Fadi002/de4py

What it solves

De4py addresses the difficulty of analyzing obfuscated Python code, which is often used in malware or protected software to hide its true logic. It provides tools to reverse these obfuscations, making the code readable for malware analysts and reverse engineers.

How it works

The tool uses a hybrid approach to deobfuscation:

• Onyx Engine: Leverages local LLMs via Ollama (defaulting to qwen2.5-coder:1.5b) combined with Abstract Syntax Tree (AST) cleaning, pattern matching, and control-flow flattening recovery to simplify complex code.
• Legacy Support: Includes direct deobfuscators for specific popular obfuscators like Jawbreaker, BlankOBF, and Hyperion.
• Analysis Tools: Features a file analyzer for detecting packers (like PyInstaller), a behavior monitor for tracking memory and socket access, and a Pyshell GUI for executing code within target processes.

Who it’s for

It is designed for malware analysts, reverse engineers, and security researchers who need to inspect and understand obfuscated Python scripts.

Highlights

• AI-Powered: Uses local LLMs for advanced code simplification.
• Comprehensive Analysis: Includes packer detection, metadata extraction, and real-time behavior monitoring.
• Dynamic Execution: Allows running Python code inside external target processes.
• Extensible: Features a plugin architecture and a programmable API for custom analyzers.
• User-Friendly: Offers a modern PySide6 GUI with support for over 18 languages.