk

do u mind explaining how to do that? how to dump the bytes from _PyEval_EvalFrameDefault

Edited by shadow.Walker (see edit history)

Share this post


Link to post
shadow.Walker
On 6/9/2020 at 3:22 PM, OdieWan said:

Thanks to "Extreme Coders", I've never programmed in python before, but after reading all your public material and following the recommended steps in this thread I've been able to desofuscate the code.
If they tell you how to do it you will understand it, but if they guide you and you have to discover how to do it you will learn

martisor_unpacked.py 10.3 kB · 12 downloads

Quote

def run_it():
    r"""
    /*
    An exception occurred when decompiling this method (06000001)

    ICSharpCode.Decompiler.DecompilerException: Error decompiling System.Void <Module>::.cctor()
    ---> System.OverflowException: Arithmetic operation resulted in an overflow.
    at ICSharpCode.Decompiler.ILAst.ILAstBuilder.StackSlot.ModifyStack(StackSlot[] stack, Int32 popCount, Int32 pushCount, ByteCode pushDefinition) in C:\projects\dnspy\Extensions\ILSpy.Decompiler\ICSharpCode.Decompiler\ICSharpCode.Decompiler\ILAst\ILAstBuilder.cs:line 47
    at ICSharpCode.Decompiler.ILAst.ILAstBuilder.StackAnalysis(MethodDef methodDef) in C:\projects\dnspy\Extensions\ILSpy.Decompiler\ICSharpCode.Decompiler\ICSharpCode.Decompiler\ILAst\ILAstBuilder.cs:line 387
    at ICSharpCode.Decompiler.ILAst.ILAstBuilder.Build(MethodDef methodDef, Boolean optimize, DecompilerContext context) in C:\projects\dnspy\Extensions\ILSpy.Decompiler\ICSharpCode.Decompiler\ICSharpCode.Decompiler\ILAst\ILAstBuilder.cs:line 269
    at ICSharpCode.Decompiler.Ast.AstMethodBodyBuilder.CreateMethodBody(IEnumerable`1 parameters, MethodDebugInfoBuilder& builder) in C:\projects\dnspy\Extensions\ILSpy.Decompiler\ICSharpCode.Decompiler\ICSharpCode.Decompiler\Ast\AstMethodBodyBuilder.cs:line 112
    at ICSharpCode.Decompiler.Ast.AstMethodBodyBuilder.CreateMethodBody(MethodDef methodDef, DecompilerContext context, AutoPropertyProvider autoPropertyProvider, IEnumerable`1 parameters, Boolean valueParameterIsKeyword, StringBuilder sb, MethodDebugInfoBuilder& stmtsBuilder) in C:\projects\dnspy\Extensions\ILSpy.Decompiler\ICSharpCode.Decompiler\ICSharpCode.Decompiler\Ast\AstMethodBodyBuilder.cs:line 88
    --- End of inner exception stack trace ---
    at ICSharpCode.Decompiler.Ast.AstMethodBodyBuilder.CreateMethodBody(MethodDef methodDef, DecompilerContext context, AutoPropertyProvider autoPropertyProvider, IEnumerable`1 parameters, Boolean valueParameterIsKeyword, StringBuilder sb, MethodDebugInfoBuilder& stmtsBuilder) in C:\projects\dnspy\Extensions\ILSpy.Decompiler\ICSharpCode.Decompiler\ICSharpCode.Decompiler\Ast\AstMethodBodyBuilder.cs:line 92
    at ICSharpCode.Decompiler.Ast.AstBuilder.<>c__DisplayClass89_1.<AddMethodBody>b__0() in C:\projects\dnspy\Extensions\ILSpy.Decompiler\ICSharpCode.Decompiler\ICSharpCode.Decompiler\Ast\AstBuilder.cs:line 1531
    */

    """
    pass

what Dnspy got to do with a python compiled program!! would u explain how u managed to modified the _PyEval_EvalFrameDefault function!

Share this post


Link to post
Extreme Coders
Posted (edited)
15 hours ago, shadow.Walker said:

do u mind explaining how to do that? how to dump the bytes from _PyEval_EvalFrameDefault

_PyEval_EvalFrameDefault executes a code object on the Python frame.
To dump the code object to a file you need to use PyMarshal_WriteObjectToFile / PyMarshal_WriteObjectToString at an appropriate place within the function.

 

15 hours ago, shadow.Walker said:

what Dnspy got to do with a python compiled program!! would u explain how u managed to modified the _PyEval_EvalFrameDefault function!

DnSpy has nothing to do with Python. It's just a piece of string inserted there on purpose.

Edited by Extreme Coders (see edit history)
  • Thanks 1

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...