base on toolkit for python reverse engineering > [!IMPORTANT] > this project has been officially archived. It has been a rewarding experience to develop and share this project with the community. However, I’ve noticed that many users lack the necessary coding or reverse engineering experience to fully benefit from the project. This has led to an increase in basic questions and issues that detract from the project's original intent. --- <a href="#home"><img src="https://github.com/Fadi002/de4py/blob/main/Pictures/de4py.jpg?raw=true"></img></a> # de4py <p align="center"><b>important note: IF YOU ARE A SKID AND DON'T KNOW HOW TO CODE OR USE AI TO CODE AND HAVE NO EXPERIENCE AT ALL THEN THIS TOOL IS NOT FOR YOU !!!</b></p> <p align="center"><b>what is de4py?</b></p> De4py are an Advanced python deobfuscator with a beautiful UI and a set of Advanced features that enables malware analysts and reverse engineers to deobfuscate python files and more. this project is maintained by me (<a href="https://github.com/Fadi002">Fadi002</a>) and my friend <a href="https://github.com/AdvDebug">AdvDebug</a>. ## Features <table> <th align="left">Feature</th> <th align="left">Function</th> <tbody> <tr> <td>Deobfuscation</td> <td>De4py support some popular obfuscators, like: Jawbreaker, BlankOBF, PlusOBF, Wodx, Hyperion, pyobfuscate.com obfuscator</td> </tr> <tr> <td>Pycode Execution</td> <td>Executing your python code inside the process which can be useful in many cases to make the program do something you want to make it do, for example if the program have licensing and it calls the real "main" only if you bought the program you can call it directly.</td> </tr> <tr> <td>Strings Dump</td> <td>Dumping Strings in the python process and saving it as a file which can be pretty useful to extract data from memory such as webhooks.</td> </tr> <tr> <td>Removing Exit Function</td> <td>Removing the exit function which can be extremely useful if the python program tried to exit itself if it found a debugger or a VM</td> </tr> <tr> <td>Getting All Functions</td> <td>Getting all functions inside the python process which can be really useful when trying to modify a python function in memory</td> </tr> <tr> <td>Pyshell GUI</td> <td>Custom GUI to make it easy to execute python code inside the desired process.</td> </tr> <tr> <td>GUI and Console Support</td> <td>De4py supports both console and GUI, but why use console when you can have a nice-on-the-eyes GUI, am i right? ;)</td> </tr> <tr> <td>File Analyzer</td> <td>an analyzer that have many features like detecting if the python program is packed and tries to unpack it if it was using pyinstaller for example, it also got a feature that shows either all strings or suspicious strings (suspicious strings like: IPs, websites, and "token" "discord" "leveldb" strings and other suspicious strings in the file) and shows them in a nice output window.</td> </tr> <tr> <td>Behavior Monitoring</td> <td>De4py can monitor python processes and see if they opened any files handles, opened a process, wrote/readed the memory of other processes and also monitoring if the process terminated other processes, in addition to sockets monitoring (including the size of data that is being sent and the ip that is being sent/recieved from) along with dumping socket content to a file and dumping OpenSSL encrypted content decrypted into a file, and PYC dumping.</td> </tr> <tr> <td>Plugins system</td> <td>You can add plugins to de4py to customize the theme or add custom deobfuscators <a href="https://github.com/Fadi002/de4py-plugins-repo">plugins repo and docs here</a></td> </tr> <tr> <td>API system</td> <td>You can use de4py features such as deobfusctor engine and pyshell in your own tools <a href="https://github.com/Fadi002/de4py/tree/main/api">API docs here</a></td> </tr> </tbody> </table> ## Screenshots <p float="left"> <a href="#Screenshots"><img src="https://github.com/Fadi002/de4py/blob/main/Pictures/Home.png?raw=true" width="400"></img></a> <a href="#Screenshots"><img src="https://github.com/Fadi002/de4py/blob/main/Pictures/Deobfuscator.png?raw=true" width="400"></img></a> <a href="#Screenshots"><img src="https://github.com/Fadi002/de4py/blob/main/Pictures/Shell.png?raw=true" width="400"></img></a> <a href="#Screenshots"><img src="https://github.com/Fadi002/de4py/blob/main/Pictures/WinAPIHooking.png?raw=true" width="400"></img></a> <a href="#Screenshots"><img src="https://github.com/Fadi002/de4py/blob/main/Pictures/Analyzer.png?raw=true" width="400"></img></a> <a href="#Screenshots"><img src="https://github.com/Fadi002/de4py/blob/main/Pictures/About.png?raw=true" width="400"></img></a> <a href="#Screenshots"><img src="https://github.com/Fadi002/de4py/blob/main/Pictures/CLI.png?raw=true" width="400"></img></a> </p> ## Contributions All contributions are welcomed. ## Social media links At this moment we have discord only https://discord.gg/cYxxUHsbRm ## Issues Please before open issue read the [FAQ](https://github.com/Fadi002/de4py/blob/main/FAQ.md). ## Disclaimer This tool are for educational purposes only, never try deobfuscating someone's software without permission, ALL developers and contributors are not responsible for any kind of misuse. ## License Notice this tool are licensed under GNU General Public License v3.0. ", Assign "at most 3 tags" to the expected json: {"id":"6043","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"