BackDoorBuster/detection/pyc_detection.py

56 lines
1.6 KiB
Python

from typing import List, Tuple
import uncompyle6
import io
import os
import subprocess
def run_pycdc(exe_path: str, pyc_file: str) -> str:
"""
Executes pycdc.exe with the given .pyc file using a command line string and captures the output.
Args:
exe_path (str): Path to the pycdc.exe executable.
pyc_file (str): Path to the .pyc file to decompile.
Returns:
str: Output from pycdc.exe.
"""
if not os.path.isfile(exe_path):
print(f"ERROR: The specified pycdc.exe path is not valid: {exe_path}")
print("Please check your pycdc path.")
exit(1)
command = f'"{exe_path}" "{pyc_file}"'
result = subprocess.run(command, capture_output=True, text=True, shell=True)
if result.returncode != 0:
raise Exception(f"Error running pycdc.exe: {result.stderr}")
return result.stdout
def disassemble_pyc(file_path: str, pycdc_addr=None) -> str:
"""
Disassembles a .pyc file using uncompyle6.
Args:
file_path (str): The path to the .pyc file.
Returns:
str: The disassembled code as a string.
"""
output = io.StringIO()
try:
uncompyle6.main.decompile_file(file_path, output)
return output.getvalue()
except Exception as e:
if pycdc_addr is None:
print(
"ERROR: For Python 3.11 and above, you need to install pycdc and compile it yourself to obtain pycdc.exe."
)
print("repo: https://github.com/zrax/pycdc.git")
exit(1)
else:
return run_pycdc(pycdc_addr, file_path)