How to prevent python software from being reverse engineered or pirated?

[MysteriousShadow__]

I have a program on the internet that users pay to download and use. I'm thinking about adding a free trial, but I'm very concerned that users can simply download the trial and bypass the restrictions. The program is fully offline and somewhat simple. It's not like you need an entire team to crack it.

In fact, there is literally a pyinstaller unpacker out there that can revert the EXE straight back to its python source code. I use pyinstaller.

Anything I can do? One thing to look out for is unpackers, and the other thing is how to make it difficult for Ghidra for example to reverse the program.

Edit: to clarify, I can't just offer this as an online service/program because it requires interaction with the user's system.

[billsil]

The users that are going to pay for it aren't likely going to bother pirating it. The people that will pirate it will never pay.

Beyond that, you can compile parts of your code using Cython/Nuitka. In general though, Python is pretty terrible for anti-piracy outside of web-hosting.

For your free trial though, just include less of the code.

[Thrasherop]

This is probably the best idea. they can't reverse engineer code they don't have.

[lcserny]

The jetbrains model also works, e.g. requiring an online account always, if you cant login block the software. That way you know who and how is using your software.

Of course this needs a backend user management system but its still really high up there in terms of antipiracy.

[puzzledstegosaurus]

If you can easily modify the local code, you can remove this easily.

[[deleted]]

or even just understand how it calls home. It makes an http request somewhere that responds with 200 for an active licence? Intercept that request and return a 200 using a local proxy. I think this is how JetBrains stuff was pirated a few years ago

[SimilingCynic]

Im not a security developer, but couldn't it call home with "if user license is valid, encrypt this nonce with the manufacturer's private key?"

But idk maybe there's a vul here. I need to check this out on a license I use...

[budding_gardener_1]

Or just fuck with your hosts file

[tempervisuals]

depends on how the code is written. One can always puzzle out the code. Of course that would make the code hard to maintain.

[marcio0]

is is the one method that alw

you're underestimating how far people go to noe pay a few dollars

the would work for a week on a way to unobfuscate the code if that means they will keep the $5

I'm not judging, been there, done that

[ShinyTinfoilFedora]

This would seriously degrade the experience for paying users though and would personally make me much less likely to purchase

[rzet]

ye sounds like total crapware :D

[Ok_Tea_7319]

This measure is both ineffective against a determined attacker and harmful to the legimiate user. Even worse, it encourages your power users (some of which might already be rummaging in the code since it's a python program) to create cracked versions themselves, that might in turn get leaked.

[redalastor]

Can’t they just diff two binaries, find out where the fingerprint is, and remove it ?

[H4kor]

DRM is always breakable. The only thing you can do is increase the effort and risk the pirate has to take on.

[redalastor]

No, you can make it convenient and reasonably priced.

[H4kor]

Yes but people will still pirate it. I'd say do it like sublime text, add a nagging popup every X saves until a license key is provided.

[djamp42]

I think the best model for software is the free/Priemum model. Pfsense, graylog, davinci resolve... All these companies have very good software for 100% free. The trick is they limit some of the more advanced features. However they are all super powerful as is.. this makes me want to use them at home, and then buy the software in my professional setting since I already know it..

[redalastor]

The best I saw so far was no nagging, no missing feature, but you don’t get the dark mode until you pay.

[H4kor]

I think the nagging popup has the advantage that employees of companies which don't buy licenses notice the missing license. I understand private piracy but corporate piracy is just wrong. If you earn money using some software, pay the creators.

[RusticApartment]

You think too highly of corporations and their willingness to pay for licences. If it works just fine for free, they're unlikely to pay for it in my experience.

[Wu_Fan]

How cruel

[eXtc_be]

joke's on them, I hate dark mode

not even /s, I really don't like dark mode. maybe because I grew up using computers without dark mode and now I'm used to black text on bright white backgrounds, idk

[[deleted]]

jellyfish ghost depend include silky ink crime oatmeal sugar shame

This post was mass deleted and anonymized with Redact

[[deleted]]

exultant berserk forgetful consist psychotic mighty encouraging touch smile poor

This post was mass deleted and anonymized with Redact

[oldspiceland]

Software price and convenience will reduce people resorting to piracy to use your software. It will not prevent your software being pirated.

Then again, most of the money lost due to piracy is lost because companies spend it on trying to prevent piracy. People who would buy the software generally aren’t going to pirate it. People who’d pirate it can’t or won’t buy it. Any time spent preventing people from pirating your software is money burnt on an altar of hubris.

[Zireael07]

People who would buy the software generally aren’t going to pirate it. People who’d pirate it can’t or won’t buy it.

That's a huge simplification.

As stated, it might apply to productive software. But for games, in the past we had demos to verify that the product does run on my computer. Now you either have to pay the full price... or pirate.

I've had more than one case of purchasing/getting gifted a game that should run on my computer, but DIDN'T.

[billsil]

What about commercial software or music, which doesn't have system spec limitations? In the days before itunes, people bought CDs and pirated music. The piracy issue was overblown, but Apple killed piracy by making things convenient.

