How to Decompile a PyInstaller EXE: Step‑by‑Step Guide

Tools used:

pyinstxtractor.py – extracts the contents of a PyInstaller‑packed exe into a folder.

uncompyle6 – decompiles .pyc files back to Python source.

010Editor (or any binary editor) – view and edit binary data.

Installation

pip install uncompyle6

Step 1: Unpack the exe

python3 pyinstxtractor.py ***.exe  # replace with your target exe

This creates a folder named filename_extracted containing the unpacked data.

Step 2: Add missing header

PyInstaller removes the first eight bytes of the .pyc file. You must prepend them: the first four bytes are the Python version magic number, the next four are the timestamp. Retrieve the version from the struct information inside the original exe.

1. Locate the file named after the exe (without extension) in the extracted folder.

2. Open it with 010Editor, copy the first eight bytes.

3. Open the target file (e.g., abc_text) and insert the copied bytes at the beginning.

4. Rename the file to add the .pyc extension.

Step 3: Decompile the .pyc

The resulting .pyc can now be decompiled. Use uncompyle6:

uncompyle6 abc_text.pyc > abc_text.py

The command produces the original Python source file.