如何将马歇尔码 object 转换为 PYC 文件

Question

I was reversing some obfuscated python code and I found some marshal code object. The problem is that I don't find a way to get the source code, I tried dissasemble it but I don't understand much of it, also I've tried pycd or uncompyle6 but I need the PYC file so I was wondering, How do I convert the marshal code object to a PYC file?

This is the code example:

import marshal

code = marshal.loads(b'\xe3\x00\x00\x00\x00......More Stuff')

# And now i want to convert the "code" variable to a PYC file, any ideas?

Thank you

Answer 1

The source of py_compile gave me an idea. You can mimic how the Python interpreter "compiles" the source code. However, I'm sure this is undocumented, but it works for me.

# file test.py
import importlib, sys
# Replace this with your code
code = compile('print(123)', 'file.py', 'exec')
print('Filename:', code.co_filename)
# This is the trick
pyc_data = importlib._bootstrap_external._code_to_timestamp_pyc(code)
print(pyc_data)
with open('file.pyc', 'wb') as f:
    f.write(pyc_data)

Output:

$ python3 test.py
Filename: file.py
bytearray(b'o\r\r\n\x00\x00\x00\x00 ... cut ... \x00\x00\x0c\x00')
$ python3 test.pyc
123