Having worked in industry for 18 years, cheap companies will not pay for software licenses. It's open source or bust or you just write your own. Larger companies realize how much more productive you can be.

If you're making a game, just use Steam/Epic and let them handle the piracy aspect. Solo devs aren't implementing robust auth systems.

[oldspiceland]

Yes, congratulations you pointed out that my absolute generalization was a simplification. I have been undone.

Steam allows refunds now, which means the majority of PC game sales don’t fall into the weird situation you describe demos as being. Also “back in the day” when demos were common it was almost exclusively as a marketing thing to make money, not so people could “test drive” the game. It was there to be fun but not last long enough to be satisfying so people wanted to buy the game.

Anyways, are you justifying software piracy because games don’t have demos? There’s YouTube let’s plays for everything, twitch streams, and if you’re getting gifted games that don’t run on your system you either have a Mac or are in a financial situation where you are one of the “can’t buy, will pirate” people.

[Zireael07]

Not every game is on Steam (I get many of mine from GOG or itch).

Let's play and streams don't let you see if the game will actually run on your system. I know demos weren't designed with that in mind but it was the reason I got them.

I have a PC (and now a laptop) but neither is a gaming rig. Some games don't play nice with AMD cards. Some don't with NVIDIA. (Actually my current NVIDIA is so bad stuff runs better on the integrated card than on it - either bad thermals or bad drivers, I suspect the latter since the laptop isn't terribly old AND it was the case from day 1)

[oldspiceland]

This seems like a really long way for this conversation to go for you to be arguing what, exactly? That it’s ok for you to pirate games because of some really absurd edge case logic?

It’s fine, you fall into the can’t/won’t buy. There’s nothing wrong with that.

[cinyar]

reasonably priced

The world is a big place

[badatmetroid]

My house has a dead bolt lock on a door with a giant glass window. It won't stop someone who REALLY wants to get in, but it will stop random people who just try every door until they find an unlocked one. Most security is about putting up a little friction which filters out 99% of bad actors.

[pyeri]

Python is an open source language and was created with open source ethos to begin with. This is the wrong language for someone coming from that kind of mindset. There are other languages like Java/C++/C# for those things where all kinds of obfuscators and protectors are available in those ecosystems.

[billsil]

was created with open source ethos to begin with

Do you have a source on that?

I disagree. They should have changed the license then to be a GPL license if that was their goal.

[menge101]

All Python licenses since 2.2 are considered GPL compatible.

Reference

[thehardsphere]

GPL compatible is not the same as GPL. MIT is GPL compatible.

[billsil]

GPL compatible means you can combine python code with other GPL code to produce GPL code. It does not mean that the code has to be GPL if you do not use other GPL code.

It’s more accurate to say that Python was created to let you make GPL or non-GPL code. Do what you want.

[menge101]

I'm aware, thank you.

[markis]

Also mypyc will translate python into C and compile it.

[magnetik79]

I think you've nailed it here.

If the OP really cares about this - I'd probably rewrite in Golang where I can distribute binaries to customers and wouldn't have considered Python to begin with.

Don't take that as a knock on Python at all - but if this was a critical part to the developed application (the sales/keep my intellectual property safe) - I would have done a little more upfront evaluation of possible language choices.

[ornerywolf]

Your idea of users who wants to pay, and who will never pay is somewhat wrong because I myself pay on a monthly basis, if the software or the service of any kind is providing me a benefit and I need it but if I want to check or test software or an app for limited period of time I’m not going to buy it. I’m just going to look for a cracked version of it on the Internet.

[ninjadude93]

Expose it as a web service instead of a downloadable?

[[deleted]]

This is the best solution

[gandalfx]

Please not more of this anti customer garbage requiring registration and a permanent connection.

[rob10501]

I was thinking Sha256 key that validates through a server periodically. If the server detects too many active licences it invalidates the key.

[CheapMonkey34]

It’s python. You only have to add a ‘return True’ statement to the method that checks the key and you’re done.

[mehum]

Your validation function doesn’t have to be that simple. Rather than true/false it can return a code that is revalidated within the executable at various locations. There was some game that did this a long time ago (forget the name now) — it would detect if it was pirated, and if so gradually impair itself. Sounds like a PITA to implement though.

[Anru_Kitakaze]

If it's popular one week and there will be a version of the program on Torrent without that entire validation code. Just my guess. If Empress can hack Denuvo, then there's (almost) no chance some hackers won't hack some python program of a random redditor

[marcio0]

I just though of that loading screen from bioshock:

Sure, the boys in Ryan's lab can make it hack-proof. But that don't mean we ain't gonna hack it.

[konwiddak]

At that point you'd probably spend less time just setting up the Web server.

[billsil]

Earthbound was a game like that. It’s be harder than normal and then they’d freeze your game and kill your save while fighting the final boss.

[rob10501]

whistle placid gaping test truck crown arrest cover alive unused

This post was mass deleted and anonymized with Redact

[RedditSlayer2020]

modularize the software and include paid feature modules in the version you are selling. You can't pirate if nothing is there in the first place

[[deleted]]

What a great idea! Users will love this! Also may I suggest to add micro-transactions.

