Navigation X
ALERT
Click here to register with a few steps and explore all our cool stuff we have to offer!



   4202

What's the best way to obfuscate python code?

by Quessts - 21 September, 2020 - 07:06 PM
This post is by a banned member (Quessts) - Unhide
Quessts  
Supreme
1.218
Posts
314
Threads
5 Years of service
#1
Hey I'm building a python program and I'm tryna obfuscate it. I tried using pyarmor but my code is too big for pyarmor any suggestions?
This post is by a banned member (ebp) - Unhide
This post is by a banned member (Quessts) - Unhide
Quessts  
Supreme
1.218
Posts
314
Threads
5 Years of service
#3
(21 September, 2020 - 07:29 PM)ebp Wrote: Show More
No clue what this is for, but private obfuscators or writing your own will almost always be superior. However if you are lazy and want a free alternative then pyarmor gets the job done and the majority of people have zero clue how to deobsfucate it.
 
Code:
1. Use [i]pyinstxtractor.py[/i] to extract the executable in Python 3.7
2. Using the extracted files, create the following directory structure
.
|-- martisor.pyc
`-- pytransform
|-- __init__.py
|-- _pytransform.dll
|-- license.lic
`-- pytransform.key

1 directory, 5 filesFor running on Linux, you need [i]_pytransform.so[/i] downloadable from [url]https://pyarmor.dashingsoft.com/platforms.html[/url]

3. Install [i]psutil [/i]using pip (Required for pyarmor). From now on, you can just run [i]python3.7 martisor.pyc[/i] instead of the unpackme executable.
4. pyarmor encrypts the code objects on disk and they are only decrypted at runtime just before they are executed. The entire logic is implemented in [i]_pytransform.dll[/i]. There are [url=https://pyarmor.readthedocs.io/en/latest/security.html#cross-protection-for-pytransform]anti-debugging/timing checks[/url] to prevent us from using a debugger to dump code objects from memory. But there's no need to use a debugger at all when CPython itself is open source. [img]https://forum.tuts4you.com/uploads/emoticons/default_smile.png[/img]
5. Compile Python 3.7 from source. Modify the [i]_PyEval_EvalFrameDefault[/i] function such that it dumps the code object to disk. By doing so we do not need to bother about all the anti-debugging and encrypted stuff. This is because pyarmor decrypts the code object in memory before it hands it to the Python VM for execution.
6. Run strings on the dumped code  object. We get many base64 strings. Like this one: CkdFTkVSQVRFLUtFWS0wWDcyR09ELVVOUEFDS01FCg==
7. Base64 decode and profit!

The Steps needed to deobsfuscate pyarmor courtesy of this thread: https://forum.tuts4you.com/topic/41945-p...ent-203008

I tried this and I was able to reverse engineer it. I just found a alternative to pyarmor that doesn't have a limit I'm uploading a tutorial soon. But thanks anyway
This post is by a banned member (ebp) - Unhide
This post is by a banned member (Quessts) - Unhide
Quessts  
Supreme
1.218
Posts
314
Threads
5 Years of service
#5
(This post was last modified: 21 September, 2020 - 08:35 PM by Quessts.)
(21 September, 2020 - 08:04 PM)ebp Wrote: Show More
doesnt have a limit? what are you on about.

yeah like you cant use pyarmor if you have a big program. It gives out an error cant exceed 33000 bytes or something like that. I found something that doesn't have a byte limit I made a thread here
This post is by a banned member (ebp) - Unhide
This post is by a banned member (Quessts) - Unhide
Quessts  
Supreme
1.218
Posts
314
Threads
5 Years of service
#7
(21 September, 2020 - 08:51 PM)ebp Wrote: Show More
(21 September, 2020 - 08:35 PM)Quessts Wrote: Show More
(21 September, 2020 - 08:04 PM)ebp Wrote: Show More
doesnt have a limit? what are you on about.

yeah like you cant use pyarmor if you have a big program. It gives out an error cant exceed 33000 bytes or something like that. I found something that doesn't have a byte limit I made a thread here

:monkas: if your files that big then your code must be awful, how many imports does it have?  from python import *  kek

Nope its a really big file. It has over 50 modules for checkers. It also has selenium web driver so that's a lot I guess
This post is by a banned member (ebp) - Unhide

Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
or
Sign in
Already have an account? Sign in here.


Forum Jump:


Users browsing this thread: 1 Guest(s)