Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Help Needed: How to Work with Extracted .pyd Files to Retrieve Source Code #13

Open
BaseMax opened this issue Dec 5, 2024 · 2 comments

Comments

@BaseMax
Copy link

BaseMax commented Dec 5, 2024

Thank you! I used your software to decode it, and now I have several .pyd files. Could you please advise me on how to proceed in identifying and working towards retrieving the source code? Currently, I only have a collection of .pyd files.

[+] Processing ../marktplaats.exe
[+] File type: PE
[+] Payload size: 20523272 bytes
[+] Payload compression: true
[+] Beginning extraction...
[+] Total files: 673
[+] Successfully extracted to __/marktplaats.exe_extracted
@extremecoders-re
Copy link
Owner

Pyd files are compiled Python extension modules. Unfortunately it isn't possible to retrieve the source code by the usual means like decompilation as there is no Python bytecode in pyd files. Pyd files are like any other natively compiled executable. You can load a pyd file in Ghidra/IDA to have a look at the assembly code. The usual techniques to reverse engineer natively compiled executables apply here.

@Siradankullanici
Copy link

https://github.com/HydraDragonAntivirus/AutoNuitkaDecompiler You can get from there. It works against get malware payloads.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants