python逆向之pyc文件

本文转载自查看原文 2022-01-28 00:10 1053 『CTFer & RE』

最近做题老是遇到python逆向，没有经验，查了一些资料，记录一下

Python是一门解释性语言，没有严格意义上的编译和汇编过程

解释型语言没有严格编译汇编过程，由解释器将代码块按需要变运行边翻译给机器执行。因此解释型语言一度存在运行效率底，重复解释的问题。

但是通过对解释器的优化!可以提高解释型语言的运行效率。Python就属于这一种编程语言。

一、pyc文件

1、pyc文件概述

Pyc文件是py编译过程中产生的字节码文件，可以由虚拟机直接执行，是python将目标源码编译成字节码以后在磁盘上的文件形式

2、pyc文件结构（python 2.6.2 和 python3.8）

/* Bytecode object */

typedef struct {

    PyObject_HEAD

    int co_argcount;            /*  Code Block的位置参数个数，比如说一个函数的位置参数个数*/

    int co_nlocals;             /*  Code Block中局部变量的个数，包括其中位置参数的个数 */

    int co_stacksize;           /* 执行该段Code Block需要的栈空间 */

    int co_flags;               /* CO_..., see below */

    PyObject *co_code;          /* Code Block编译所得的字节码指令序列。以PyStingObjet的形式存在 */

    PyObject *co_consts;        /* PyTupleObject对象，保存CodeBlock中的所常量 */

    PyObject *co_names;         /* PyTupleObject对象，保存CodeBlock中的所有符号 */

    PyObject *co_varnames;      /* Code Block中的局部变量名集合 */

    PyObject *co_freevars;      /* Python实现闭包需要用的东西 */

    PyObject *co_cellvars;      /* Code Block中内部嵌套函数所引用的局部变量名集合 */

    /* The rest doesn't count for hash/cmp */

    PyObject *co_filename;      /* Code Block所对应的.py文件的完整路径 */

    PyObject *co_name;          /* Code Block的名字，通常是函数名或类名 */

    int co_firstlineno;         /* Code Block在对应的.py文件中起始行 */

    PyObject *co_lnotab;        /* 字节码指令与.py文件中source code行号的对应关系，以PyStringObject的形式存在 */

    void *co_zombieframe;     /* for optimization only (see frameobject.c) */

} PyCodeObject;

python3.8:

typedef struct {
    PyObject_HEAD
    int co_argcount;            /* #arguments, except *args */
    int co_posonlyargcount;     /* #positional only arguments */
    int co_kwonlyargcount;      /* #keyword only arguments */
    int co_nlocals;             /* #local variables */
    int co_stacksize;           /* #entries needed for evaluation stack */
    int co_flags;               /* CO_..., see below */
    int co_firstlineno;         /* first source line number */
    PyObject *co_code;          /* instruction opcodes */
    PyObject *co_consts;        /* list (constants used) */
    PyObject *co_names;         /* list of strings (names used) */
    PyObject *co_varnames;      /* tuple of strings (local variable names) */
    PyObject *co_freevars;      /* tuple of strings (free variable names) */
    PyObject *co_cellvars;      /* tuple of strings (cell variable names) */
    /* The rest aren't used in either hash or comparisons, except for co_name,
       used in both. This is done to preserve the name and line number
       for tracebacks and debuggers; otherwise, constant de-duplication
       would collapse identical functions/lambdas defined on different lines.
    */
    Py_ssize_t *co_cell2arg;    /* Maps cell vars which are arguments. */
    PyObject *co_filename;      /* unicode (where it was loaded from) */
    PyObject *co_name;          /* unicode (name, for reference) */
    PyObject *co_lnotab;        /* string (encoding addr<->lineno mapping) See
                                   Objects/lnotab_notes.txt for details. */
    void *co_zombieframe;       /* for optimization only (see frameobject.c) */
    PyObject *co_weakreflist;   /* to support weakrefs to code objects */
    /* Scratch space for extra data relating to the code object.
       Type is a void* to keep the format private in codeobject.c to force
       people to go through the proper APIs. */
    void *co_extra;

    /* Per opcodes just-in-time cache
     *
     * To reduce cache size, we use indirect mapping from opcode index to
     * cache object:
     *   cache = co_opcache[co_opcache_map[next_instr - first_instr] - 1]
     */

    // co_opcache_map is indexed by (next_instr - first_instr).
    //  * 0 means there is no cache for this opcode.
    //  * n > 0 means there is cache in co_opcache[n-1].
    unsigned char *co_opcache_map;
    _PyOpcache *co_opcache;
    int co_opcache_flag;  // used to determine when create a cache.
    unsigned char co_opcache_size;  // length of co_opcache.
} PyCodeObject;