Skip to content

Instantly share code, notes, and snippets.

@johnjohnsp1
Forked from simonw/recover_source_code.md
Created March 12, 2017 12:56
Show Gist options
  • Save johnjohnsp1/cf74c7e1c60f7ba9c3fb380fc79c44fa to your computer and use it in GitHub Desktop.
Save johnjohnsp1/cf74c7e1c60f7ba9c3fb380fc79c44fa to your computer and use it in GitHub Desktop.
How to recover lost Python source code if it's still resident in-memory

I screwed up with git and managed to delete the code I had just written... but it was still running in a process in a docker container. Here's how I got it back, using https://pypi.python.org/pypi/pyrasite/ and https://pypi.python.org/pypi/uncompyle6

  1. Attach a shell to the docker container

  2. Install GDB (needed by pyrasite)

    apt-get update && apt-get install gdb

  3. Install pyrasite - this well let you attach a Python shell to the still-running process.

    pip install pyrasite

  4. Install uncompyle6, which will let you get Python source code back from in-memory code objects:

    pip install uncompyle6

  5. Find the PID of the process that is still running

    ps aux | grep python

  6. Attach an interactive prompt using pyrasite

    pyrasite-shell

  7. Now you're in an interactive prompt! Import the code you need to recover:

    from my_package import my_module

  8. Figure out which functions and classes you need to recover:

    dir(my_module) ['MyClass', 'my_function']

  9. Decompile the function into source code:

    import uncompyle6 import sys uncompyle6.main.uncompyle( 2.7, my_module.my_function.func_code, sys.stdout )

    uncompyle6 version 2.9.10

    Python bytecode 2.7

    Decompiled from: Python 2.7.12 (default, Nov 19 2016, 06:48:10)

    [GCC 5.4.0 20160609]

    Embedded file name: /srv/destination_service/destination_service/wsgi.py

    function_body = "appears here"

  10. For the class, you'll need to decompile each method in turn:

    uncompyle6.main.uncompyle( 2.7, my_module.MyClass.my_method.im_func.func_code, sys.stdout )

    uncompyle6 version 2.9.10

    Python bytecode 2.7

    Decompiled from: Python 2.7.12 (default, Nov 19 2016, 06:48:10)

    [GCC 5.4.0 20160609]

    Embedded file name: /srv/my_package/my_module.py

    class_method_body = "appears here"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment