python2 反編譯pyinstaller打包的可執行exe檔案

先上個連結，基於python3的反編譯python打包的exe檔案的教程

 https://blog.csdn.net/weixin_46847476/article/details/105358131

故事開始於pyinstxtractor.py 反編譯query.exe檔案後不會直接生成query.py檔案，是沒有副檔名的query檔案，需要根據struct檔案修改query檔案，具體是往query檔案裡新增若干個16進位制字串，此例是16個hex。

C:\Users\netmanager\Desktop\python_test>dir
 驅動器 C 中的卷沒有標籤。
 卷的序列號是 1556-183E

 C:\Users\netmanager\Desktop\python_test 的目錄

2020-10-07  20:52    <DIR>          .
2020-10-07  20:52    <DIR>          ..
2020-10-07  20:40                 0 mod_hex_py2.py
2020-10-07  12:26             1,467 query
2020-10-07  20:52                 0 query.py
2020-10-07  12:26             1,467 query.pyc
2020-10-07  12:26               234 struct
               5 個檔案          3,168 位元組
               2 個目錄 56,282,697,728 可用位元組

C:\Users\netmanager\Desktop\python_test>dir
 驅動器 C 中的卷沒有標籤。
 卷的序列號是 1556-183E

 C:\Users\netmanager\Desktop\python_test 的目錄

2020-10-07  21:21    <DIR>          .
2020-10-07  21:21    <DIR>          ..
2020-10-07  21:21               941 mod_hex_py2.py
2020-10-07  12:26             1,467 query
2020-10-07  20:52                 0 query.py
2020-10-07  12:26             1,467 query.pyc
2020-10-07  21:21             1,475 query2.pyc
2020-10-07  12:26               234 struct
               6 個檔案          5,584 位元組
               2 個目錄 56,280,313,856 可用位元組


C:\Users\netmanager\Desktop\python_test>uncompyle6 -o . query2.pyc
query2.pyc --
# Successfully decompiled file

C:\Users\netmanager\Desktop\python_test>dir
 驅動器 C 中的卷沒有標籤。
 卷的序列號是 1556-183E

 C:\Users\netmanager\Desktop\python_test 的目錄

2020-10-07  21:23    <DIR>          .
2020-10-07  21:23    <DIR>          ..
2020-10-07  21:21               941 mod_hex_py2.py
2020-10-07  12:26             1,467 query
2020-10-07  20:52                 0 query.py
2020-10-07  12:26             1,467 query.pyc
2020-10-07  21:23             1,401 query2.py
2020-10-07  21:21             1,475 query2.pyc
2020-10-07  12:26               234 struct
               7 個檔案          6,985 位元組
               2 個目錄 56,280,096,768 可用位元組

C:\Users\netmanager\Desktop\python_test>dir
 驅動器 C 中的卷沒有標籤。
 卷的序列號是 1556-183E

 C:\Users\netmanager\Desktop\python_test 的目錄

2020-10-07  21:37    <DIR>          .
2020-10-07  21:37    <DIR>          ..
2020-10-07  21:37             1,028 mod_hex_py2.py
2020-10-07  12:26             1,467 query
2020-10-07  20:52                 0 query.py
2020-10-07  12:26             1,467 query.pyc
2020-10-07  21:23             1,401 query2.py
2020-10-07  21:21             1,475 query2.pyc
2020-10-07  21:37             1,475 query3.pyc
2020-10-07  12:26               234 struct
               8 個檔案          8,547 位元組
               2 個目錄 56,278,953,984 可用位元組

C:\Users\netmanager\Desktop\python_test>uncompyle6 query3.pyc
# uncompyle6 version 3.7.4
# Python bytecode 2.7 (62211)
# Decompiled from: Python 2.7.18 (v2.7.18:8d21aa21f2, Apr 20 2020, 13:19:08) [MSC v.1500 32 bit (Intel)]
# Embedded file name: query.py
# Compiled at: 1995-09-28 00:18:56
import wmi, os
f = os.popen('systeminfo | findstr \xcf\xb5\xcd\xb3\xd0\xcd\xba\xc5')
print f.read()
f.close()

def sys_version():
    c = wmi.WMI()
    print '\nOS:'
    for sys in c.Win32_OperatingSystem():
        print sys.Caption, sys.BuildNumber, sys.OSArchitecture, sys.CSName, sys.RegisteredUser,

    print '\nCPU:'
    for processor in c.Win32_Processor():
        print processor.Name.strip()

    print '\nMemory:'
    for Memory in c.Win32_PhysicalMemory():
        print int(Memory.Capacity) // 1073741824, 'GB'

    print '\nDISK:'
    for physical_disk in c.Win32_DiskDrive():
        if physical_disk.Size:
            print '\t' + str(physical_disk.Caption) + ' :\t' + str(long(physical_disk.Size) // 1000000000) + 'GB'

    print '\nIP:'
    for interface in c.Win32_NetworkAdapterConfiguration(IPEnabled=1):
        print 'MAC: %s' % interface.MACAddress
        for ip_address in interface.IPAddress:
            print '\tIP: %s' % ip_address

    print '\nBIOS:'
    bios = c.Win32_BIOS()[0]
    print bios.Version
    print bios.Manufacturer
    print bios.ReleaseDate


sys_version()
rawinput_a = raw_input('\xc7\xeb\xb9\xd8\xb1\xd5\xb3\xcc\xd0\xf2')
# okay decompiling query3.pyc

C:\Users\netmanager\Desktop\python_test>

 上面是命令提示符cmd操作過程

下面是給query檔案頭部加上struct檔案的前16個16進位制字串的程式碼，用於python2,

python3的開頭的連結裡有。

# -*- coding: cp936 -*-
'''python v2.7
print binascii.hexlify.__doc__
b2a_hex(data) -> s; Hexadecimal representation of binary data.
---
print binascii.unhexlify.__doc__
a2b_hex(hexstr) -> s; Binary data of hexadecimal representation.
hexstr must contain an even number of hex digits (upper or lower case).

'''
import binascii
file = 'query'
with open(file,'rb') as f:
    content = f.read()
a = binascii.hexlify(content)
print 'query檔案的前30個HEX字串'
print a[:30]
print '*'*30
file1 = 'struct'
with open(file1,'rb') as f1:
    content1 = f1.read()
b = binascii.hexlify(content1)
print 'struct檔案的前30個HEX字串'
print b[:30]
prefix_part = binascii.unhexlify(b[:16])
#經比較,pyinstxtractor.py反編譯後的"query"檔案少了16個HEX字元
f2 = open('query3.pyc','wb')
f2.write(prefix_part) # 加上"struct"檔案的前16個HEX字元對應的頭部檔案binary data
f2.write(content) # 把query檔案寫入query3.pyc
f2.close()
f.close()
f1.close()
raw_input_a = raw_input('完成頭部檔案新增,在當前目錄查詢query3.pyc')