Skip to content

CPython Bytecode

Decompilers, Disassemblers, Assemblers

When decompiling CPython bytecode, you need to make sure that the decompiler supports the CPython version

Decompilers and supported Python versions

The most versatile decompiler is probably uncompyle6.

decompiler remarks supported versions link
uncompyle6 1.4, 2.1-2.7, 3.0-3.8 (diff. branches, see readme) click
decompyle3 aka decompile3 recommended to cross check with unpyc37, generally better than uncompyle6 for supported versions 3.7 and 3.8 click
uncompyle 2.7 click
uncompyle2 by wibiti forked from uncompyle 2.7 click
uncompyle2 by Mysterie forked from uncompyle2 by wibiti 2.5, 2.6, 2.7 click
unpyc3 by google by google code 3.2 click
unpyc3 by figment fork of google code version 3.3 click
unpyc37 fork of unpyc3 3.7 click
pycdc aka Decompyle++ wants to support all versions but unsupported opcodes with 3.10+ click
pylingual uses "transformer models to learn new Python bytecode specifications as they are released.", 256kb limit all (?) click

Disassembler

Most decompilers also have disassembly support but there are some dedicated disassemblers.

  • dis is part of Python, supports the currently installed python version
  • python-xdis, supports 1.0 - 3.10, does not rely on installed Python version

🔗Python Bytecode Instructions

The disassembler is especially useful if premade tools/decompilers fail to extract anything.

Inspecting objects:

import rich
import malwaremodule
rich.inspect(malwarefunction)

Disassembly:

import dis
import malwaremodule
dis.dis(malwarefunction)

Assembler

python-xasm, for making small patches to existing bytecode

Last update: 2023-04-04

Comments