Cython is a great way to protect the source code of a Python program. However, memory inspection and memory reverse engineering can still be done to this Cython program.

What are ways to prevent (or make it very difficult) for an attacker to inspect the memory of the Cython program?

  • Which platform are you using? On Windows you can create a native library and store sensitive values in memory using DPAPI. – 0xec Nov 27 '19 at 9:53
  • @0xec Thanks for the note. I am using Linux. Is there a Linux equivalent to DPAPI? – Peter Smith Nov 27 '19 at 19:44
  • I'm not aware of any Linux equivalent of DPAPI, However there are libraries like memguard which can be used. It's in golang though. – 0xec Nov 28 '19 at 6:36

You can create a library on c/c++ and encrypt the memory access, however, with a debugger at the end the memory can be read. Notice that with the python module inspect you can not inspect native c/c++ libraries

  • Thanks a lot for the answer. What tools do you use to encrypt the memory? – Peter Smith Nov 27 '19 at 0:23
  • @PeterSmith check out my answer below for a good tool. There's also a tool called VMProtect but Themida is generally harder to crack. – the_endian Nov 27 '19 at 19:16

Get Themida. Just go to that page and look at the huge list of features... You will take your executable you built with Cython, and then input that into Themida. You have a bunch of different obfuscation options. Themida will heavily influence size and performance of the application, but a compromise can be made. I don't work for or endorse Themida/Oreans, but it's the best protection out that for your use-case. Don't believe me? Go search the Internet for deobfuscated/unpacked Themida for the current version - there is no known public defeat of this. Better yet, pack your program then try to reverse it yourself!

  • Thanks @the_endian! Do you know how Themida or VMProtect works to defend from memory reverse engineering? Is there a paper or some article on what technique they use? – Peter Smith Nov 27 '19 at 20:48
  • 1
    @PeterSmith they use like 70 different techniques... Did you see the list at the bottom of that page? A good start would be taking items for that list and Googling them. Also look up "unpacking Themida" . It's extremely difficult and requires months and years of work to defeat. You will find old scripts online for OLD versions of Themida... Such as this: forum.tuts4you.com/topic/39566-devirtualizeme-themida-2460 Note the versions for these are very old and posted years ago. You won't find one for current version, or even close. Plus this is only to unpack 1 of 70 protections – the_endian Nov 27 '19 at 22:10
  • 1
    Make an account on tuts4you, look up "Unpacking themida" you'll see. It aint easy, trust me. – the_endian Nov 27 '19 at 22:10
  • 1
    @PeterSmith Because you asked, heres a whitepaper on FinFisher devirtualization: welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf This will show you how much work is required to devirtualize... And by the way, FinFisher wasnt using Themida and in fact was using a much weaker protection. – the_endian Nov 27 '19 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.