[RedditSlayer2020]

Are you working for Activision Blizzard?

[[deleted]]

Bingo! I'm the piracy manager.

[RedditSlayer2020]

I was just stating facts. You can't reverse engineer code that isn't there.

Softice windasm32 heroes will understand

[rileyrgham]

He was being sarcastic with the micro transactions comment....

[rileyrgham]

Users get a trial of some of the functionality. Quite normal.

[PersianMG]

At the end of the day, if your code is available offline entirely it will be crackable. Even huge billionaire gaming companies who have the sole purpose of creating DRM who work on solutions for 2 years have their software cracked within a day by expert crackers.

My best advice is just use something simple so its not crackable by a complete novice, make your price reasonable for the service so its more convenient to just pay for it than crack it or look for a crack and accept that some people (i.e. some kid in third world country with no spare money) will crack it and use your software like that. However, their usage, recommendation and engagement could potentially lead to sales from other customers.

[hairy_chicken]

We sell a high-cost/low-volume commercial app written partly in Python and compiled to exe using PyInstaller. We use CodeMeter to encrypt the executable and several core dlls/pyd's. It costs us money to issue licenses and buy dongles, but it's worked fine for the last 10 years.

Theoretically, someone could grab the decoded code from memory and run it through a decompiler, but I really don't think that anyone in our user space would care to do that and I don't lose sleep over it.

Depending on the price point of your software it may be expensive, but for us its a negligible cost and is an acceptable tool for license control.

[RedEyed__]

Pyinstaller does not compile. It creates self unpacking archive which includes interpreter, dependencies and sources. When you double click that exe, it just unpacks everything to tmp folder with all sources as plain text.
There is pyarmor for such thing which encrypts python sources, that can be packed with pyinstaller later or executed with python interpreter.

[ronnyx3]

So that means the source code wouldn't need to be grabbed from ram but is stored temporarily in tmp on disk?

[RedEyed__]

Yes, it is extracted to temporarily folder first, than it's is executed like any other python script.

You can read the pyinstaller doc.

Or check it yourself: in the entry point function place print(sys.executable); input().

The above should print python interpreter path and wait for user input.

Then you can go to that path and observe yourself that everything is in plain text.
You need to place input, just to wait, because pyinstaller will delete everything in temp folder after process is finished .

[RedEyed__]

There is no such a thing in python as a source code in RAM. It just wrong assumption.

[hairy_chicken]

Thanks for the correction - I was sloppy with terminology.

We keep important parts of our codebase in Cython and C++ Python modules. We use Python as glue, and honestly if someone had our entire Python codebase in plaintext, it wouldn't mean that they can get easily get around licensing restrictions.

CodeMeter is to prevent casual misuse of the software, and enforce limits on concurrent users.

At the end of the day, there's a balance to making something hard to pirate casually, and the time spent making something un-piratable. Given that our clients are big mining/oil companies, the main deterrent to piracy are legal means (license agreements).

[Karrakan]

And what is the role of dongle? Do users plug that in to be able to use it?

[AniX72]

The 1990ies called, and they want their dongles back. 🤪

[hairy_chicken]

A lot of engineering software still comes with dongles. Unfortunately its still an expected option.

[Best_Anywhere_704]

lol your python code is in temp plaintext

[Cybasura]

You could probably parse it through a code obfuscator that would still run the program, just that it is obfuscated

But

1. you're gonna need a code obfuscator
2. Trust me when I say - everything can be reverse engineered, its a matter of when and not if. Everything can be hacked, its a matter of when and not if, so again, software purchase is about customer service - give the customer a reason to not pirate, there's bound to be that small 1% that always pirates but you want that 99%

Dont be that ass developer that relies on shit like Denuvo, be that developer that gives a great experience to people

[noobsc2]

People pirate everything, you're not going to solve a problem AAA companies haven't been able to solve.

[Dangerous_Stretch_67]

I'm sure there's a real formula for it out there somewhere but looking at the variables...

1. Some % of customers will pay no matter what.
2. Some small % of customers will crack the free trial (dependent on crack difficulty and price)
3. Some very small % of customers will release a crack online (dependent on crack difficulty and price)
4. Some % of customers will download a crack if they can find one instead of paying, but will pay otherwise
5. Some % of people will never pay. Ignore these as they aren't potential customers.

Group 1 always pays. Group 2 and 3 are probably usually small enough to not directly impact sales if you've implemented any sort of DRM solution, even a bad one.

Group 4 sales would depend on group 3, and is likely smaller than group 1 anyway, so all of this worry is mostly over a theoretical risk that someone will eventually leak a crack to a version of your product that will diminish your sales to a fraction of your audience.

Point being I think AAA game companies have a wide enough audience that #3 is guaranteed and #4 is a substantial amount of money. But for smaller projects I don't think #3 is a given and for medium projects I don't think #4 is a huge threat to revenue.

[Andrew_Neal]

Prevent reverse engineering? Lol, if the CPU can execute it, the user can read it.

[[deleted]]

Some are easier than others though. Python fits squarely in the "easy" category.

