Author: TheSwedishLord
Date: 2026-02-27 16:19
Summary: Static deobfuscation of "PROTECT BY NONAME" — a 6-layer Python protector.
Layers peeled (no code executed, pure bytecode inspection):
1. Hex-escaped imports → zlib, base64, marshal
2. Base85 decoding → 1069-byte encrypted blob
3. XOR decryption → 32-byte cyclic key (a8a250...0133)
4. zlib decompression → 1571 bytes of marshal data
5. Marshal deserialization → Python code object
6. Variable name demangling → _Ω + random suffix → real names
Result: The recovered program is a rainbow text animation displaying "hello" with cycling HSV colors via ANSI 24-bit escape sequences.
Automated solver and 22 unit tests included in the zip.
Loading writeup...