de4py is a comprehensive Python deobfuscation and reverse engineering tool designed primarily for Windows environments. It combines a native PySide6 GUI with a CLI interface to analyze, unpack, and clean obfuscated Python scripts and PyInstaller executables. The core functionality relies on a modular engine architecture that supports multiple deobfuscation strategies, including legacy regex-based detection and the newer 'Onyx' engine which utilizes AST manipulation and local LLM integration for semantic recovery. It also features native C++ components for process injection and behavior monitoring, allowing users to hook into running Python processes for dynamic analysis. The architecture is split between high-level Python logic for AST transformation and low-level C++ code for system interaction. The Python side manages the deobfuscation pipeline, UI rendering, and plugin management, while the C++ side handles DLL injection, API hooking via Detours, and named pipe communication. This hybrid approach provides powerful capabilities but introduces significant platform coupling and dependency on specific Windows APIs and Python versions. The tool is licensed under CC BY-NC-4.0, restricting commercial use. While the codebase demonstrates sophisticated engineering in areas like VM lifting and AST optimization, it carries risks associated with external API dependencies (telemetry, updates), brittle regex signatures for obfuscation detection, and heavy reliance on Windows-specific system calls. It is best suited for security researchers and malware analysts working in Windows environments who require a unified static and dynamic analysis platform.

The LLM identified 3 files worth highlighting for reuse: