How to patch a .pyc file in existing pyinstaller build? about pyinstxtractor HOT 6 CLOSED

https://github.com/extremecoders-re/pyinstxtractor/wiki/Replacing-files-inside-the-CArchive

In this article, the new file has to be less than the old one.
what to do if the new file is more in size??

from pyinstxtractor.

Will that violate any checksums or anything?

There no checksums used anywhere in pyinstaller.

In this article, the new file has to be less than the old one.
what to do if the new file is more in size??

If the new file is larger in size than the older it implies all other files which are located after that file have to be shifted. As a result, the table of contents of the CArchive has to be updated with the new offsets for all the affected files.

from pyinstxtractor.

Yes, I shifted everything properly and I updated the TOC also the Cookie.

The patched program does not execute properly. I get killed as soon as i run the program.
The thing is that the position of the cookie is also updated, but I dont know there the offset of the cookie is stored, so that is not updated, hence maybe that is why it does not execute.

As a sanity check i ran pyinstxtractor.py on the pathced file, and it is able to extract everything without any error. so i have updated all offsets etc ( which are mentioned in your script ) properly.

Also, I am on a mac.

from pyinstxtractor.

I think there is some content in the tail which has to be updated, idk what all though.

from pyinstxtractor.

I see. Mac is tricky. If you go through the pyinstaller source, it requires signing the executable. The modifications invalidates the signature and could be the reason why the process gets killed immediately.

https://github.com/pyinstaller/pyinstaller/blob/779a94968ecc55e0cc23ea89cb3b6523e7cff576/PyInstaller/building/api.py#L785-L806

https://github.com/pyinstaller/pyinstaller/blob/779a94968ecc55e0cc23ea89cb3b6523e7cff576/PyInstaller/building/api.py#L822-L845

from pyinstxtractor.

Yup, unsigning it, then patching it and signing it again works. Thanks.
Whats surprising is that you dont have to do that if the payload is smaller in size.

from pyinstxtractor.