A Glance at Interpreted Language Bytecode Trickery

on YouTube ↗41m

" summary

Researcher encounters a product of compiled Python 2.7 packaged with py2exe whose .pyc files break uncompyle6 with an unknown magic number 62216. Investigation shows opcodes are remapped (e.g. 111→131, 64→4), so a recursive routine rewrites co_code and constants, rebuilds a .pyc with a documented magic number and decompiles successfully. For PHP SourceGuardian, the vld extension is modified to dump at the second zend_execute, five opcode handlers are replaced to deobfuscate operands and dump unused classes/functions. Code and writeups live on the Tenable tech blog.

AI-written summary · about

" chapters (30)

1. 0:00Start
2. 1:10Background
3. 1:50Topics
4. 3:07Python Opcode Remapping
5. 3:17Druva inSync is built with py2exe
6. 4:43What's a .pyc file?
7. 5:24It won't decompile!
8. 5:55pyc file format
9. 7:02Magic Number List
10. 9:17Code object is executable
11. 10:03Disassembling Code Object in hello.pyc
12. 11:58More Nested Code Objects
13. 13:10Remap the Opcodes in Code Objects
14. 15:44PHP - SourceGuardian
15. 17:52PHP Bytecode
16. 18:48PHP Hooks and Extensions
17. 20:16Vulcan Logic Dumper (VLD) Extension
18. 22:21VLD-Zend_compile_file() hook -sg-load
19. 22:46Visualizing the Hook
20. 23:452nd zend_execute() hook - no opcodes!?
21. 25:19But why? ... Time to debug
22. 27:28Another sample...
23. 30:19Debugger: JMP Handler
24. 30:30Enter the SG JMP Handler
25. 31:56SourceGuardian JMP Handler
26. 32:34Solution: Fix each zend_op
27. 33:29Solution: Fix The Op Array
28. 35:395 SourceGuardian Opcode Handlers
29. 36:59Classes and functions: 'main'
30. 38:35Dump it All - ClassOne

" related talks

• 38mThere and Back Again: Reverse Engineering Python BinariesJosh Wiedemeier · PyCon US 2024
• 45m"Advanced Malware Threat: handling obfuscated code using..."Alexandre Borges · CONFidence 2019
• 01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized PackersAlexandre Borges · HITBSecConf 2019 Amsterdam
• 21mDemystify Today's Binary Disassembling and How Modern ABI Makes it EasierEric Koskinen, Chengbin Pang, Jun Xu · Black Hat Asia 2020
• 25mCommSec D1 - A Deep Dive Into Malicious DocumentsJosh Stroschein · Hack In The Box Amsterdam 2018
• 30mThe Hidden ART Of Rolling Shellcode DecryptionTijme Gommers · Nullcon Goa 2025
• 32mYou Can Run, but You Can't Hide - Finding the Footprints of Hidden ShellcodeJohn Uhlmann · Black Hat Asia 2023
• 11mcompilers HATE him: use this ONE WEIRD TRICK to hide a message...!William Woodruff · !!Con 2021