pyinstxtractor-ng

What it is and what it does

pyinstxtractor-ng is a reverse-engineering tool that unpacks PyInstaller-frozen executables to recover their embedded Python bytecode, libraries, and resources. It works on both Windows PE and Linux ELF binaries and can automatically decrypt encrypted PyInstaller archives. The tool uses xdis to unmarshal bytecode, so you don't need to match the Python version that built the original executable.

You can use it as a library in Python code or run precompiled standalone binaries on systems without Python installed. It offers three main modes: full extraction to a directory, one-directory mode for immediate execution of extracted files, and info-only mode to inspect archive metadata without writing files.

Use it for:

• Recover source code or dependencies from a PyInstaller executable when original sources are lost.
• Inspect and debug what libraries and resources are bundled inside a frozen Python application.
• Analyze encrypted PyInstaller archives to understand their structure and contents.
• Extract bytecode for reverse engineering or security analysis of compiled Python applications.
• Restore a working Python environment from a frozen executable for modification or testing.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Extracts Python bytecode and resources from PyInstaller-generated executables (Windows PE and Linux ELF), with support for automatic decryption of encrypted archives.

Yes, if you need to extract or analyze PyInstaller executables. Low install friction, active maintenance, no known vulnerabilities, and straightforward dependencies. The copyleft license is a consideration only if you plan to redistribute or embed the tool itself; using it to extract your own executables has no license implications.

Install

pyinstxtractor-ng on PyPI

pip install pyinstxtractor-ng

uv add pyinstxtractor-ng

poetry add pyinstxtractor-ng

Installing pyinstxtractor-ng

Before you install

Low friction install with just two runtime dependencies (pycryptodome and xdis). Active maintenance with a release 42 days ago. Supports Python 3.8 through 3.12.

License in practice

GPL-3.0-only copyleft license means any derivative work or distribution must also be licensed under GPL-3.0. Use this if you're comfortable with copyleft obligations; avoid if you need to incorporate it into proprietary code.

Quickstart

pip install pyinstxtractor-ng

from pyinstxtractor_ng import PyInstExtractor

extractor = PyInstExtractor('path/to/executable.exe')
extractor.extract()

Requires the target PyInstaller executable to be accessible; precompiled binaries are available if you want to run without Python installed.

Verify before relying

• Whether the package can handle all PyInstaller versions or has known compatibility limits.
• Performance characteristics when extracting large or heavily encrypted executables.
• Whether bytecode decompilation is included or if xdis is used only for unmarshalling.

Package facts

Evidence: pyinstxtractor_ng-2026.7.3-py3-none-any.whl

Tags

More Utilities packages