ptn1411/skill/ida-nuitka-reconstructor

Name: ida-nuitka-reconstructor
Author: ptn1411

Claude Code and agent skill by ptn1411/skill

Trust tier 2

community

LLM review pending

Source check pending

Checking that the SKILL.md file is still in the repository.

Reconstruct Python source code from Nuitka-compiled binaries (.dll/.exe/.pyd) by extracting serialized constants from PE .rsrc/.rdata sections and using IDA Pro MCP for live decompilation. Use when the target is a Nuitka onefile/standalone binary with NO .encrypted files — the Python is compiled to C, not encrypted.

Install

npx vskill@latest install ptn1411/skill/ida-nuitka-reconstructor

SKILL.md

IDA + Nuitka Source Reconstructor

Reconstruct readable Python source from Nuitka-compiled native binaries by combining IDA Pro MCP live analysis with raw PE section constant extraction.

Language rule: All skill instructions use English.
Final summary presented to the user must be in Vietnamese.

When to Use This Skill

Condition	Use this skill
Nuitka onefile `.exe` with embedded `.dll`	✅ Yes
Nuitka standalone `.pyd` / `.dll`	✅ Yes
Nuitka + XOR/Base64 `.encrypted` files	❌ Use `nuitka-decryptor` instead
PyInstaller `.exe`	❌ Use `pyinstxtractor`
Electron `.asar`	❌ Use `electron-builder-unpacker`

Key difference from `nuitka-decryptor`: This skill handles the case where Python is compiled to C (no encrypted .py files exist). The source must be reconstructed from serialized Nuitka constants, not decrypted.

How Nuitka Onefile Works

source.py → Nuitka compiler → C code → MSVC/GCC → native .dll/.exe
                                          ↓
                              Python constants serialized into PE .rsrc section
                              (strings, function names, class names, imports, URLs, HTML, JS)

Key insight: Nuitka compiles Python logic to C, but all string constants (literals, attribute names, module names, format strings) are stored as serialized blobs in the PE .rsrc section (sometimes .rdata). These constants contain enough information to reconstruct ~80-95% of the original source.

Architecture

┌─────────────────────────────────────────────────┐
│                IDA Pro (binary loaded)           │
│  ┌───────────┐  ┌──────────┐  ┌──────────────┐  │
│  │ list_funcs│  │ decompile│  │   py_eval    │  │
│  └─────┬─────┘  └────┬─────┘  └──────┬───────┘  │
│        │              │               │          │
│        └──────────┬───┘───────────────┘          │
│                   │ MCP HTTP :13337              │
└───────────────────┼──────────────────────────────┘
                    │
         ┌──────────▼──────────┐
         │ ida_mcp_analyze.py  │  ← Step 1: Structure analysis
         └──────────┬──────────┘
                    │
         ┌──────────▼──────────────┐
         │ extract_rsrc_strings.py │  ← Step 2: Raw PE .rsrc extraction
         └──────────┬──────────────┘
                    │
         ┌──────────▼────────────────────┐
         │ reconstruct_nuitka_source.py  │  ← Step 3: Source reconstruction
         └──────────┬────────────────────┘
                    │
              reconstructed/*.py

Step 1 — IDA MCP Analysis (Live Binary)

Prerequisite: IDA Pro is open with the target binary loaded. IDA MCP server running at http://127.0.0.1:13337/mcp.

Run scripts/ida_mcp_analyze.py:

bash

python scripts/ida_mcp_analyze.py --url http://127.0.0.1:13337/mcp --out ida_analysis.json

What it does:

List exports — finds entry points (run_code, DllEntryPoint, etc.)
List functions — catalogs all named functions with addresses
Decompile key functions — pseudo-C for entry points and interesting functions
PE section mapping via py_eval — finds .rsrc / .rdata offsets and sizes
Check mapped memory — confirms which sections IDA has loaded

Known IDA limitations with Nuitka:

survey_binary timeouts on large binaries (>20MB) — script uses targeted queries instead
.rsrc section is NOT mapped by IDA — string searches (find, find_regex) return empty
IDA 9.x removed ida_search.find_binary — script uses ida_bytes.bin_search with compiled_binpat_vec_t

When IDA MCP is not available (IDA not open): Skip this step. Steps 2-3 work standalone.

Step 2 — Extract Constants from PE .rsrc Section

Run scripts/extract_rsrc_strings.py:

bash

# Basic extraction
python scripts/extract_rsrc_strings.py --binary target.dll --out extracted_strings.json
 
# With IDA analysis for cross-referencing
python scripts/extract_rsrc_strings.py --binary target.dll --ida-analysis ida_analysis.json --out extracted_strings.json
 
# Also check .rdata section
python scripts/extract_rsrc_strings.py --binary target.dll --sections rsrc,rdata --out extracted_strings.json

What it does:

Parse PE headers to locate .rsrc and .rdata sections
Read raw bytes from each section
Extract all UTF-8 printable strings (min length 4)
Categorize strings by type:

imports — module names (tkinter, playwright, json, etc.)
functions — function/method names (Nuitka prefixed with u or a)
classes — class names
urls — HTTP/HTTPS URLs and endpoints
html_js — embedded HTML/JavaScript code
format_strings — Python format strings and templates
constants — other string literals