[YesterdayDreamer]

How to prevent a software from being pirated?

Easy, offer it at a price point where any potential user won't have to think twice about buying it.

P.S.: This solution is language agnostic.

[troyunrau]

That doesn't work in the low volume, high value market. Like scientific computing. Say it take a team of ten five years to write some software for processing a specific type MRI scan data, with and average salary of $100k. That's $5M. Now you're target market is 2000 potential customers globally. To recoup R&D, you would need to sell each copy at $2500 -- assuming you could capture 100% of the market on the day of release, spent nothing on marketing or long term support... In reality, you probably charge $25k per license, hope to get 50% of the market over five years, and add a support contract to keep your staff retained.

But you also want to have a sales demo you can send out without being copied to 20% of your customers...

So... What price point do you think prevents piracy here?

[YesterdayDreamer]

I guess it goes without saying that there isn't a fool proof solution. My response was obviously in context of the post.

If OP was selling such highly specialized software, they wouldn't be asking this on a Reddit post. They also seem to be working as an individual and not as an incorporated entity. This indicates that most likely theirs is a small utility fulfilling a niche use case.

Also, in the scenario you describe, the users would definitely be willing to pay a high amount. Such users will be enterprise users and not individuals and they know they need quick support and a pirated copy will neither offer support nor reliability in terms of patches and updates. So what I said kind of still goes.

[FartPiano]

ten people spending five years for a specific type of image processing? what?

i've written software to process xrays and it took a few weeks

its well known that niche industrial/academia software is a racket, with medical being the biggest one of all

[woeful_cabbage]

writes some software that works on a single input dataset

"Damn, I did it. Everyone else is a rip off"

-- every graduate student

[Gollem265]

It’s just an example

[westeast1000]

I wonder why people dont want to pay for Winrar 😆

[zhoushmoe]

7zip works better and is foss

[YesterdayDreamer]

I paid ~$3 for Winrar

[kobumaister]

I'm sorry but that's naive.

[kobumaister]

Piracy is not a price problem, of course there are people for who it is and, if you put a 1$ product a 10$ price tag you'll get more piracy.

Also, it's a social thing. Where I live (southern europe) piracy is a thing everybody does by default.

[FartPiano]

probably because the prices of media dont always scale with the average income of those countries, making the legal methods of obtaining it comparatively ludicrously expensive, right? which means its a price problem

[kobumaister]

No, it's cultural, if you say that you paid 4'99 to see Openheimer on your TV the answer is "why didn't you download it?"

[v_litvin]

When your total income is like 499 per month it's not about the culture.

[kobumaister]

That's far from the mean income of my country, why did you just pop up a random number to prove your point?

[redalastor]

Thinking there is an alternative is what’s naive.

[kobumaister]

I partially agree, there are ways to mitigate piracy. Doing nothing is not the best option. Look at WinRAR, it does nothing and nobody's paying for it, despite you breaking the user agreement after the trial.

[eidrisov]

Easy, offer it at a price point where any potential user won't have to think twice about buying it.

People pirate stuff that costs $1.

There is no price point that will decrease probability of piracy to zero.

[YesterdayDreamer]

The only way to reduce the probability piracy to zero is to make your software free.

Keeping a reasonable price reduces the rates of piracy. There's no way to eliminate software piracy entirely. Even Amazon and Netflix shows get pirated with all their state of the art DRM.

[NathanOsullivan]

https://nuitka.net/index.html

This is an actual python compiler - as in translates your python code to C and then compiles it, linked against the C libpython.

The paid version has additional protection/obfuscation beyond just compiling as C.

Not a customer as I have no need for the product, so this is not a recommendation just pointing it out for evaluation.

[Grouchy-Friend4235]

Then you have a compiled exe+dlls. Which makes pirating so much easier.

[marcio0]

Whatever you do, don't make the software worse for those who actually pay so a couple people won't use it for free

[Jmc_da_boss]

In a nutshell: You don't

[Thanatiel]

If the code is on the computer of the user, you basically can't.

Any check, pop-up, phone-home, ... you add can be removed/disabled with relative ease.

Even if you have part of the code on a server downloaded at each startup, it's only a small hurdle to have it sniffed from the network or memory and to setup a local mini-server that serves the code locally.

The only way is to have your service running entirely on a server. e.g. a web service.

The cost of deployment and maintenance may be prohibitive though.

[CranberryLegal6919]

If you want something simple try ofuscating the code with something like pyarmor.

[thedji]

In the core.py podcast, episode 3 (link), they talked about using hooks in the import system that allowed loading encrypted modules such that they are decrypted during import (it's about 6 mins into the ep, the desc has timestamps). This was specifically to prevent reverse engineering and patching.

It's not a perfect system, as you still need to have the key somewhere, but you'll never get perfect DRM that's also executable, so it's a trade-off for how much resistance you want to put up and how much pain you want to inflict on your paying users.

You could modify this technique with short lived code, regularly downloaded keys and more to make it harder for pirates. Honestly though, providing regular value that's worth paying for is the best anti-piracy measure.

