Bad MAGIC (0x0A0D0DA8)

[lmachens]

I have a pyc file, which has a unknown magic.
3.11 has 0x0A0D0DA7, my file has 0x0A0D0DA8 and 3.12 has 0x0A0D0DCB. I assume, it's something in between?
But opcodes like STORE_FAST_LOAD_FAST are in use (which are available in #498)

Some sample files:
bad_magic.zip

Maybe someone has an idea?

[greenozon]

0xDA7 (dec: 3495) is the last one in 3.11, not sure how did you get a pyc module with 3496.... maybe some private custom build?

https://github.com/python/cpython/blob/8303d32ff55945c5b38eeeaf1b1811dbcf8aa9be/Lib/importlib/_bootstrap_external.py#L421

[greenozon]

you could make a hack:
change the existing magic for python 3.11 and rebuild your binaries:
MAGIC_3_11 = 0x0A0D0DA7, -> 0x0A0D0DA8,
and see if it helps to decode your pyc*

[lmachens]

@greenozon
Thx!
I already did that and get Unsupported opcode: STORE_FAST_LOAD_FAST error.
Then I tried out your 3.13 PR (thx !) because it has STORE_FAST_LOAD_FAST, but it throws Unsupported opcode: INPLACE_ADD

[greenozon]

to be honest, I have some doubts you are using 3.13 version of python which is still in beta phase...

could you tell more about your app/sw/env you are using?

it's very suspicious you have some unsupported MAGIC which is in between of 3.11 and 3.12 versions...

[lmachens]

@greenozon
It's very possible, that it's a custom build.
These files are from the game Once Human, which is using Neox game engine.

[greenozon]

OK, could you identify what python is being in use over there?
some python related dlls nearby or so...

if the MAGIC sig was changed most probably the opcodes/whatever might be hacked as well!?

[lmachens]

Sadly, I couldn't find a version number.
Yes, it's possible that they hacked them as well.
Did you take a look at the files?

[greenozon]

yeah, hacked pycdas just out of curiosity...
results are "bad":

    [Disassembly]
        0       <INVALID>
        2       <INVALID>
        4       <INVALID>
        6       <INVALID>
        8       STORE_NAME                      0: bindict
        10      <INVALID>
        12      <INVALID>
        14      <INVALID>
        34      <INVALID>
        36      KW_NAMES                        1: None
        40      <INVALID>
        50      STORE_NAME                      1: data
        52      <INVALID>
        54      <INVALID>

try to inspect other *.exe; *.dll in your game folder (eg using ExeinfoPE or Die tools or whatever you got used to...)

[greenozon]

ideally if you find some python engine dll (most probably modified cpython)

[greenozon]

Basically protected/obfuscated .pyc module is a advanced topic
if you up to it and ready to spend some days/weeks, there are some nice writeups, eg:
https://www.slideshare.net/slideshow/reversingobfuscatedpythonapplications-dropbox140819110311phpapp01/38200072

[lmachens]

Thx for your time and feedback @greenozon
Are you able to extract the bindict? This is the most important variable for me.

[greenozon]

jokes aside,
figure out what protection/obfuscation applied and where is the execution environment

[rockingdice]

@lmachens as far as I know, the neox engine always does python opcode mapping for security reasons. So it's not regular pyc file to deal with.

BTW I'm surprised someone is also interested in that game as I did. Are you interested in talking in private to discuss more details about it? You can reach me: mhwo_feedback@outlook.com

[lguilhermee]

Don't know if you guys already started, but i'm reversing the game, i've never messed with python scripting built into the game only lua.

Related to code, it feels that they changed a bit the opcodes, gonna try to map it and use this project to decrypt it

[lmachens]

@lguilhermee Yes, we already started. Feel free to DM me on Discord
devleon