pycdc icon indicating copy to clipboard operation
pycdc copied to clipboard

[bug]pycdc decode python3.8 exception handling fail!

Open longxinyun-security opened this issue 2 years ago • 6 comments

image

PycRef<ASTNode> res = value.cast<ASTCall>()->pparams().front();

value.cast<ASTCall>()->pparams().size()==0

stack = stack_hist.top(); stack.pop();

stack_hist.size()==0

longxinyun-security avatar May 10 '22 09:05 longxinyun-security

I also had a similar error last night, when I tried to decompile the pyc file compiled with python 3.10, the message "Unsupported opcode: BLA_BLA_BLA" appears.

I think this is an error because the pyc file that will be decoded is a bytecode file compiled with python 3.9 and above, and the opcodes that are not supported by pycdc are opcodes that just appeared in python version 3.9 and above.

so I tried reading the ASTree.cpp file and studying it, then I realized that the opcode that was printed as an error was not in the "case block" of the ASTree.cpp file.

I tried to change it a little by adding the opcodes printed in the error message into the case block (on line 1166)

case Pyc::JUMP_IF_NOT_EXC_MATCH_A:
case Pyc::RERAISE_A:

then rebuild it. I don't know what happened but it solved my problem when trying to decompile python 3.9 and above bytecode. everything is done!

karjok avatar Jun 06 '22 02:06 karjok

I also had a similar error last night, when I tried to decompile the pyc file compiled with python 3.10, the message "Unsupported opcode: BLA_BLA_BLA" appears.

I think this is an error because the pyc file that will be decoded is a bytecode file compiled with python 3.9 and above, and the opcodes that are not supported by pycdc are opcodes that just appeared in python version 3.9 and above.

so I tried reading the ASTree.cpp file and studying it, then I realized that the opcode that was printed as an error was not in the "case block" of the ASTree.cpp file.

I tried to change it a little by adding the opcodes printed in the error message into the case block (on line 1166)

case Pyc::JUMP_IF_NOT_EXC_MATCH_A:
case Pyc::RERAISE_A:

then rebuild it. I don't know what happened but it solved my problem when trying to decompile python 3.9 and above bytecode. everything is done!

Thanks, bro !

longxinyun-security avatar Jun 06 '22 02:06 longxinyun-security

just add the unsupported opcode to the case block in the ASTree.cpp file as above. hope it helps :) Thanks for replying.

karjok avatar Jun 06 '22 02:06 karjok

it need more than "just add", but useful if just want to see the code.

Original

try:
    f = open("demofile.txt")
    try:
        f.write("Lorum Ipsum")
    except:
        print("Something went wrong when writing to the file")
    finally:
        f.close()
except:
  print("Something went wrong when opening the file")

Decompiled

# Source Generated with Decompyle++
# File: tes.pyc (Python 3.9)  

try:
    f = open('demofile.txt')
    try:
        try:
            f.write('Lorum Ipsum')
        finally:
            pass
        print('Something went wrong when writing to the file')
        if None:
            pass
        f.close()
        f.close()
        if None:
            pass
        print('Something went wrong when opening the file')
        if None:
            return None


ewwink avatar Jun 21 '22 17:06 ewwink

I also had a similar error last night, when I tried to decompile the pyc file compiled with python 3.10, the message "Unsupported opcode: BLA_BLA_BLA" appears.

I think this is an error because the pyc file that will be decoded is a bytecode file compiled with python 3.9 and above, and the opcodes that are not supported by pycdc are opcodes that just appeared in python version 3.9 and above.

so I tried reading the ASTree.cpp file and studying it, then I realized that the opcode that was printed as an error was not in the "case block" of the ASTree.cpp file.

I tried to change it a little by adding the opcodes printed in the error message into the case block (on line 1166)

case Pyc::JUMP_IF_NOT_EXC_MATCH_A:
case Pyc::RERAISE_A:

then rebuild it. I don't know what happened but it solved my problem when trying to decompile python 3.9 and above bytecode. everything is done!

Could you elaborate on adding those cases to the corresponding line? I inserted the lines you shared but still cannot decode try/except blocks. I have a segmentation fault error instead

rrblgn avatar Dec 03 '22 13:12 rrblgn

Python CFG recognition is a labor-intensive task, and many instructions in new versions are not supported by pycdc, requiring the addition of a large amount of code and testing in ASTree.cpp. The "Unsupported opcode" error is issued in the BuildFromCode function and needs to be fixed in the switch/case of this function. My translation was generated by an AI as my English is not very good.

longxinyun-security avatar Jun 14 '23 13:06 longxinyun-security

Duplicate #449

zrax avatar Feb 21 '24 22:02 zrax