Unfuck: A utility for deobfuscating Python 2.7 bytecode

• unfuck

  6 196 6.0 Rust

  Python 2.7 bytecode d̶e̶o̶b̶f̶u̶s̶c̶a̶t̶o̶r unfucker

I haven't heard of this tool before, but I don't think it would work for obfuscated code. Check out the graph image on my wiki [1]. While this image doesn't show the exact scenario, imagine that the first instruction is a `JUMP_ABSOLUTE 100` and the rest of the instructions between offset [3,100) are just garbage or invalid.

A naive disassembler (like the `dis` module in python) interprets the bytecode linearly -- i.e. one instruction after another. Rizin's diassembler [2] seems to take the same approach. The way I do disassembly is to only disassemble code paths that are potentially executed by queueing non-conditional jumps, both targets of a conditional jump, and the next instruction when the current instruction is non-jumping instruction.

[1] https://github.com/landaire/unfuck/wiki/Obfuscation-Tricks

• thefuck

  305 82,689 4.8 Python

  Magnificent app which corrects your previous console command.

The Fuck[1] is a handy tool that I use daily in the office.

Is fsck something you'd avoid because of its name, or is the single letter change enough to make it safe?

[1] https://github.com/nvbn/thefuck

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• rizin

  46 2,426 9.8 C

  UNIX-like reverse engineering framework and command-line toolset.

  

Suggest a related project