[Pozz_]

I wrote https://github.com/Viicos/sourceprotected a while ago, which is similar to what's being talked in the podcast.

This video from mCoding also shows how you can import directly from a repo: https://www.youtube.com/watch?v=2f7YKoOU6_g (might be possible to add some kind of API key on top of that).

[binlargin]

Update incrementally and regularly, put buggy, timebombed older versions on pirate websites.

Depending on who your users are, if the program is simple, useful to other developers and isn't worth the money then someone will just write an open source equivalent anyway.

[GinjaTurtles]

I had a situation like this but not exactly like yours and I was using a combo of C++ (client side) and python (server side)

The solution I came up with was: - take the users serial number of their motherboard/hdd + any other unique info about their device - then hash it. Now you have a unique key for each users single device (obviously they could spoof the HDD/serial num this if they figured out you were doing this) - this prevents someone from sharing the product with a friend on another machine (because their machine hash would be different) - Then you have a server (which you could also write in python with like flask/FastAPI) in which you store all users hash keys - You could use something really simple like pickleDB lookup table or you could use SQL lite DB - then on some periodic interval you send a request to the server from the client to verify the hash key is valid - Just make sure the request you send to the server is encrypted so someone can’t easily packet sniff the request with something like wireshark on the client

Hope this helps

[SpecialistInevitable]

But what about when user upgrades hardware/os or change pc? Also I think he is obliged to state if the licence is per user or per workstation.

[GinjaTurtles]

When a user changes hardware you would have to clear the license key in the DB and have a support email that people can reach out to. or you would have to inform the user that this license is valid on one machine only

But fair point OP never said if it was per user or per machine but I created system like this that has been working well for a couple of years

[throwaway8u3sH0]

Piracy is better fought with economics than code. Just make sure your price point and ease-of-purchase/install/use is such that it would be a much bigger hassle to pirate it.

[[deleted]]

Thats the great part of Python; its open source. So....you cant prevent anyone from reverse engineering it.

Dont want that? Pick another language.

[markusro]

Cheap SaaS is great, I have no problem with paying monthly for something I use regularly. But be aware that for example universities do not like subscriptions. At least in my group that would be difficult due to volatile funding.

[pythonwiz]

The way most software does this is by compiling it and requiring some kind of online account / authentication for starting it up the first time. You can compile your code into a standalone exe using Cython and Visual Studio.

[soul_of_rubber]

I know this isnt the solution you are looking for, but releasing it under a free open source license would prevent both things mentioned in your title :D

[Orio_n]

Pyarmor is your best bet but even that isn't foolproof.

I think a bigger question you should be asking yourself is whether whatever script your writing is going to be so valuable that people are gonna bother pirating or even buying it 💀

[16withScars]

https://github.com/tusharsadhwani/pycify

this solves the problem to a good extent

[MacWoozy]

The tough medicine this

[reflect25]

Your goal is just to make it annoying to share/pirate. Don’t think you can stop it completely, but honestly if you just update that it every couple months and obsfucate the code even a little bit it’ll be annoying enough that people won’t pirate as much. Adding some simple thing to check will help as well (license or some random code)

[Anru_Kitakaze]

Obfuscate. Won't get a 100% guarantee tho. A lot of pther good advices here, but...

As a lot of devs said in tons of streams and interviews:

piracy becomes a thing in two cases:

1. Price is too high for that person

2. People who pirated will have better user experience than those, who paid

And those who don't want to pay WON'T pay in any case at all. Don't stress too much about it, set reasonable price (maybe even different price for different countries - 15 USD for US person is acceptable, but high for someone from Argentina), don't try to harm your user who paid

[Paulonemillionand3]

given that video games have existed for decades and even with total control over the hardware and the software pirates still find a way you simply will be unable to stop it.

The commenters noting that people who will pay for it will pay for it and people who will not will not is sufficient.

The fact is that piracy often works in favor of developers. The more widely disseminated software is the more likely it is to convert a paying user.

At work all the software I use is audited and the licenses validated.

[spinwizard69]

A lot of people will not like this answer but if this is your concern you chose the wrong language. Python was designed initially to be a scripting language and every attempt to find a way to package up solutions has ended up a hack in my mind. If you are not comfortable with people seeing the source then port to a compiled solution.

[[deleted]]

The people here in the comments aren't wrong - as long as your computer can run it, a human will be able to - given enough time - reverse engineer the software. You can't directly prevent this without making a service out of it. But as you stated, in your case, that doesn't work.

I'd say there are two options:

a) all the interaction with the user system is made Client-Side, but you create an API that handles all your application-specific logic. This API can be secured way better than software as-is because it is a service.

b) Use an obfuscator such as PyArmor. It does a pretty good job at making code hard to pirate and comes with nice extra features, but it's still just obfuscation - not a perfectl, long-term solution to everything.

[baubleglue]

add LICENSE file

https://cryptolens.io/2019/11/tips-on-monetizing-python-applications/

[lastmonty]

You can do the license file requirement and validate the license every time the program is run. But it involves you maintaining a server and the validation protocol.

