RePyInstaller

A command‑line binary analyzer for Windows PE files. It extracts detailed metadata, detects packers/compilers (especially Python bundlers), and outputs results in human‑readable text or JSON.

Features

• PE header analysis (entry point, imports, sections)
• Entropy calculation for the whole file and per section
• String extraction (ASCII and UTF‑16LE)
• Heuristic detection of:
  • Python packers: PyInstaller, Nuitka, py2exe, cx_Freeze, PyArmor, PyOxidizer, shiv, pex
  • .NET utilities: Mono, ILMerge, Costura, Fody, Obfuscators
  • Other languages: Go, Rust
  • Packers/Protectors: UPX, ASPack, VMProtect, Themida, Enigma, Armadillo, MPRESS, PECompact, Petite, FSG, RLPack, and more
• Score‑based detection with evidence collection
• Optional verbose mode for detailed inspection
• Output to console and/or file, with automatic file naming

Installation

Clone the repository and build with Cargo:

git clone https://github.com/CodeHorizon0/RePyInstaller.git
cd RePyInstaller
cargo build --release

The binary will be located at target/release/RePyInstaller.

Usage

RePyInstaller <FILE> [OPTIONS]

Options

Option	Description
--json	Output in JSON format (default: colourised text)
--verbose	Show detailed information (imports, sections, evidence)
-o, --output <FILE>	Write output to a specific file (default: <input>_analysis.txt or .json)
--no-file	Do not write to a file; only print to console
-h, --help	Print help information
-V, --version	Print version information

Examples

Basic analysis:

RePyInstaller sample.exe

Analysis with verbose output:

RePyInstaller sample.exe --verbose

JSON output to a custom file:

RePyInstaller sample.exe --json --output result.json

Console‑only analysis (no file):

RePyInstaller sample.exe --no-file

Example Output (text mode)

=== RePyInstaller Analysis ===
File:     sample.exe
Size:     9474975 bytes
SHA256:   a91a17ad6e4b36fb733e9161782f48a56f8b36f4d59ad69ab1f7263165d827fb
Entropy:  6.6291
Is PE:    Yes
Strings:  52526
Detected: Fody

Scores:
  Fody: 10
  .NET: 5
  Mono: 5
  VMProtect: 5
  ...

JSON Output

The JSON schema includes file, size, sha256, entropy, is_pe, strings, detector (with detected, scores, evidence), and pe (with available, entry_point, imports, sections).