Package: uncompyle6
Contentsuncompyle6IntroductionWhy this?RequirementsInstallationRunning TestsUsageVerificationKnown Bugs/RestrictionsSee Alsouncompyle6A native Python cross-version decompiler and fragment decompiler.
The successor to decompyle, uncompyle, and uncompyle2.Introductionuncompyle6translates Python bytecode back into equivalent Python
source code. It accepts bytecodes from Python version 1.0 to version
3.8, spanning over 24 years of Python releases. We include Dropbox’s
Python 2.5 bytecode and some PyPy bytecodes.Why this?Ok, I’ll say it: this software is amazing. It is more than your
normal hacky decompiler. Usingcompilertechnology, the program
creates a parse tree of the program from the instructions; nodes at
the upper levels that look a little like what might come from a Python
AST. So we can really classify and understand what’s going on in
sections of Python bytecode.Building on this, another thing that makes this different from other
CPython bytecode decompilers is the ability to deparse justfragmentsof source code and give source-code information around a
given bytecode offset.I use the tree fragments to deparse fragments of codeat run timeinside mytrepandebuggers. For that, bytecode offsets are recorded
and associated with fragments of the source code. This purpose,
although compatible with the original intention, is yet a little bit
different.  Seethisfor more information.Python fragment deparsing given an instruction offset is useful in
showing stack traces and can be encorporated into any program that
wants to show a location in more detail than just a line number at
runtime.  This code can be also used when source-code information does
not exist and there is just bytecode. Again, my debuggers make use of
this.There were (and still are) a number of decompyle, uncompyle,
uncompyle2, uncompyle3 forks around. Many of them come basically from
the same code base, and (almost?) all of them are no longer actively
maintained. One was really good at decompiling Python 1.5-2.3, another
really good at Python 2.7, but that only. Another handles Python 3.2
only; another patched that and handled only 3.3.  You get the
idea. This code pulls all of these forks together andmoves
forward. There is some serious refactoring and cleanup in this code
base over those old forks. Even more experimental refactoring is going
on indecompyle3.This demonstrably does the best in decompiling Python across all
Python versions. And even when there is another project that only
provides decompilation for subset of Python versions, we generally do
demonstrably better for those as well.How can we tell? By taking Python bytecode that comes distributed with
that version of Python and decompiling these.  Among those that
successfully decompile, we can then make sure the resulting programs
are syntactically correct by running the Python interpreter for that
bytecode version.  Finally, in cases where the program has a test for
itself, we can run the check on the decompiled code.We use an automated processes to find bugs. In the issue trackers for
other decompilers, you will find a number of bugs we’ve found along
the way. Very few to none of them are fixed in the other decompilers.RequirementsThe code in the git repository can be run from Python 2.4 to the
latest Python version, with the exception of Python 3.0 through
3.2. Volunteers are welcome to address these deficiencies if there a
desire to do so.The way it does this though is by segregating consecutive Python versions into
git branches:masterPython 3.6 and up (uses type annotations)python-3.3-to-3.5Python 3.3 through 3.5 (Generic Python 3)python-2.4Python 2.4 through 2.7 (Generic Python 2)PyPy 3-2.4 and later works as well.The bytecode files it can read have been tested on Python
bytecodes from versions 1.4, 2.1-2.7, and 3.0-3.8 and later PyPy
versions.InstallationYou can install from PyPI using the nameuncompyle6:$ pip install uncompyle6To install from source code, this project uses setup.py, so it follows the standard Python routine:$ pip install -e .  # set up to run from source treeor:$ python setup.py install # may need sudoA GNU Makefile is also provided somake install(possibly as root or
sudo) will do the steps above.Running Tests$  make checkA GNU makefile has been added to smooth over setting running the right
command, and running tests from fastest to slowest.If you haveremakeinstalled, you can see the list of all tasks
including tests viaremake --tasksUsageRun$ uncompyle6 *compiled-python-file-pyc-or-pyo*For usage help:$ uncompyle6 -hVerificationIn older versions of Python it was possible to verify bytecode by
decompiling bytecode, and then compiling using the Python interpreter
for that bytecode version. Having done this, the bytecode produced
could be compared with the original bytecode. However as Python’s code
generation got better, this no longer was feasible.If you want Python syntax verification of the correctness of the
decompilation process, add the--syntax-verifyoption. However since
Python syntax changes, you should use this option if the bytecode is
the right bytecode for the Python interpreter that will be checking
the syntax.You can also cross compare the results with either another version ofuncompyle6since there are are sometimes regressions in decompiling
specific bytecode as the overall quality improves.For Python 3.7 and 3.8, the code indecompyle3is generally
better.Or try specific another python decompiler likeuncompyle2,unpyc37,
orpycdc.  Since the later two work differently, bugs here often
aren’t in that, and vice versa.There is an interesting class of these programs that is readily
available give stronger verification: those programs that when run
test themselves. Our test suite includes these.And Python comes with another a set of programs like this: its test
suite for the standard library. We have some code intest/stdlibto
facilitate this kind of checking too.Known Bugs/RestrictionsThe biggest known and possibly fixable (but hard) problem has to do
with handling control flow. (Python has probably the most diverse and
screwy set of compound statements I’ve ever seen; there
are “else” clauses on loops and try blocks that I suspect many
programmers don’t know about.)All of the Python decompilers that I have looked at have problems
decompiling Python’s control flow. In some cases we can detect an
erroneous decompilation and report that.Python support is pretty good for Python 2On the lower end of Python versions, decompilation seems pretty good although
we don’t have any automated testing in place for Python’s distributed tests.