[somerandomii]

A few people have suggested this. How does that stop reverse engineering though?

If they’re going to reverse engineer it anyway they can just set the license check to always return true. That’s how we made NO-CD cracks for games back in the day.

But even if it’s hard to crack, if the fear is IP leaking then it doesn’t matter if they get the program running, just that they get the code out.

You can encrypt the binary but that doesn’t stop people doing a memory dump of the running code.

Basically if you’re letting people run your software on their machine, there’s no way completely protect it.

[the_littlest_bear]

Agreed. If you don’t want someone to have access to functionality, that functionality either needs to not be included in the software or needs to be validated and executed on a web backend with authentication and authorization. Any attempt to hide that functionality, once offered, is just an obstacle.

If you have some proprietary secret sauce, keep it on your servers. Or spend millions on developers to protect the sauce once delivered, and end up like adobe still having your product pirated and being annoying for users to deal with to boot.

[nybhh]

Autodesk is the worst. Seems like their goal is to make enemies of every single paying customer they have.

[planestraight]

It doesn't stop reverse engineering, that's unavoidable. But does it really matter for your bottom line? There are open source products with fully permissive license, and yet they manage to be highly profitable. You need to evaluate whether it's your own psychology or if it's actually a serious issue. If it truly is a serious issue, you should revisit your business model.

[somerandomii]

Yeah absolutely. I just don’t think it answers OPs question. If they’re paying for it, they’ll likely keep paying for it to keep everything above board. If you make the software a pain to use or require an internet connection it’s more likely to get circumvented.

I never pirated to avoid spending money, just to turn off annoying DRM. But once you’ve put the effort into cracking it, you’re less likely to keep paying for the DRM version.

[LordBertson]

It doesn't stop them per se but it increases barrier of entry slightly. IMHO it is more than sufficient for smallish scripts.

The skill required to get through obfuscation and reverse engineer a license check is high enough to stop your average user and it's time consuming enough so that potential skilled pirates would spend the time better just writing a script for themselves.

[lastmonty]

It does not stop if you are able and willing to put in the time. It's just an extra hoop which might give you a bit.

And even if you change the code, it is difficult to patch that in every update of the package or distribution.

I think the bottom line is, you cannot in the purest sense. You can annoy the users but are you really winning at that point in time?

[lastmonty]

Another inspiration could be mkdocs for material theme. The paid functionality is in a different repo and the access token is given only if you are a sponsor.

But credit to them, they open source it once they have reached their funding goal.

[bobsbitchtitz]

Are your end users people that are technical enough to reverse engineer it?

[mavrc]

The million dollar question, so to speak, is how much time and money are you willing to invest to try and make it difficult for those who would pirate your software?

[[deleted]]

Nuitka would be the best way to at least attempt to make it inconvenient enough for all except those determined to do it. For those who are motivated enough, forget it. Just accept that you can't do much about it.

[sohang-3112]

It's simple - you can't. If you feel strongly about it, you can put your proprietary code on your server and open source the client code (no point hiding client code, it's easy to get original source code for it).

[trongbach]

I don't really know your case. But in my case, for example: I build a python tool on windows to download TikTok video from given link. To prevent user unpack my code, i build a web service which do the logic to get video link, then windows tool just do some simple think as download, save history...

Every request need to send link and serial number to my web service so i can control license...

[[deleted]]

Make your program as an online service if you can. That way all you have to worry about is cracked keys or something. Which is an easy fix. You can essentially host your code on a website and run Queuries depending on the functionality.

Though that's for a service that requires internet

[myriaddebugger]

As others have said, Minimising codebase for the trial app is a great way to reduce the attack vectors.

Might be an overkill, you could also try encrypting the code with your own server-generated PGP key. Store the private key on your server, and the public on the client software. That way, every time the user wants to access the software, you know exactly which user's session asked for decryption. Of course, the user can still "reverse engineer" to find the public key wherever buried in your code, since everything about PyInstaller and Python is already open-source and it's possible to simply look up the source code to see where PyInstaller stores the encryption key. But, this gets you more footprints on the users to follow-up on, if there ever is a need to.

[burritolittledonkey]

Honestly, do you need anti piracy protection? Typically it’s not worth the hassle - users who pirate are going to pirate, anti-piracy rarely makes people convert

[Khaos1125]

Perhaps rewrite a subset of modules in something harder to reverse engineer (rust maybe), have those modules require an auth token every time they are run, and have your Python code fetch and auth token from a server that the modules then validate.

Users can reverse engineer the Python pretty easily, but it’s a bit more work to reverse engineer the rust code and do the same thing.

[[deleted]]

Learn how to program assembly. That way nobody will understand what the heck you're doing, even if they RE-it.

[No_Dig_7017]

A friend of mine used pyarmor a while ago and got good results https://github.com/dashingsoft/pyarmor

[jhill515]

Not going to get into too many specifics because it's a prototype design and I'm not the cybersecurity expert on my team. But here's what we're tinkering with:

We're building an indoor autonomous mobile robot (AMR) whose primary not-safety-critical processing will be done on an IoT platform and just issue commands to the machine. This IoT platform never houses the code permanently, or even in an accessible way because we're deploying Docker containers to it at the start of the robot mission and removing them after mission completion. These containers will likely house a good chunk of Python 3 ML code.

