Skip to content

Instantly share code, notes, and snippets.

@thimslugga
Forked from simonw/recover_source_code.md
Created May 18, 2019 18:41
Show Gist options
  • Save thimslugga/e7caaf7e6ccef75c5a0a70b9d77a32aa to your computer and use it in GitHub Desktop.
Save thimslugga/e7caaf7e6ccef75c5a0a70b9d77a32aa to your computer and use it in GitHub Desktop.
How to recover lost Python source code if it's still resident in-memory

I screwed up with git and managed to delete the code I had just written... but it was still running in a process in a docker container. Here's how I got it back, using https://pypi.python.org/pypi/pyrasite/ and https://pypi.python.org/pypi/uncompyle6

= Attach a shell to the docker container

  1. Install GDB (needed by pyrasite)

    apt-get update && apt-get install gdb

  2. Install pyrasite - this well let you attach a Python shell to the still-running process.

    pip install pyrasite

  3. Install uncompyle6, which will let you get Python source code back from in-memory code objects:

    pip install uncompyle6

  4. Find the PID of the process that is still running

    ps aux | grep python

  5. Attach an interactive prompt using pyrasite

    pyrasite-shell

  6. Now you're in an interactive prompt! Import the code you need to recover:

    from my_package import my_module

  7. Figure out which functions and classes you need to recover:

    dir(my_module) ['MyClass', 'my_function']

  8. Decompile the function into source code:

    import uncompyle6 import sys uncompyle6.main.uncompyle( 2.7, my_module.my_function.func_code, sys.stdout )

    uncompyle6 version 2.9.10

    Python bytecode 2.7

    Decompiled from: Python 2.7.12 (default, Nov 19 2016, 06:48:10)

    [GCC 5.4.0 20160609]

    Embedded file name: /srv/destination_service/destination_service/wsgi.py

    function_body = "appears here"

  9. For the class, you'll need to decompile each method in turn:

    uncompyle6.main.uncompyle( 2.7, my_module.MyClass.my_method.im_func.func_code, sys.stdout )

    uncompyle6 version 2.9.10

    Python bytecode 2.7

    Decompiled from: Python 2.7.12 (default, Nov 19 2016, 06:48:10)

    [GCC 5.4.0 20160609]

    Embedded file name: /srv/my_package/my_module.py

    class_method_body = "appears here"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment