38 lines
1.1 KiB
Markdown
38 lines
1.1 KiB
Markdown
# API Reference: Analyzing Compiled Python Malware
|
|
|
|
## Overview
|
|
|
|
`scripts/analyst.py` detects frozen-Python packers (PyInstaller, py2exe, cx_Freeze) by their markers,
|
|
locates the PyInstaller CArchive magic cookie, and extracts embedded Python version strings. It
|
|
reads bytes statically and executes nothing.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| (stdlib) | — | regex, JSON, file IO |
|
|
|
|
## Core functions
|
|
|
|
### `detect(path)`
|
|
Returns the detected packer, PyInstaller cookie offset, and Python version strings, plus the
|
|
recommended next step.
|
|
|
|
## Markers
|
|
|
|
- PyInstaller: `_MEIPASS`, `PYZ-00.pyz`, `pyiboot01_bootstrap`, CArchive cookie `MEI\\014\\013\\012\\013\\016`.
|
|
- py2exe: `PYTHONSCRIPT`.
|
|
- cx_Freeze: `cx_Freeze` strings.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python scripts/analyst.py detect sample.exe
|
|
```
|
|
|
|
## Sources
|
|
|
|
- PyInstaller archive format (CArchive/PKG, MEI cookie) — https://pyinstaller.org/en/stable/advanced-topics.html
|
|
- Python bytecode / .pyc magic (dis module) — https://docs.python.org/3/library/dis.html
|
|
- pyinstxtractor extraction workflow (public PyInstaller-unpacking tooling)
|