Detect Nuitka serialization markers (u, a, s, w prefixes)
Output structured JSON for Step 3

Nuitka serialization format (see references/nuitka_serialization_format.md):

u prefix → unicode string literal (e.g., u\x0bhello world)
a prefix → attribute/identifier name (e.g., a\x04self)
Length encoded as 1-4 bytes after prefix
Strings appear in order of source code occurrence

Step 3 — Reconstruct Python Source

Run scripts/reconstruct_nuitka_source.py:

bash

# Auto-reconstruct from extracted strings
python scripts/reconstruct_nuitka_source.py \
  --strings extracted_strings.json \
  --out reconstructed/
 
# With IDA decompilation data for better structure
python scripts/reconstruct_nuitka_source.py \
  --strings extracted_strings.json \
  --ida-analysis ida_analysis.json \
  --out reconstructed/
 
# Interactive mode — shows candidates and asks for confirmation
python scripts/reconstruct_nuitka_source.py \
  --strings extracted_strings.json \
  --interactive \
  --out reconstructed/

What it does:

Import recovery — identifies import X, from X import Y from module name strings
Class/function skeleton — builds class and function definitions from attribute names
String literal placement — maps string constants to likely code locations
URL/endpoint mapping — reconstructs API call patterns
GUI reconstruction — detects tkinter/Qt patterns and rebuilds UI code
JavaScript/HTML embedding — preserves embedded code blocks
Constants and config — reconstructs module-level constants

Reconstruction accuracy depends on:

Number and quality of string constants preserved by Nuitka
Presence of format strings (reveal variable names and logic)
HTML/JS templates (often contain complete code blocks)
Error messages (reveal function flow and validation logic)

Step 4 — Verify & Test

bash

# Syntax check
python -m py_compile reconstructed/main.py
 
# Try to run (may need dependencies)
pip install playwright pyotp  # or whatever the target needs
python reconstructed/main.py
 
# Compare behavior with original
# Run original .exe and reconstructed .py side by side

Workflow Summary

1. IDA MCP    → ida_mcp_analyze.py   → Structure: exports, functions, PE layout
2. PE EXTRACT → extract_rsrc_strings.py → All string constants from .rsrc/.rdata
3. RECONSTRUCT → reconstruct_nuitka_source.py → Python source files
4. VERIFY     → Run reconstructed code, compare with original
5. REPORT     → Present findings to user IN VIETNAMESE

Integration with Other Skills

When	Chain to
Binary not yet identified	Run `binary-identifier` first
Found .encrypted files alongside .pyd	Switch to `nuitka-decryptor`
Found anti-debug in dispatcher	Use `anti-debugging-techniques`
Need to patch license check in reconstructed code	Use `binary-patcher`
Reconstructed code has obfuscated JS	Chain to `javascript-deobfuscator`
Need keygen from reconstructed license logic	Use `writerpro-pentest`

Final Report to User (always in Vietnamese)

🔬 Tái tạo source code Nuitka hoàn tất:
 
  📦 Binary phân tích : <FILENAME> (<SIZE>)
  🏗️ Kiến trúc       : Nuitka Onefile (Python <VER> → C → native)
  📊 PE Sections      : .text (<SIZE>), .rsrc (<SIZE>), .rdata (<SIZE>)
 
  🔍 IDA MCP Analysis:
    - Exports    : <COUNT> (run_code, DllEntryPoint, ...)
    - Functions  : <COUNT> identified
    - Decompiled : <COUNT> key functions
 
  📝 Constants Extracted:
    - Imports       : <COUNT> module names
    - Functions     : <COUNT> function/method names
    - Classes       : <COUNT> class names
    - URLs          : <COUNT> endpoints
    - HTML/JS       : <COUNT> embedded code blocks
    - String literals: <COUNT> constants
 
  ✅ Source Reconstructed:
    - Files    : <COUNT> .py files
    - Lines    : <COUNT> total lines
    - Accuracy : ~<PERCENT>% (estimated)
 
  💾 Output: reconstructed/
 
  ▶ Bước tiếp theo:
    - Kiểm tra code: python reconstructed/main.py
    - Tìm secrets: grep -rn "api_key\|secret\|token" reconstructed/
    - Keygen: sử dụng writerpro-pentest nếu cần

Anti-Patterns

❌ Don't	✅ Do
Search strings via IDA find/find_regex on Nuitka binary	Read raw PE bytes — .rsrc is not mapped
Use `survey_binary` on large Nuitka DLLs	Use targeted `list_funcs` + `decompile`
Assume all Nuitka apps have .encrypted files	Many are compiled-only, no encryption layer
Try to decompile Nuitka C code back to Python	Extract constants and reconstruct — C decompilation gives Nuitka runtime, not original Python
Skip IDA when available	IDA provides function structure and xrefs that improve reconstruction accuracy
Present findings in English	Always deliver final summary in Vietnamese

Security

Security scanPassed, 100 of 100Pattern checks on the skill's files.
Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingida-nuitka-reconstructor/SKILL.md

Popularity

Repository stars: 150
Repository forks: 90
7-day trend score: 25

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/ptn1411/skill/ida-nuitka-reconstructor/badge)](https://verified-skill.com/skills/ptn1411/skill/ida-nuitka-reconstructor)

Something wrong with this skill or its page? Tell us.