Menu

#4 Unrecognized installer?

2.0
wont-fix
nobody
None
2016-03-05
2016-03-04
BC
No

Using this exe http://archive.evilzone.org/hacking-and-security/netbox-blue-help/?action=dlattach;attach=7131
I am not certain it was created with PyInstaller, however, it does have a PYZ section. If I manually extract the PYZ section and then modify your program to just extract it, then I am able to get the .pyc files and then disassemble them to .py

Is it not being recognized properly or is it not actually PyInstaller?

Discussion

  • ExtremeCoders

    ExtremeCoders - 2016-03-05

    Its indeed pyinstaller.

    It's not recognized since it is digitally signed. The tool recognizes pyinstaller executables by checking the appended data at the end of the executable (called overlay). This data should end with the magic cookie in order to be recognized by pyinstaller.

    For digitally signed executables, the authenticode signature is appended after the magic cookie hence the tool fails.

    If you remove the last 8045 (0x1F6D) bytes from the executable i.e. the digital signature, the tool will work normally.

     
  • BC

    BC - 2016-03-05

    Thanks for the feedback and the excellent tool!

     
  • ExtremeCoders

    ExtremeCoders - 2016-03-05
    • status: open --> wont-fix
     

Log in to post a comment.