A Python script to extract and fix PyInstaller executable contents for decompilation.
PyInstaller Extractor is a Python script that extracts the contents of PyInstaller-generated executable files. It unpacks the embedded Python bytecode and resources, fixing pyc file headers so they can be decompiled back to readable Python source code. This tool is essential for analyzing, debugging, or recovering source code from packaged Python applications.
Security researchers, forensic analysts, and developers who need to inspect or reverse-engineer PyInstaller-packaged Python applications, especially for malware analysis, code recovery, or debugging purposes.
It provides a simple, script-based solution that works across many PyInstaller versions and Python environments, automatically handling header fixes that are necessary for decompilation, unlike manual extraction methods.
PyInstaller Extractor
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Explicitly lists support for PyInstaller versions from 2.0 to 6.19.0 and beyond, ensuring compatibility with a wide range of executables generated over many years.
Can natively extract both Windows executables and Linux ELF binaries without additional tools, as highlighted in the README's section on Linux extraction.
Automatically repairs pyc file headers to make them compatible with standard decompilers like Uncompyle6, simplifying the recovery of Python source code.
Runs on both Python 2 and 3, though the README recommends matching the executable's Python version to prevent unmarshalling errors during extraction.
To avoid extraction errors, users must run the script with the same Python version as the executable, which can be inconvenient if the version is unknown or unavailable.
Does not support encrypted PyInstaller executables, as indicated by the reference to pyinstxtractor-ng for that feature, limiting its use in secured environments.
After extraction, users need separate decompilers like Uncompyle6 to convert pyc files to readable source, adding complexity to the reverse-engineering process.