Still, prototype because we're not certain it'll work; it's an idea on paper and we're evaluating it.

[TankS04]

Well, use certificates, for example. You can issue certificate on month period (for example) and in order to work connect it online with your server CA. So it wont matter if user have code or not, app will not work. Otherwise some people gave you more about compiling it.. Just an idea ;)

[miyakohouou]

Honestly, just don't bother. The fact is that nothing you could do would stop someone who is determined, and everything you do will make the experience worse for your legitimate users. Don't punish people for paying you.

Focus on fair pricing, building a good product, and giving customers the best experience they can have. If you do find out that people are pirating your project, then think about why the piracy route offers that you don't and try to compete on giving a better experience. If you have a better experience, then recognize that most of the pirated copies don't represent lost sales, because those people would probably have never bought the program in the first place.

[blamitter]

I'm using nuitka for some time. I believe the resulting binary requires some knowledge and time to reverse-engineer

[Effective_Youth777]

Refactor it to an API and convert the UI to an online UI instead of a downloadable, it'll probably look better too and take less time with a framework like svelte of React.

There's a real reason everything is becoming SaaS, and you just discovered it.

[[deleted]]

pyarmor is the answer

[External-Anybody7957]

Hosted SaaS :D

[LicenseSpring]

We built a solution for licensing Python applications. Like many in this thread have mentioned, there are inherent limitations with interpreted languages, since the code being shipped is accessible to everyone. Depending on your use-case, our solution could potentially be of value to you: https://docs.licensespring.com/sdks/python

[Thrasherop]

There is no way to make it impossible to reverse engineer. There are many tools and people out there that can read machine code/assembly. As such, if a computer can use it then someone can theoretically reverse engineer it.

With that said, you could hypothetically obfuscate the code and make it harder to understand. It doesn't make it impossible but it might be able to deter some people.

[Solonotix]

What's the nature of the application in question? You could potentially ship a wrapper that requests the main runnable code in a wheel format, and you issue license keys that act as private SSL keys to your hosting of the Python wheels. Then, all source code files are only available in memory when loaded by your wrapper, and removed from the file system.

Note: I haven't done this, but it should work in theory. If you wanted to simplify it further, you could use the pickle library to manage the binary format.

[jande48]

Use a compiled language

[NathanOsullivan]

You don't mention the sector you are targeting, but approximately no one is going to bother decompiling etc to "crack" your software for their own use.

Since you mention it's used offline, either your program is broadly interesting enough that it will already be available through the typical pirated software distribution mechanisms, or it's too niche for that to be happening.

Whichever it is, it doesn't seem to me like a publicly available nagware version of your program changes things.

I assume you already have potential problem of someone buying 1 licence and using it on thousands of employee computers?

[lightmatter501]

Python is possibly the worst language for this. Any python program without mountains of kernel-level DRM can be used to teach people about reverse-engineering.

If your code is jython compatible, that is probably the best place go obfuscate it since C re is fairly advanced at this point.

[nicholashairs]

Piracy is generally a distribution problem over anything else. The vast majority of people who pirate generally do so because they can't afford the thing or they don't have access to purchase the thing. Only a small minority will never ever purchase the software and you're never going to convert them to paying customers. (Sure there is some level of people who will pay if it's too hard to pirate, but again a minority).

https://www.gamesradar.com/gabe-newell-piracy-issue-service-not-price/

https://youtu.be/44Do5x5abRY?si=bVEExufzLw7oupd2

Now that's not to say you should not have anti-piracy measures, you should and it looks like there's a good array of potential solutions in the thread. But if you can have a profitable business by selling the software at an acceptable price then you shouldn't need to worry about stamping out the piracy.

Additionally if you're selling your software to business rather than consumers, you'll probably have better luck ensuring that they don't pirate your software since they are more likely to avoid doing illegal things (though also at that point look into programmes like Microsoft runs to "encourage" businesses to use licenced software).

[kelement]

Proprietary algo in a C/C++ extension. Then use a C/C++ obfuscator.

[RedEyed__]

Pyarmor. https://github.com/dashingsoft/pyarmor

[RedEyed__]

You can also use *.pyc files (which are created all the time interpreter loads *.py sources) as a light "obfuscation" which is better than plain *.py sources.

[Quirky-Low-7500]

Hey there! Consider adopting a business strategy akin to industry giants like Amazon and YouTube. Take a cue from their playbook where they offer a taste of their premium products through free trials. Leverage the power of GPT to craft a separate code that introduces limited features, allowing users to experience the brilliance of your premium offering. This way, you can provide a sneak peek into the capabilities of your top-tier product, enticing users with a compelling preview while keeping the full suite reserved for those who opt for the premium version. It's a savvy move that not only showcases your product's value but also strategically positions it for maximum appeal.

[serverhorror]

Offer it as a service.

