PyInstaller Extractor - Dynamic Magic Detection

A fork of pyinstxtractor by Extreme Coders that detects PyInstaller archives without relying on hardcoded magic bytes.

The Problem

The original pyinstxtractor uses a hardcoded magic constant to find the archive cookie:

MAGIC = b'MEI\014\013\012\013\016'  # or b'CYB\x0c\x0b\n\x0b\x0e' in newer versions

If someone modifies the magic bytes in their PyInstaller build (common in malware/custom packing), the extractor fails because it can't find the expected pattern.

The Solution

This fork validates the cookie structurally instead of searching for a specific byte pattern. The PyInstaller cookie always has the same 88-byte layout:

Offset  Size  Field           Validation
------  ----  -----           ----------
 0       8    magic           (any value accepted)
 8       4    toc_rel_offset  must point within the file
12       4    entry_offset    must point within the file
16       4    toc_size        > 0 and < file_size / 2
20       4    pyver           200..400 (Python 2.0 - 4.0)
24      64    pylib_name      must contain "python"

It reads the last 88 bytes of the file, parses the integer fields, and validates that:

• Python version is in a reasonable range (200–400)
• The library name contains "python"
• TOC size is positive and not absurdly large
• Computed overlay and TOC positions are within the file

Result: works with ANY custom magic bytes without modification.

Usage

python pyinstxtractor.py <pyinstaller-packed.exe>

The script will:

1. Auto-detect the PyInstaller cookie (any magic)
2. Auto-detect the Python version from DLL references in the binary
3. Set appropriate pyc magic bytes for decompilation
4. Extract all files from CArchive and PYZ archives

Example output:

[+] Processing C:\target.exe
[+] File size: 18619055 bytes (17.76 MB)
[+] Scanning for PyInstaller cookie structure...
[+] PyInstaller cookie found at offset: 0x11c1a57
[+] Pyinstaller version: 2.1+
[+] Python version from cookie: 3.11
[+] Found 104 files in CArchive
[+] Successfully extracted pyinstaller archive: C:\target.exe

Requirements

• Python 3.x (no external dependencies)
• For PYZ extraction, run under the same Python version as the target

Credit

Based on pyinstxtractor by Extreme Coders, licensed under GPL v3.

License

GNU General Public License v3