bytecode-decompiler--obfuscation-assistantlisted

Loads Python pyc bytecode via marshal after importlib header validation, pretty-prints raw dis, reconstructs a basic-block control-flow graph annotated with loop heads and try/except regions, renames mangled single-letter variables using usage heuristics, renders a readable structured pseudo-Python outline, flags obfuscation signatures such as missing strings, oversized constants and dynamic eval execution, and documents the uncompyle6 byte-exact pipeline when it is installable.
RMAzrim/opencode-artes · ★ 2 · AI & Automation · score 76

Install: claude install-skill RMAzrim/opencode-artes

# Bytecode Decompiler & Obfuscation Assistant ## 1. System Architecture & Prerequisites - Runtime binary: **Python 3.9 or newer** (uses `dis.get_instructions`, `ast.unparse`-free rendering, `importlib.util.MAGIC_NUMBER`, `marshal`). Tested primarily on CPython 3.9–3.13 `.pyc` files. - Standard library only: `dis`, `marshal`, `importlib.util`, `io`, `json`, `argparse`, `re`, `sys`, `pathlib`, `types.CodeType`, `dataclasses`, `typing`. - Optional (documented in Section 4, never required by the ship'ed module): **`uncompyle6`** from PyPI for byte-exact decompilation of matching CPython versions, and the `xdis` package it wraps. When the installed interpreter matches the `.pyc` version, `uncompyle6 file.pyc` produces exact source. - Input: a single `.pyc` (Python bytecode) file — either a timestamp pyc (16-byte header: magic + flags + mtime + source size), a PEP 552 hash-based pyc (magic + flags + 8-byte hash), or a bare `marshal`-dumped code object. Loading is **not** a security boundary: `marshal` can craft hostile objects; analyze only trusted files or run inside a throwaway sandbox. ## 2. Input/Output Data Contracts ### 2.1 CLI input options (JSON Schema) ```json { "$schema": "http://json-schema.org/draft-07/schema#", "title": "unpyc_assistant_cli_options", "type": "object", "properties": { "pyc": { "type": "string", "description": "Path to the .pyc file to analyze." }, "out": { "type": "string", "description": "Path where reconstructed pseudo-Pytho