zrax/pycdc
Pycdc
pycdc is a reverse engineering toolset that decompiles and disassembles compiled Python bytecode files back into readable source code. It parses .pyc file headers, reconstructs abstract syntax trees from bytecode instructions, and handles version-specific opcodes across Python versions 1.0 through 3.13 with endian-aware binary parsing.
The tool recovers numeric constants, string literals, and marshalled Python objects from compiled bytecode, supporting both file-based and in-memory bytecode loading. It provides a human-readable disassembly listing of bytecode instructions alongside full source code reconstruction, with the ability to decompile marshalled code objects when the target Python version is specified.
The project covers binary data structure recovery, marshalled object extraction, and multi-version Python reverse engineering through a command-line interface that outputs formatted results. It is distributed as a C++ executable that reads .pyc files or bytecode buffers and produces decompiled Python source code.
Features
- Bytecode Decompilers - Translate compiled Python bytecode back into readable source code by analyzing and reconstructing the original program structure.
- Python Reverse Engineering - Analyzes, parses, and decompiles compiled Python code objects from binary files for security and forensics.
- Multi-Version Python Decompilers - Handles bytecode from Python versions 1.0 through 3.13 with version-specific opcode mapping and endian-aware parsing.
- Bytecode Disassemblers - Converts compiled Python bytecode into human-readable assembly-like listings of opcodes and operands.
- Bytecode File Header Analysis - Parses .pyc file headers to identify Python language version, encoding settings, and other metadata for correct decompilation.
- Binary Data Structure Reconstructors - Reconstructing high-level data types like strings, tuples, and lists from raw bytecode streams in compiled files.
- String Literal Decoding - Decodes and formats Unicode, ASCII, interned, and short string objects from compiled bytecode with proper quoting and escaping.
- Bytecode Numeric Recovery - Reconstructs integer, floating-point, and complex number literals from both string-stored and binary-encoded bytecode representations.
- Marshalled Code Object Processing - Decompile marshalled code objects from Python's marshal format, reconstructing source code when the target Python version is specified.
- Multi-Version Bytecode Analyzers - Analyzing and decompiling bytecode across Python versions 1.0 through 3.13 with version-specific opcode handling.
- Marshal Format Deserializers - Loads serialized Python objects from a byte stream, reconstructing their types and values for further processing.
- Version-Specific Bytecode Dispatch - Handle bytecode from Python versions 1.0 through 3.13 by mapping version-specific opcodes to a common internal representation.
- Bytecode-to-AST Reconstruction - Translates raw bytecode instruction sequences into an abstract syntax tree that mirrors the original program structure.
- Bytecode String Decoders - Decode and format string objects stored in .pyc files, handling Unicode, ASCII, interned, and short string types with proper quoting.
- Python Bytecode Integer Literals - Reconstructs integer literal values from compiled bytecode, handling both standard and arbitrary-precision integers.
- Decompilers - Python bytecode disassembler and decompiler.
