fix: NOP is not 9 if minor version >= 13

.github/workflows/regtest.yml

@@ -39,18 +39,18 @@ jobs:
           lfs: true
           submodules: true
 
-      - name: Run shot.py
+      - name: Run shot.py and check for changes
+        working-directory: ./regtest
         run: |
-          touch ./regtest/.git/.no1shot
+          find . -type f -name '*\.1shot\.*' -exec rm -f {} + >/dev/null 2>&1
+          touch ./.git/.no1shot
           pip install pycryptodome
-          python3 ./project/oneshot/shot.py ./regtest --no-banner >/dev/null 2>&1
+          python3 ../project/oneshot/shot.py . --no-banner >/dev/null 2>&1
-          cd ./regtest
           if [ -n "$(git status --porcelain)" ]; then
             cd ../project
             COMMIT_MSG=$(git log -1 --pretty=%B | head -n 1)
             echo "$COMMIT_MSG" | grep -q "update tests" || { echo "Workspace changed but commit message does not contain 'update tests'. Failing workflow."; exit 1; }
           fi
-          cd ..
 
       - name: Commit and push changes
         if: ${{

oneshot/detect.py

@@ -11,7 +11,7 @@ def ascii_ratio(data: bytes) -> float:
 
 
 def valid_bytes(data: bytes) -> bool:
-    return len(data) > 64 and all(0x30 <= b <= 0x39 for b in data[2:8])
+    return len(data) > 64 and all(0x30 <= b <= 0x39 for b in data[2:8]) and data[9] == 3
 
 
 def source_as_file(file_path: str) -> Union[List[bytes], None]:

pycdc/pyc_code.cpp

@@ -216,7 +216,7 @@ void PycCode::pyarmorDecryptCoCode(unsigned long consts_index, PycModule *mod)
         // Assume tail of code is not used there
         memset(
             &code_bytes[desc->decrypt_length],
-            9, // NOP
+            mod->verCompare(3, 13) == 0 ? 30 : mod->verCompare(3, 14) == 0 ? 27 : 9, // NOP
             desc->decrypt_begin_index);
     }