another error

[asukasukasukasuka]

Traceback (most recent call last):
  File "/usr/local/lib/python3.7/dist-packages/xdis-5.0.7-py3.7.egg/xdis/load.py", line 293, in load_module_from_file_object
    co = marshal.loads(bytecode)
ValueError: bad marshal data (unknown type code)
Traceback (most recent call last):
  File "/usr/local/lib/python3.7/dist-packages/xdis-5.0.7-py3.7.egg/xdis/load.py", line 293, in load_module_from_file_object
    co = marshal.loads(bytecode)
ValueError: bad marshal data (unknown type code)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/bin/decompyle3", line 33, in <module>
    sys.exit(load_entry_point('decompyle3==3.3.2', 'console_scripts', 'decompyle3')())
  File "/usr/local/lib/python3.7/dist-packages/decompyle3-3.3.2-py3.7.egg/decompyle3/bin/decompile.py", line 190, in main_bin
  File "/usr/local/lib/python3.7/dist-packages/decompyle3-3.3.2-py3.7.egg/decompyle3/main.py", line 304, in main
  File "/usr/local/lib/python3.7/dist-packages/decompyle3-3.3.2-py3.7.egg/decompyle3/main.py", line 183, in decompile_file
  File "/usr/local/lib/python3.7/dist-packages/xdis-5.0.7-py3.7.egg/xdis/load.py", line 168, in load_module
    get_code=get_code,
  File "/usr/local/lib/python3.7/dist-packages/xdis-5.0.7-py3.7.egg/xdis/load.py", line 307, in load_module_from_file_object
    "Ill-formed bytecode file %s\n%s; %s" % (filename, kind, msg)
ImportError: Ill-formed bytecode file xiami_login_downloader.pyc
<class 'ValueError'>; bad marshal data (unknown type code)

[graysuit]

Respected developer @rocky

Description

I got an suspicious python compiled file which I want to decompile and get source code. I extracted the *.pyc files using pyinstxtractor. After that I installed python-decompile3 and tried to decompile targeted pyc file but it says ImportError: Ill-formed bytecode file C:\Users\gray\Desktop\abc\Google_Update.bin_extracted\Google_Update.pyc <class 'ValueError'>; bad marshal data (unknown type code).

How to Reproduce

$ decompyle3 "C:\Users\gray\Desktop\abc\Google_Update.bin_extracted\Google_Update.pyc"
Traceback (most recent call last):
  File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\lib\site-packages\xdis\load.py", line 293, in load_module_from_file_object
    co = marshal.loads(bytecode)
ValueError: bad marshal data (unknown type code)
Traceback (most recent call last):
  File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\lib\site-packages\xdis\load.py", line 293, in load_module_from_file_object
    co = marshal.loads(bytecode)
ValueError: bad marshal data (unknown type code)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\Scripts\decompyle3-script.py", line 11, in <module>
    load_entry_point('decompyle3==3.3.2', 'console_scripts', 'decompyle3')()
  File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\lib\site-packages\decompyle3-3.3.2-py3.7.egg\decompyle3\bin\decompile.py", line 190, in main_bin
  File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\lib\site-packages\decompyle3-3.3.2-py3.7.egg\decompyle3\main.py", line 304, in main
  File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\lib\site-packages\decompyle3-3.3.2-py3.7.egg\decompyle3\main.py", line 183, in decompile_file
  File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\lib\site-packages\xdis\load.py", line 168, in load_module
    get_code=get_code,
  File "C:\Users\gray\AppData\Local\Programs\Python\Python37-32\lib\site-packages\xdis\load.py", line 307, in load_module_from_file_object
    "Ill-formed bytecode file %s\n%s; %s" % (filename, kind, msg)
ImportError: Ill-formed bytecode file C:\Users\gray\Desktop\abc\Google_Update.bin_extracted\Google_Update.pyc
<class 'ValueError'>; bad marshal data (unknown type code)

Expected behavior

I expected it would deliver python code. Obfucticated, mangled, or discordered code doesn't matter. I need just code to check whats inside.

Environment

Python 3.7.3

Version: 3.3.2
Summary: Python cross-version byte-code decompiler
Home-page: https://github.com/rocky/python-decompyle3/
Author: Rocky Bernstein, Hartmut Goebel, John Aycock, and others
Author-email: rb@dustyfeet.com
License: GPL3
Location: c:\users\gray\appdata\local\programs\python\python37-32\lib\site-packages\decompyle3-3.3.2-py3.7.egg
Requires: spark-parser, xdis
Required-by:

3.7.3 (v3.7.3:ef4ec6ed12, Mar 25 2019, 21:26:53) [MSC v.1916 32 bit (Intel)]

windows 10 pro 32 bit 10.0.15063 N/A Build 15063

I am not sure whether I can get its python bytecode without source code or not. But I do have some testing malware file. Its same which I am using. Please let me know, if anything unclear or missing. I would surely corporate.
Regards.

Only Pyc File :
Google_Update.zip

All extracted files:
https://filebin.net/rxj0h6kj07wa7ylc

Virustotal report:
https://www.virustotal.com/gui/file/e968e6cb3e74f73ae90c4d691c777aebe7e43d500bb7c447d4a83da78aa300d5/detection

[rocky]

This kind of thing feels like something you should pay someone to help you with.

if you make a contribution to the project under the support page, I'll consider looking into to this. (The larger the donation, the more llikely I'll do it.) But it for me it has to be done on the weekend.

I also mention elsewhere someone else you might contact.

[graysuit]

This kind of thing feels like something you should pay someone to help you with.

Sure, donation is your right.

I also mention elsewhere someone else you might contact.

No need, owner knows about his code more than any other. lol

By the way, is this problem is in decompile3 or in my file ? Can you shortly describe it ?

[rocky]

I'll guess your file since that's the easier of the two paths. Quite frankly, I personally am not all that interested in this.

And given all the number of open tickets and volunteers for these kinds of problems or other work on the other kinds of problems, I don't think anyone else is either.