Python Frozen App Reversing
SkillWeb & browsingGuides your agent through python claude skill steps to recover hidden logic from packaged Python executables.
Available today. Use it from your connected AI after setup.
No other account needed.
Add ahel to your AI once: Claude, ChatGPT, Cursor, Claude Code or Codex. Then ask it to use this.
Then ask your AI: use the Python Frozen App Reversing skill
About this skill
Recover logic from PyInstaller, cx_Freeze, py2exe, Nuitka, and other frozen Python applications, including modified bootloaders, decoy entry scripts, patched frozen standard-library modules, embedded marshal code objects, and logic hidden inside pythonXY.dll or libpython. Use for packaged Python exe
What this skill tells your AI
The instructions your AI receives, as published by manyuegong33/r0crawl_skills in skills/python-frozen-app-reversing/SKILL.md and read by ahel’s review.
Preserve the environment
Record hashes, architecture, packer evidence, Python version, and tool versions. Use a dedicated virtual environment for extractors; do not downgrade shared dependencies.
Inventory every layer
- Identify the container using imports, strings, overlay magic, and process behavior.
- List the archive TOC before extraction.
- Extract the archive and record every script, runtime hook, PYZ entry, native extension, and Python runtime library.
- Disassemble entry scripts with a Python-version-compatible tool.
- Run
scripts/scan_frozen_artifacts.pyacross the entire extraction tree using runtime output and function identifiers as markers.
Treat an inert entry script as evidence
If the extracted entry script exits or lacks observed behavior, inspect in this order:
- PyInstaller runtime hooks and bootstrap scripts
- Frozen modules embedded in
pythonXY.dllorlibpython - Modified standard-library modules
- Custom bootloader calls before script execution
- Runtime-created code objects
Do not conclude that extraction failed solely because main.pyc is a decoy.
Locate modified frozen modules
- Search all extracted binaries for unique runtime text, function names, exception text, and nearby Python identifiers.
- Compare the bundled runtime library with the same upstream Python version when available.
- Inspect
_PyImport_Frozen*tables, marshal tags, code-object names, filenames such as<frozen os>, and clusters of Python names/constants. - Use the exact bundled Python version to deserialize marshal data; marshal is version-specific.
See references/modified-runtime.md for the decision tree.
Cross the runtime boundary early
Prove whether output and input stacks enter pythonXY.dll or libpython. If they do, stop treating CRT or Win32 I/O as the verifier and route to cpython-runtime-introspection.
Deliverables
- container and archive inventory
- real execution location: archive entry, frozen module, runtime library, or loader
- recovered code object or equivalent verifier
- offsets and hashes for every derived artifact
- live validation of the recovered answer
Signals
- GitHub stars
- 285
- Forks
- 100
- Last commit
- Sep 2026
ahel review
K6low
bundled executables the agent is told to run
Automated review, not a security audit. Ruleset v1+k2.
Advanced
- Catalog kind
- skill
- Key
python-frozen-app-reversing- Source
- github.com/manyuegong33/r0crawl_skills