Python Frozen App Reversing

SkillWeb & browsing

Guides your agent through python claude skill steps to recover hidden logic from packaged Python executables.

Use Python Frozen App Reversing in Claude, ChatGPT or Ahel Desktop

Free. Sign in, add Python Frozen App Reversing and connect your AI. About a minute.

Claude ChatGPT Ahel Desktop

Also: Claude Code · Cursor · Codex

Then ask your AI: use the Python Frozen App Reversing skill

Details

Instructions available. Your AI can read the instructions. Execution depends on the setup they require.

Account requirements not reviewed. Check the skill instructions before use; ahel provides instructions and does not run this skill.

No other account needed.

Add ahel to your AI once: Claude, ChatGPT, Cursor, Claude Code or Codex. Then ask it to use this.

Python Frozen App ReversingStart free

About this skill

Recover logic from PyInstaller, cx_Freeze, py2exe, Nuitka, and other frozen Python applications, including modified bootloaders, decoy entry scripts, patched frozen standard-library modules, embedded marshal code objects, and logic hidden inside pythonXY.dll or libpython. Use for packaged Python exe

What this skill tells your AI

The instructions your AI receives, as published by manyuegong33/r0crawl_skills in skills/python-frozen-app-reversing/SKILL.md and read by ahel’s review.

Preserve the environment

Record hashes, architecture, packer evidence, Python version, and tool versions. Use a dedicated virtual environment for extractors; do not downgrade shared dependencies.

Inventory every layer

Identify the container using imports, strings, overlay magic, and process behavior.
List the archive TOC before extraction.
Extract the archive and record every script, runtime hook, PYZ entry, native extension, and Python runtime library.
Disassemble entry scripts with a Python-version-compatible tool.
Run scripts/scan_frozen_artifacts.py across the entire extraction tree using runtime output and function identifiers as markers.

Treat an inert entry script as evidence

If the extracted entry script exits or lacks observed behavior, inspect in this order:

PyInstaller runtime hooks and bootstrap scripts
Frozen modules embedded in pythonXY.dll or libpython
Modified standard-library modules
Custom bootloader calls before script execution
Runtime-created code objects

Do not conclude that extraction failed solely because main.pyc is a decoy.

Locate modified frozen modules

Search all extracted binaries for unique runtime text, function names, exception text, and nearby Python identifiers.
Compare the bundled runtime library with the same upstream Python version when available.
Inspect _PyImport_Frozen* tables, marshal tags, code-object names, filenames such as <frozen os>, and clusters of Python names/constants.
Use the exact bundled Python version to deserialize marshal data; marshal is version-specific.

See references/modified-runtime.md for the decision tree.

Cross the runtime boundary early

Prove whether output and input stacks enter pythonXY.dll or libpython. If they do, stop treating CRT or Win32 I/O as the verifier and route to cpython-runtime-introspection.

Deliverables

container and archive inventory
real execution location: archive entry, frozen module, runtime library, or loader
recovered code object or equivalent verifier
offsets and hashes for every derived artifact
live validation of the recovered answer

Signals

GitHub stars: 294
Forks: 103
Last commit: Sep 2026

ahel review

K6low
bundled executables the agent is told to run

Automated review, not a security audit. Ruleset v1+k2.

Advanced

Item type: skill
Key: python-frozen-app-reversing
Source: github.com/manyuegong33/r0crawl_skills

github.com/manyuegong33/r0crawl_skills