9

This question is related to this other one. I just wonder what are the techniques applicable and which can be found in the real world to obfuscate Python program (similar questions can be found on stackoverflow here and here).

mikeazo mentioned the fact that his program was provided with a custom Python interpreter, but what are the other techniques and how efficient are they ?

Improve this question

5 Answers 5

Reset to default
19

Here are tricks you can use when packaging your python app with a custom interpreter.

  1. Remap the opcodes for the interpreter
  2. Encrypt the pyc files (the custom interpreter decrypts before importing)
  3. Remove access to co_code in the interpreter (delete the reference to co_code in the code_memberlist array declaration in codeobject.c of the interpreter)
  4. Obfuscate/protect the python interpreter
  5. Do not bundle modules such as dis which would help in reverse engineering (basically reverse engineer an unobfuscated python program, note all modules/techniques you find useful and remove them from the custom interpreter)
  6. Modify the interpreter so it can only import pyc files (can be done by removing the compile modules or filtering in the interpreter)
  7. The pyREtic folks give a few standard techniques for entering the custom interpreter. Testing these out on your app and trying to disable those access methods would make things much harder for a reverse engineer.
  8. Remove functions from interpreter which the RE could call to help him/her out such as PyRunString(). Otherwise they can attach with a debugger and run arbitrary python code.

References

Improve this answer
2
7

I don't know of any specific Python obfuscation tools (probably because the kind of people who want to write obfuscated code aren't going to be doing it in Python, except for amusement/education).

However, if I did need to obfuscate Python code, I'd probably use the same techniques you'd use for a program in any language. The lack of tools means you need to write your own obfuscator, but that's not too difficult.

Basically, think of anything you would do to reverse engineer a program and transform it to make that harder.

  • Make your invariants complex. Transform program invariants into stuff like `(x ** y) % p == 457' or "this data structure represents an achordal graph". Such invariants are highly unlikely to be guessed by a static or dynamic analysis tool and will take ages for humans to figure out.

  • Mix together logic of different methods. Take every good design practice and do the opposite. Randomly inline portions of methods into other methods, and then rearrange the code. Duplicate portions of the CFG and randomly insert jumps between corresponding points in the two versions, then mutate them so they're not obviously duplicates.

  • Add a packer. Bonus pointers if you only decrypt portions of the code when you actually need to execute them, and make the results depend on program state so it's difficult to determine the keys in advance. Try to make sure the original program never appears in memory at once.

The main challenges to obfuscation are that it requires understanding of the program and usually hurts performance. The more extreme obfuscations are only applicable in cases where performance doesn't matter and withstanding intense scrutiny is important (i.e. malware).

Improve this answer
1
  • Apart from obfuscating the code, the problem arises with trying to enforce application licensing and expiration. In that case, I'd suggest moving some critical part of the application into a native binary (write it in C that is) and do a license check there. Of course, that C shared library/dll can then be protected in "standard" way.
    – 0xea
    May 1, 2013 at 9:07
2

I think these questions from SO might help:

Obfuscating Python code?

How do I protect Python code?

Python Code Obfuscation [closed]

Improve this answer
0

This free tool will obfuscate multi module Python source code while retaining identifiers imported from 3rd party libraries. Also other identifiers can be exempted from obfuscation. I made it for my own use on a multi-year project, but decided others might benefit from it as well.

Improve this answer
1
  • "SyntaxError: encoding declaration in Unicode string" when trying to run the obfuscated code. Also it import sys which may be blocked in some environments. Such a tool should not add dependencies.
    – rapt
    Apr 13, 2017 at 17:22
0

You have some options.

You can create your own obfuscation method comprised of existing encryption tools...i.e. openssl. But, beware, it will likely take you a considerable amount of time to complete this type of project.

It'll require you to map out how you're going to enclosed the "passwords/passkeys" within the obfuscated code in such a way that no one, except you, can get to it. It'll be preferable if even you cant get to it.

Then, you need to add in some logic that will cause the script to protect itself from inquisitive users who may try to pry it apart. And equally as important, whatever method you come up with must not add significantly to the execution time of the script.

This may sound impossible, but i think its doable. You just have to be motivated and have enough time on your hands.

Or, if you want a shortcut, you can try pasting a sample unix based python script to this site, and see if you can break their code and unveil your "hidden" code.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.