Stuck at PyArmor deobfusaction

[Aqu4]

I am reverse engineering my first piece of software and already fixed the "unknown magic numbers" errors.

 

I have run into a block of code that says this and i don't know what to do. Any tips appreciated:

Please Login or Register to see this Hidden Content

[FaithHF]

Although I'm not familiar with pyarmor (or much regarding python obfuscation,) I do know that it basically works like this:

 

Please Login or Register to see this Hidden Content

 

Now, again, it's my assumption that the pyarmor runtime, rather than executing data within the function, will simply decrypt the data and shift it down to the offset of 0 (or maybe just call it at the offset for the bytecode.) From there, it'll call the bytecode as a function, finish execution, then finally return/exit the program.

 

My best guess is to maybe play around with the pyarmor runtime and see if you can get it to output anything. Poke around until something moves, I guess. Maybe find a pirated copy of IDA and some python plugins so you can step through and see how the bytecode actually works.

 

Sorry I probably can't be too much help :/

[tonu96]

Perhaps PyArmor somehow defeats this, but with a decent IDE like PyCharm you should be able to run the software through the debugger and have it show the decompiled code as it's executed. It'll still be obfuscated, but at least you could capture the obfuscated code portion and try to work out what it's doing manually and/or write a script to deobfuscate it.

[lavid]

Please Login or Register to see this Hidden Content

If you are lucky enough person was using trial version wich means you can use any lib to run software,idk if that helps you in any way tho.
PS here are docs 

Please Login or Register to see this Hidden Content

,take a look it will give you some clues and good luck

 

I am reverse engineering my first piece of software and already fixed the "unknown magic numbers" errors.

 

I have run into a block of code that says this and i don't know what to do. Any tips appreciated:

Please Login or Register to see this Hidden Content

[leonh03]

thank you bro  i will try this out bro!

[SkillDima]

any one know how to deobfuscate it?