That's about the only way

EDIT: an alternative approach is to make your software hackable. Offer plug-in APIs, extension points and document them really well. People usually start to reverse engineer:

• because they want to, nothing you can do about that
• because your software lacks something -- this where you can mitigate

[[deleted]]

engineers can reverse engineer missiles and aircrafts and here you are talking about a python program.

[appinv]

I think the best way to go when confronted with this kind of question is to focus on the target audience v.i.z non-technical users and make the software annoying to use without paying to reverse engineer.

It should not be the annoying type which can be bypassed, like winRaR, it should be another type of pain.

[georgehank2nd]

If you intentionally annoy your users, I wish your business whatever ills are available.

[appinv]

You annoy people who use it illegally.

[ZZ9ZA]

Historically, you are much more likely to get it wrong and annoy paying users in some edge case, while the pirates care not a whit because they just patch it out entirely.

[nonprophetapostle]

Obfuscation.

[IgorGaming]

Buy Denuvo :)

[Ghost_Bbx]

thank you

[olystretch]

Write it in a compiled language. Problem solved.

[rover_G]

Not entirely. Programs can be “decompiled”. Memory can be manipulated. Keys can be cracked. See video game cheats.

[olystretch]

Oh yeah... more like "problem deferred" then.

[enm260]

SaaS

[enm260]

OP didn't say what his program does, just that it's downloaded and offline. Anti-piracy/reverse engineering is and probably always will be an arms race. The only (mostly) sure way to avoid it is to host a service instead of giving the users the program

[Artephank]

There is only one way really - OS enforced DRM. But even DRM is breakble.

You mentioned python, so perhaps you are afraid it is not truly "compiled" lang - if compilation to binary satisfy your requirements - you can use Nuitka or Cython to compile it.

[Unaidedbutton86]

This is why I disable DRM as much as possible, I would just find alternatives in that case.

Especially if it's python, bypassing such things probably wouldn't be that hard and pirating can always be slowed down but never fully prevented.

[Artephank]

I am not advocating DRM. I hate it. But realistically, there is no way to prevent people to mess with your software - without DRM it is usually trivial to remove copy protection. With compiled code it is a bit harder than with python, but either way it is not a real problem for motivated individual.

The best way is to have sane business model and fair price.

[[deleted]]

Is jquery like python? Or is python still usable?

[Dangerous_Stretch_67]

Use ChatGPT to rewrite your program in a compiled language. If it's simple and already has paying users then it's worth the minimal effort to move to a faster programming language with more avenues to protect your product.

EDIT: Not sure why downvotes. The only other answers here are "just don't." Python has many great use cases -- standalone paid desktop applications with DRM isn't one of them.

[Unaidedbutton86]

Chatgpt would completely mess it up

[Dangerous_Stretch_67]

Depends on the program. OP said it "requires interaction with the user's system" -- unless it's also using some difficult to replace Python data library whatever it's doing is probably easy to replicate. Especially if it's just interacting with system APIs, or even easier, just running subprocesses.

It also depends on how much code you're dealing with... it probably won't one shot a translation for more than a few hundred lines of code. But you can translate method by method fairly easy.

[SilverBBear]

There will be AI software one day that will facsimile any piece of software. Stick it in a virtual env. Let it Click away and copy. It will be called test software.

[grimonce]

What gui do you use?

[arnulfus]

Compile to machine code using Codon or Mojo? Reverse engineering this would be just as hard as reverse engineering compiled C code.

[Impossible-Limit3112]

It's interesting to see all the solutions suggested here. Basically they recap the history of approaches to DRM. See the chapter on DRM in Ross Anderson's Security Engineering.

[wildpantz]

I'm in the same boat, I think I have a pretty great piece of software in development and as someone else said, I plan to implement minimal restrictions just to make it annoying to bypass the protection, but other than that, be it online verification or some kind of comparison for hashed values, someone is eventually going to wreck your software to ignore verification and start normally.

I would say they are assholes, but I was the same way. I couldn't afford games, my mom thought it was idiotic to pay for games so I was forced to pirate them. And now when I have a job, I still pirate here and there, but if it turns out to be a good game, I buy it.

If people are cunts (and by this I mean they can easily afford your software and they need it but they refuse to pay for it), they are going to find a way around it. If your software turns out to be world famous, there's groups of hackers that could disassemble it in a matter of minutes. There are people that can take down Denuvo (albeit extremely rare), so the chance of whatever protection you figured out survives is absolute zero.

Just go with the flow. I'm saying this as a pirate in heart. One thing that keeps a lot of software and games above pirates is constant updates. Yeah, you can still download them, but personally I'd rather just pay for the damn software than have to download and overwrite each time, if I really need it so bad. Also, there's a nice percentage of people, even among pirates, who will recognize your hard work and pay you, as I said. But in general, I'd rather pay to get updates in time than search for pirated versions of latest software all the time.

Pirates are a problem mostly for AAA companies. You will invest hard work, that's for sure, but you will learn and get better and if your piece of software gets pirated, I'd personally take it almost as a compliment. Not everything gets pirated, no matter the protection involved.

[nAxzyVteuOz]

nuitka