2

Cython is a great way to protect the source code of a Python program. However, memory inspection and memory reverse engineering can still be done to this Cython program.

What are ways to prevent (or make it very difficult) for an attacker to inspect the memory of the Cython program?

3
  • Which platform are you using? On Windows you can create a native library and store sensitive values in memory using DPAPI.
    – 0xec
    Nov 27, 2019 at 9:53
  • @0xec Thanks for the note. I am using Linux. Is there a Linux equivalent to DPAPI? Nov 27, 2019 at 19:44
  • I'm not aware of any Linux equivalent of DPAPI, However there are libraries like memguard which can be used. It's in golang though.
    – 0xec
    Nov 28, 2019 at 6:36

2 Answers 2

2

You can create a library on c/c++ and encrypt the memory access, however, with a debugger at the end the memory can be read. Notice that with the python module inspect you can not inspect native c/c++ libraries

2
  • Thanks a lot for the answer. What tools do you use to encrypt the memory? Nov 27, 2019 at 0:23
  • @PeterSmith check out my answer below for a good tool. There's also a tool called VMProtect but Themida is generally harder to crack.
    – the_endian
    Nov 27, 2019 at 19:16
2

Get Themida. Just go to that page and look at the huge list of features... You will take your executable you built with Cython, and then input that into Themida. You have a bunch of different obfuscation options. Themida will heavily influence size and performance of the application, but a compromise can be made. I don't work for or endorse Themida/Oreans, but it's the best protection out that for your use-case. Don't believe me? Go search the Internet for deobfuscated/unpacked Themida for the current version - there is no known public defeat of this. Better yet, pack your program then try to reverse it yourself!

4
  • Thanks @the_endian! Do you know how Themida or VMProtect works to defend from memory reverse engineering? Is there a paper or some article on what technique they use? Nov 27, 2019 at 20:48
  • 1
    @PeterSmith they use like 70 different techniques... Did you see the list at the bottom of that page? A good start would be taking items for that list and Googling them. Also look up "unpacking Themida" . It's extremely difficult and requires months and years of work to defeat. You will find old scripts online for OLD versions of Themida... Such as this: forum.tuts4you.com/topic/39566-devirtualizeme-themida-2460 Note the versions for these are very old and posted years ago. You won't find one for current version, or even close. Plus this is only to unpack 1 of 70 protections
    – the_endian
    Nov 27, 2019 at 22:10
  • 1
    Make an account on tuts4you, look up "Unpacking themida" you'll see. It aint easy, trust me.
    – the_endian
    Nov 27, 2019 at 22:10
  • 1
    @PeterSmith Because you asked, heres a whitepaper on FinFisher devirtualization: welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf This will show you how much work is required to devirtualize... And by the way, FinFisher wasnt using Themida and in fact was using a much weaker protection.
    – the_endian
    Nov 27, 2019 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.