{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/pyinstxtractor/pyinstxtractor-ng/blob/1ed86ccc575cf10a42454a217e72540adf359f2e/pyinstxtractor_ng.py",
    "https://github.com/pyinstxtractor/pyinstxtractor-ng/blob/1ed86ccc575cf10a42454a217e72540adf359f2e/pyinstxtractor_ng.py#L1-L15",
    "https://github.com/pyinstxtractor/pyinstxtractor-ng/blob/1ed86ccc575cf10a42454a217e72540adf359f2e/pyproject.toml",
    "https://github.com/pyinstxtractor/pyinstxtractor-ng/blob/1ed86ccc575cf10a42454a217e72540adf359f2e/requirements-dev.txt",
    "https://github.com/pyinstxtractor/pyinstxtractor-ng/blob/1ed86ccc575cf10a42454a217e72540adf359f2e/.github/workflows/build.yaml",
    "https://github.com/pyinstxtractor/pyinstxtractor-ng/blob/1ed86ccc575cf10a42454a217e72540adf359f2e/LICENSE",
    "https://github.com/pyinstxtractor/pyinstxtractor-ng/releases/tag/2026.07.03",
    "https://pypi.org/project/pyinstxtractor-ng/2026.7.3/",
    "https://github.com/extremecoders-re/pyinstxtractor/blob/815d31cf26bc71e62f851b2e549452e7b7c9dd98/README.md"
  ],
  "category": "native-analysis",
  "description_en": "Fork of PyInstaller Extractor (pyinstxtractor) by the same author that extracts the bundled CArchive files and PYZ modules from Linux ELF and Windows PE executables built with PyInstaller, writing .pyc files with repaired headers for a separate bytecode decompiler. Unlike the original script, it unmarshals the PYZ archive with the xdis library, so it does not have to run under the Python version that built the executable, and it automatically decrypts PYZ entries that PyInstaller's optional AES encryption protected, using the key module bundled in the same executable. A one-directory mode extracts the PYZ next to the other files so the result can be run directly, and --info prints archive metadata such as versions, entry points and encryption without writing files.",
  "description_zh": "PyInstaller Extractor（pyinstxtractor）的同一作者所做的分支版本，可从 PyInstaller 构建的 Linux ELF 和 Windows PE 可执行文件中提取打包的 CArchive 文件和 PYZ 模块，并输出修复了文件头的 .pyc 文件，供另行使用的字节码反编译器处理。与原脚本不同，它借助 xdis 库反序列化 PYZ 归档，因此无须在构建该可执行文件时所用的 Python 版本下运行；对于经 PyInstaller 可选 AES 加密保护的 PYZ 条目，它会利用同一可执行文件中打包的密钥模块自动解密。单目录模式会把 PYZ 内容提取到其他文件旁边，便于直接运行提取结果；--info 选项则只输出版本、入口点和加密情况等归档元数据，而不写入任何文件。",
  "entry_url": "https://awesomerea.org/resources/pyinstxtractor-ng/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/pyinstxtractor-ng/",
  "evidence_url": "https://github.com/pyinstxtractor/pyinstxtractor-ng/blob/1ed86ccc575cf10a42454a217e72540adf359f2e/README.md",
  "group": "tools",
  "id": "pyinstxtractor-ng",
  "json_url": "https://awesomerea.org/resources/pyinstxtractor-ng/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/pyinstxtractor-ng/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/pyinstxtractor-ng/index.md",
  "name": "pyinstxtractor-ng (PyInstaller Extractor Next Generation)",
  "name_zh": "pyinstxtractor-ng 新一代 PyInstaller 程序提取工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: 2026.07.03, published 2026-07-03, with a Linux binary and a Windows .exe built by PyInstaller, so those builds need no Python installation; the same version is on PyPI as pyinstxtractor-ng 2026.7.3. The reviewed main commit is two commits ahead of that tag and only relaxes the pycryptodome requirement from exactly 3.17 to 3.19.1 or later below 4.",
    "Running the script needs Python 3.8+, xdis pinned to 6.3.0 and pycryptodome; a leftover Poetry section in pyproject.toml still caps Python below 3.13. Release binaries come from a manually triggered workflow that builds with Python 3.8 and PyInstaller 5.10.1, and the repository has no tests or test executables.",
    "The script header lists PyInstaller 2.0 through 5.10.1 as supported, and the README states no version range. Entries that can be neither decompressed nor decrypted are saved unchanged with an .encrypted suffix.",
    "The PyInstaller executable comes from the user, and turning the recovered bytecode into source needs a separate decompiler. Recovered code remains subject to the rights of the original program’s owner.",
    "GPL-3.0-only."
  ],
  "requirements_zh": [
    "审阅时最新版本为 2026.07.03，发布于 2026-07-03，附带由 PyInstaller 构建的 Linux 二进制和 Windows .exe，因此使用这些构建无需安装 Python；PyPI 上也有同版本的 pyinstxtractor-ng 2026.7.3。所审阅的 main 提交比该标签多两个提交，仅把 pycryptodome 的版本要求从固定的 3.17 放宽为 3.19.1 及以上、低于 4。",
    "直接运行脚本需要 Python 3.8+、固定为 6.3.0 版的 xdis 以及 pycryptodome；pyproject.toml 中残留的 Poetry 配置段仍把 Python 限制在 3.13 以下。发布的二进制由手动触发的工作流使用 Python 3.8 和 PyInstaller 5.10.1 构建；仓库中没有测试，也没有测试用可执行文件。",
    "脚本头部列出所支持的 PyInstaller 版本为 2.0 至 5.10.1，README 未说明版本范围。既无法解压也无法解密的条目会原样保存并加上 .encrypted 后缀。",
    "PyInstaller 可执行文件由使用者自行提供；要把恢复出的字节码还原为源码，还需另用反编译器。恢复出的代码仍受原程序权利人的权利约束。",
    "采用 GPL-3.0-only 许可。"
  ],
  "targets": [
    "app",
    "binary"
  ],
  "url": "https://github.com/pyinstxtractor/pyinstxtractor-ng",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}