AwesomeREA.org

Tool

de4py

Python deobfuscation and analysis toolkit with a PySide6 GUI and a CLI mode, aimed at analysts examining obfuscated or packed Python programs. It bundles deobfuscators for named Python obfuscators such as Jawbreaker, BlankOBF, PlusOBF, Wodx, Hyperion and pyobfuscate, and an AI-assisted "Onyx" engine that pairs a local Ollama LLM (default qwen2.5-coder:1.5b) with AST cleaning and pattern matching. A file analyzer detects packers such as PyInstaller, computes hashes, looks up suspicious strings and extracts metadata, while a behavior monitor and a Python-code execution shell support dynamic inspection of a target process. It has a plugin API and can be used as a library.

Requirements & limits

  • The reviewed main commit (2026-08-17) is 18 commits past the v3.3.2-stable release (2026-08-12) and carries the same 3.3.2 version. The README asks for Python 3.10+ and recommends Windows for full feature support, while pyproject.toml declares requires-python >=3.8. There is no PyPI package: install from source with git clone then pip install . (entry point de4py, or python -m de4py / python main.py).
  • Dependencies include PySide6 for the GUI, xdis, pefile and pyinstaller for the analyzers, plus requests, psutil, pycryptodome, colorama, pypresence and sentry-sdk; the project also ships a remote API client and Sentry telemetry. The optional Onyx AI engine needs a separately installed Ollama with the configured model pulled; the model and thresholds are set in the UI.
  • Inputs are the user's own obfuscated Python scripts or packed executables. The repository's samples directory bundles the project's own test fixtures: obfuscated Python files for each supported obfuscator and small packer-built sample executables (PyInstaller, Nuitka and py2exe outputs). No third-party application files are required.
  • Licensed CC BY-NC 4.0 (non-commercial); the README states the tool is free and open source and that any paid copies are misrepresentations, and GitHub does not classify this license. The disclaimer says the tool is for educational purposes and that software should not be deobfuscated without permission; this record covers its deobfuscation and analysis use only. Nothing was installed or run, and the reviewed sources establish no REA connection.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
App · Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · Fadi002/de4py · Revision 0f66191
  2. pyproject.toml GitHub · Fadi002/de4py · Revision 0f66191
  3. requirements.txt GitHub · Fadi002/de4py · Revision 0f66191
  4. samples GitHub · Fadi002/de4py · Revision 0f66191
  5. INFO/version GitHub · Fadi002/de4py · Revision 0f66191
  6. LICENSE GitHub · Fadi002/de4py · Revision 0f66191
  7. https://github.com/Fadi002/de4py/releases/tag/v3.3.2-stable

More in Native binaries

All 104 entries in Native binaries