ptn1411/skill/pyinstaller-unpacker

Name: pyinstaller-unpacker
Author: ptn1411

Claude Code and agent skill by ptn1411/skill

Trust tier 2

community

LLM review pending

Source check pending

Checking that the SKILL.md file is still in the repository.

Fully automated PyInstaller extraction and decompilation pipeline. Extracts .pyc from onefile/onedir bundles, fixes headers, and batch-decompiles with pycdc/uncompyle6/decompile3 fallback chain.

Install

npx vskill@latest install ptn1411/skill/pyinstaller-unpacker

SKILL.md

PyInstaller Unpacker & Decompiler

Extract and decompile Python source from PyInstaller-bundled executables (.exe/.elf).

Language rule: All skill instructions use English.
Final summary presented to the user must be in Vietnamese.

0. Authorization & Routing

Operates under MASTER_POLICY.md §1-§2.

Sibling skill	When
binary-identifier	Upstream — confirms target is PyInstaller
nuitka-decryptor	If misidentified — Nuitka ≠ PyInstaller
writerpro-pentest	Downstream — keygen from recovered source
javascript-deobfuscator	If embedded Electron+PyInstaller hybrid

How PyInstaller Works

source.py → PyInstaller → CArchive → native bootloader + embedded .pyc/.pyz
                              ↓
              MEI magic marker at end of file: b'MEI\x0c\x0b\x0a\x0b\x0e'
              TOC (Table of Contents) lists all embedded files
              PYZ archive contains all imported modules as .pyc

Two modes:

Onefile: Single .exe with temp extraction at runtime. Everything in CArchive.
Onedir: Directory with main .exe + _internal/ folder containing .pyc/.pyd/.dll.

Key challenge: PyInstaller strips .pyc headers (first 16 bytes: magic + flags + timestamp + size). Must restore before decompilation.

Step 1 — Recon: Confirm PyInstaller

Look for these markers:

MEI magic at end of file (8 bytes)
Strings: _MEIPASS, _MEI, pyi_rth_, pyiboot
Section names or overlay data past PE end

bash

python scripts/unpack_pyinstaller.py --detect-only target.exe

powershell

python scripts\unpack_pyinstaller.py --detect-only target.exe

Step 2 — Extract .pyc Files

bash

python scripts/unpack_pyinstaller.py target.exe --out unpacked/

powershell

python scripts\unpack_pyinstaller.py target.exe --out unpacked\

What it does:

Detect PyInstaller variant (onefile/onedir) and Python version
If pyinstxtractor-ng available → use it (best compatibility)
Fallback → manual CArchive parsing (built-in, no deps)
Fix .pyc headers with correct magic number for detected Python version
Extract PYZ archive (all imported modules)
Write manifest.json listing all extracted files

Step 3 — Decompile .pyc to .py

bash

python scripts/decompile_pyc.py --pyc-dir unpacked/ --out decompiled/

powershell

python scripts\decompile_pyc.py --pyc-dir unpacked\ --out decompiled\

Fallback chain (version-aware):

Python version	Primary	Secondary	Last resort
3.9+	pycdc	decompile3	dis (bytecode)
3.6–3.8	uncompyle6	pycdc	dis
3.5 and below	uncompyle6	—	dis

Step 4 — Verify & Analyze

bash

head -50 decompiled/main.py
grep -rn "api_key\|secret\|password\|token\|license" decompiled/

Workflow

1. DETECT    → unpack_pyinstaller.py --detect-only → confirm PyInstaller + version
2. EXTRACT   → unpack_pyinstaller.py → .pyc files + PYZ modules
3. DECOMPILE → decompile_pyc.py → .py source files
4. ANALYZE   → grep for secrets, license logic, endpoints
5. REPORT    → Present findings IN VIETNAMESE

Final Report to User (always in Vietnamese)

📦 Giải nén PyInstaller hoàn tất:
 
  🔍 Loại          : PyInstaller <onefile|onedir>
  🐍 Python        : <VERSION>
  📁 Files trích xuất: <COUNT> files
  📝 Decompile      : <SUCCESS>/<TOTAL> files thành công
 
  🔑 Phát hiện đáng chú ý:
    - <secrets, license logic, endpoints>
 
  💾 Output: decompiled/
 
  ▶ Bước tiếp theo:
    grep -rn "api_key\|secret" decompiled/

Anti-Patterns

❌ Don't	✅ Do
Assume all Python exes are PyInstaller	Run binary-identifier first — could be Nuitka, cx_Freeze, py2exe
Skip .pyc header fix	PyInstaller strips headers — decompilers fail without them
Use only one decompiler	Version-aware fallback chain catches more files
Ignore PYZ archive	It contains all imported modules — often more interesting than main script
Decompile without knowing Python version	Magic bytes differ per version — wrong header = wrong output

Security

Security scanPassed, 100 of 100Pattern checks on the skill's files.
Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingpyinstaller-unpacker/SKILL.md

Popularity

Repository stars: 150
Repository forks: 90
7-day trend score: 25

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/ptn1411/skill/pyinstaller-unpacker/badge)](https://verified-skill.com/skills/ptn1411/skill/pyinstaller-unpacker)

Something wrong with this skill or its page? Tell us.