How to Reverse Marshal-Obfuscated Python (3 Tested Methods)

Strip away the base64 and the loader is completely mechanical. Your source is compiled to a code object, that object is marshal.dumps()'d to bytes, usually compressed, base64-encoded, and handed to exec:

import marshal, zlib, base64
exec(marshal.loads(zlib.decompress(base64.b64decode(
    "eJxLy8xJ..."        # your entire program, encoded
))))

There is no key anywhere in that pipeline — base64 and zlib/zstd are reversible transforms, and marshal is the interpreter's own format. Every step that packed the code has a public inverse, so reversing it is just running the pipeline backwards. The compression is only there to shrink the blob (see zlib vs zstd for bytecode); it adds nothing to protection.

Copy the base64 string out of the loader and reverse the exact steps it would — but stop at marshal.loads, which gives you a code object you can inspect instead of execute:

import marshal, zlib, base64, dis

blob = "eJxLy8xJ..."          # the base64 string from the loader

raw  = zlib.decompress(base64.b64decode(blob))   # if the loader used zstd, use
                                                 # compression.zstd.decompress here
code = marshal.loads(raw)                        # a code object — NOT executed

print([c for c in code.co_consts if isinstance(c, str)])   # the string literals
dis.dis(code)                                              # the full logic

Run against a sample whose "secret" is an API key and a licence check, this is the real output — the strings the author thought were hidden come straight back, and the disassembly spells out the logic:

['sk-live-9f83a1', 'PRO-2026']        # the "encrypted" key + licence, in the clear

  1  LOAD_CONST  0 ('sk-live-9f83a1')
     STORE_NAME  0 (API_KEY)
  2  ...MAKE_FUNCTION... (check)
  4  LOAD_NAME   (print) ... LOAD_CONST 2 ('PRO-2026') ...
# inside check(pw):  COMPARE_OP  (pw == 'PRO-2026')

Method 1 needs you to find and copy the blob. When the loader is messier — or when the sample is untrusted and you refuse to run it — there's a cleaner trick: run the loader in a namespace where exec is your function instead of the builtin. The loader does all its own decoding, then calls exec(code) — which lands in your capture instead of executing:

import dis

loader = open("suspicious.py").read()   # the exec(marshal.loads(...)) file

captured = []
# a globals dict whose 'exec' shadows the builtin — the loader calls ours
g = {"exec": lambda obj, *a, **k: captured.append(obj)}
exec(loader, g)          # base64/decompress/marshal.loads all run;
                         # the final exec(code) is intercepted, not executed
code = captured[0]       # the payload's code object — never ran a line of it

print([c for c in code.co_consts if isinstance(c, str)])
dis.dis(code)

['sk-live-9f83a1', 'PRO-2026']
nested functions: ['check']
# captured a code object without running a single line of the sample

dis gives you logic; for readable `.py` you feed the code object to a decompiler. Decompilers eat .pyc files, so wrap your recovered code object in a 16-byte .pyc header and write it out:

import marshal, importlib.util, struct, time

# `code` is the code object from Method 1 or 2.
header  = importlib.util.MAGIC_NUMBER            # 4-byte version magic
header += struct.pack("<I", 0)                   # flags
header += struct.pack("<I", int(time.time()))    # timestamp
header += struct.pack("<I", 0)                   # source size

with open("recovered.pyc", "wb") as f:
    f.write(header + marshal.dumps(code))

# then decompile it to real source:
#   pycdc recovered.pyc
# or drop recovered.pyc into the online .pyc decompiler

From there it's an ordinary decompilation job: pycdc (Decompyle++) handles modern bytecode, uncompyle6/decompyle3 give the cleanest output on Python ≤3.9, and our in-browser .pyc decompiler runs pycdc via WebAssembly so you can do it with nothing installed. As always, full-source decompilers lag the newest Python releases — but even when they can't rebuild perfect .py, Methods 1 and 2 already handed you the strings and the control flow. (More on that in how to decompile a .pyc.)

Some packers stack the trick — marshal inside marshal, or a loader that execs another loader. It changes nothing: you peel one layer at a time. With Method 1, each marshal.loads hands you a code object whose co_consts contains the next blob; with Method 2, the shadow-exec fires again for each inner exec, so you capture every layer as it's unwrapped. There's no depth that survives, because every layer still has to decode itself to run.

Everything above works because marshaling is a cache format, not a lock: no key, a public inverse for every step, and string literals stored verbatim. That's why shipping exec(marshal.loads(...)) protects nothing — and why it also trips antivirus, which flags that exact pattern. If you actually need to raise the cost of reverse-engineering:

1. Obfuscate the source before you marshal it. Rename every identifier and encrypt the string literals at the AST level, so even a recovered code object is gibberish with no readable secrets. Our free Python Obfuscator does this — then marshaling the result is at least hiding *mangled* code.
2. Keep real secrets off the client. As Method 1 shows, a hard-coded key survives every layer. Load keys from the environment or a server you control — see protecting API keys in Python.
3. For the strongest bar, compile to a native module (.pyd/.so via Cython, or a Nuitka binary) so there's no marshaled bytecode to loads at all.

Want to see the whole loop end to end? Build a marshal loader with our Marshal Encryptor, then run these methods on your own output — the fastest way to internalise that marshaling is a speed bump, not a wall.