{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/extremecoders-re/pyinstxtractor/blob/815d31cf26bc71e62f851b2e549452e7b7c9dd98/pyinstxtractor.py",
    "https://github.com/extremecoders-re/pyinstxtractor/blob/815d31cf26bc71e62f851b2e549452e7b7c9dd98/pyinstxtractor.py#L405-L419",
    "https://github.com/extremecoders-re/pyinstxtractor/blob/815d31cf26bc71e62f851b2e549452e7b7c9dd98/LICENSE",
    "https://github.com/extremecoders-re/pyinstxtractor/releases/tag/2026.07"
  ],
  "category": "native-analysis",
  "description_en": "Single-file Python script that extracts the contents of executables built with PyInstaller, including Linux ELF builds without other tools. It locates the PyInstaller archive in the executable, reports the PyInstaller and Python versions and likely entry-point scripts, and writes out the bundled CArchive files and the modules in the PYZ archive. It fixes the headers of the extracted .pyc files so that Python bytecode decompilers such as uncompyle6 and Decompyle++ (pycdc) recognize them.",
  "description_zh": "单文件 Python 脚本，用于提取由 PyInstaller 构建的可执行文件的内容，Linux ELF 构建也无需借助其他工具即可提取。它在可执行文件中定位 PyInstaller 归档，报告 PyInstaller 和 Python 版本以及可能的入口脚本，并导出打包在 CArchive 中的文件和 PYZ 归档中的模块。它还会修复导出的 .pyc 文件头，使 uncompyle6、Decompyle++（pycdc）等 Python 字节码反编译器能够识别。",
  "entry_url": "https://awesomerea.org/resources/pyinstxtractor/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/pyinstxtractor/",
  "evidence_url": "https://github.com/extremecoders-re/pyinstxtractor/blob/815d31cf26bc71e62f851b2e549452e7b7c9dd98/README.md",
  "group": "tools",
  "id": "pyinstxtractor",
  "json_url": "https://awesomerea.org/resources/pyinstxtractor/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/pyinstxtractor/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/pyinstxtractor/index.md",
  "name": "PyInstaller Extractor (pyinstxtractor)",
  "name_zh": "PyInstaller Extractor（pyinstxtractor）PyInstaller 程序提取工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Runs under Python 2.x or 3.x and needs no PyInstaller installation. Latest release at review: 2026.07, published 2026-07-22 without attached files; it tags the reviewed master commit, whose script header still calls itself version 2.0. The README lists PyInstaller 2.0 through 6.19.0 as tested against a separate test-binary repository and supported.",
    "Modules in the PYZ archive are extracted only when the script runs under the same Python major and minor version that built the executable; otherwise it warns and skips them, and an archive whose table of contents fails to unmarshal is skipped too. Entries that cannot be decompressed, such as those of encrypted PYZ archives, are saved unchanged with an .encrypted suffix rather than decoded.",
    "The PyInstaller executable comes from the user, and turning the recovered bytecode into source needs a separate decompiler. Recovered code remains subject to the rights of the original program’s owner.",
    "GPL-3.0."
  ],
  "requirements_zh": [
    "可在 Python 2.x 或 3.x 下运行，无需安装 PyInstaller。审阅时最新版本为 2026.07，发布于 2026-07-22，未附带任何文件；该标签指向所审阅的 master 提交，而脚本头部仍自称 2.0 版。README 列出 PyInstaller 2.0 至 6.19.0 各版本已用独立的测试样本仓库测试并受支持。",
    "只有当脚本运行的 Python 主次版本与构建该可执行文件时所用的版本相同时，才会提取 PYZ 归档中的模块；否则会发出警告并跳过，目录表无法反序列化的归档同样会被跳过。无法解压的条目（例如加密 PYZ 归档中的条目）会原样保存并加上 .encrypted 后缀，而不会被解码。",
    "PyInstaller 可执行文件由使用者自行提供；要把恢复出的字节码还原为源码，还需另用反编译器。恢复出的代码仍受原程序权利人的权利约束。",
    "采用 GPL-3.0 许可。"
  ],
  "targets": [
    "app",
    "binary"
  ],
  "url": "https://github.com/extremecoders-re/pyinstxtractor",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}