Also, we don’t have a Python interpreter for versions 1.6, and 2.0.In the Python 3 series, Python support is is strongest around 3.4 or
3.3 and drops off as you move further away from those versions. Python
3.0 is weird in that it in some ways resembles 2.6 more than it does
3.1 or 2.7. Python 3.6 changes things drastically by using word codes
rather than byte codes. As a result, the jump offset field in a jump
instruction argument has been reduced. This makes theEXTENDED_ARGinstructions are now more prevalent in jump instruction; previously
they had been rare.  Perhaps to compensate for the additionalEXTENDED_ARGinstructions, additional jump optimization has been
added. So in sum handling control flow by ad hoc means as is currently
done is worse.Between Python 3.5, 3.6, 3.7 there have been major changes to theMAKE_FUNCTIONandCALL_FUNCTIONinstructions.Python 3.8 removesSETUP_LOOP,SETUP_EXCEPT,BREAK_LOOP, andCONTINUE_LOOP, instructions which may
make control-flow detection harder, lacking the more sophisticated
control-flow analysis that is planned. We’ll see.Currently not all Python magic numbers are supported. Specifically in
some versions of Python, notably Python 3.6, the magic number has
changes several times within a version.We support only released versions, not candidate versions.Note
however that the magic of a released version is usually the same as
thelastcandidate version prior to release.There are also customized Python interpreters, notably Dropbox,
which use their own magic and encrypt bytecode. With the exception of
the Dropbox’s old Python 2.5 interpreter this kind of thing is not
handled.We also don’t handlePJOrionor otherwise obfuscated code. For
PJOrion try: PJOrionDeobfuscatorto unscramble the bytecode to get
valid bytecode before trying this tool;pydeciphermight help with that.This program can’t decompile Microsoft Windows EXE files created byPy2EXE, although we can probably decompile the code after you extract
the bytecode properly.Pydeinstallermay help with unpacking Pyinstaller bundlers.Handling pathologically long lists of expressions or statements is
slow. We don’t handleCythonor MicroPython which don’t use bytecode.There are numerous bugs in decompilation. And that’s true for every
other CPython decompiler I have encountered, even the ones that
claimed to be “perfect” on some particular version like 2.4.As Python progresses decompilation also gets harder because the
compilation is more sophisticated and the language itself is more
sophisticated. I suspect that attempts there will be fewer ad-hoc
attempts likeunpyc37(which is based on a 3.3 decompiler) simply
because it is harder to do so. The good news, at least from my
standpoint, is that I think I understand what’s needed to address the
problems in a more robust way. But right now until such time as
project is better funded, I do not intend to make any serious effort
to support Python versions 3.8 or 3.9, including bugs that might come
in. I imagine at some point I may be interested in it.You can easily find bugs by running the tests against the standard
test suite that Python uses to check itself. At any given time, there are
dozens of known problems that are pretty well isolated and that could
be solved if one were to put in the time to do so. The problem is that
there aren’t that many people who have been working on bug fixing.Some of the bugs in 3.7 and 3.8 are simply a matter of back-porting
the fixes in decompyle3. Volunteers are welcome to do so.You may run across a bug, that you want to report. Please do so after
readingHow to report a bugand
follow theinstructions when opening an issue.Be aware that it might not get my attention for a while. If you
sponsor or support the project in some way, I’ll prioritize your
issues above the queue of other things I might be doing instead.See Alsohttps://github.com/rocky/python-decompile3: Much smaller and more modern code, focusing on 3.7 and 3.8. Changes in that will get migrated back here.https://code.google.com/archive/p/unpyc3/: supports Python 3.2 only. The above projects use a different decompiling technique than what is used here. Currently unmaintained.https://github.com/figment/unpyc3/: fork of above, but supports Python 3.3 only. Includes some fixes like supporting function annotations. Currently unmaintained.https://github.com/wibiti/uncompyle2: supports Python 2.7 only, but does that fairly well. There are situations whereuncompyle6results are incorrect whileuncompyle2results are not, but more often uncompyle6 is correct when uncompyle2 is not. Becauseuncompyle6adheres to accuracy over idiomatic Python,uncompyle2can produce more natural-looking code when it is correct. Currentlyuncompyle2is lightly maintained. See its issuetrackerfor more details.How to report a bugTheHISTORYfile.https://github.com/rocky/python-xdis: Cross Python version disassemblerhttps://github.com/rocky/python-xasm: Cross Python version assemblerhttps://github.com/rocky/python-uncompyle6/wiki: Wiki Documents which describe the code and aspects of it in more detailhttps://github.com/zrax/pycdc: The README for this C++ code says it aims to support all versions of Python. You can aim your slign shot for the moon too, but I doubt you are going to hit it. This code is best for Python versions around 2.7 and 3.3 when the code was initially developed. Accuracy for current versions of Python3 and early versions of Python is lacking. Without major effort, it is unlikely it can be made to support current Python 3. See itsissue trackerfor details. Currently lightly maintained.