Best way to protect source code of .exe program running on Python?

Question

I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password).

The issue I have encountered is that in the industry I am selling on, there are a lot of "hackers" who will try to decompile your executable file, get the source code and distribute it for free to other people.

To combat these reverse-engineering attempts, I have tried to both obfuscate my code and use various compilers, but so far to no success.

What I have tried:

• Use py2exe compiler: "hackers" managed to decompile executable in an hour.
• Use pyinstaller compiler: same as with py2exe.
• Use pyminifier to obfuscate the code: "hackers" managed to deobfuscate the code.
• Use Oxyry Python Obfuscator: same as with pyminifier.

Those who managed to decompile and deobfuscate my program explained that the open-source nature of those 4 tools means that their algorithms are well-known and there are solutions out there made to reverse-engineer programs that use these open-source compilers and obfuscators.

What I didn't try yet:

• Using Pyarmor to obfuscate my code. I've heard it is good, but it costs 50$, so I want to be sure that it is the best obfuscation tool out there before purchasing the license.
• Using Cython library to create a C-wrapper for my program, making it compiled in C instead of Python. Since C binaries are much harder to read, it will make the program significantly harder to decompile. However, I have never programmed in C, and I want to know if there are better ways to compile my source Python code, without the need to learn C.
• Using VMProtect, Enigma Protector or Themida/Code Virtualizer. Each tool costs over 150$, so before purchasing them, I want to know if that would be the best way to solve my problem.

What I am not going to try:

• Completely rewrite my whole program in a language other than Python. I am not strong in other languages, plus the program itself consists of over 5,000 lines of code, so I can't just completely rewrite it for the sole purpose of making it harder to decompile.
• Making program open-source: This is a for-profit software, so I am not going to release the proprietary code, thank you for understanding.
• Making the program a web-app: Since my program directly interacts with files on the user's PC, I can't make it web-based, it has to be on the user's PC.

Please also consider that if "hacker" will be able to disable the whitelist system without even accessing the source code, he will be able to distribute it to other users with no limitation. Therefore, I am looking for a way that will not only make it extremely hard to decompile the program, but also make it almost impossible to meddle with bytecode/binaries and turn off certain parts of the program's code.

Answer 1

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose.

The way Python works is fully documented and open-source. For instance, consider the pyc file format. Much of the code which deals with reading/writing pyc's can be found in marshal.c If you modify the code and reorder the sequence in which the objects are read/written you can easily throw off decompilers. To further strengthen the protection, you can encrypt the bytecode which will be decrypted only at run-time.

Another technique commonly used is opcode remapping. The set of bytecode instructions in Python can be found in opcode.h.

Consider these two instructions

#define DUP_TOP_TWO               5

#define BINARY_TRUE_DIVIDE       27

You can interchange the opcodes for these instructions. As a result the bytecode will only be understood by your custom Python build.

The earlier versions of Dropbox were developed in Python and they used some of the above techniques to harden their code but as is the case with any DRM system, it was eventually reverse engineered and analyzed. There's a write-up of this process which you can study for further reference. (Disclaimer: I'm the author of the write-up but not the owner of the GitHub repo).