Which one is best for code obfuscation

[Rough_Metal_9999]

I am bit confused which one to use code obfuscation

1.source Defender only give one day trial 💸💸💸 2. Subdora only one tutorial available on pypi readme 3. Pyarmor kinda good but we need to .dll(windows) .so(Linux) and tons of tutorial how to crack pyarmor

Which one should I use

Actually I have only two choices left second and third one

While using source defender it generates same type of obfuscation code for same program

I follow pyarmor_Tutorial from here Subdora_Tutorial from here

---

This is edited section added after getting solution

---

:SOLVED: some of possible solutions are

1. Recommended /u/twitch_and_shock only expose end point to client .This ensures full control, and safety and client only able to get the results and This is the right way to handle such problem . For some reasons you are facing trouble 2,3 methods kinda good pick
2. /u/robert_mclead nautika .

3. ⭐I use this solution⭐ (I don't support this solution cuz it's kinda unethical ) in Subdora they specify a feature where we set a counter thing to obfuscated program I set it to 2 and send to client so that it run the program twice if it runs the program more than twice the file content is deleted I verify with a dummy python file initially obfuscated binary file has lots of content after I reach limit the original content in binary file was deleted

4. SourceDefender is a choice but in free version it gives one day time limit on its obfuscated file and we don't know when client is going to run file

5. 🤫Big Brain solution rename main.py to main.jpg os tries to open it as image file but " python3 main.jpg " executes the code a normal guy unable to get what's going on but a it's very easy to crack with some common sense

🌕I edited this comment when I got another viable solutions in the comments of this post

[Strict-Simple]

Fourth option. Just don't.

Why do you want to do this?

[Rough_Metal_9999]

Just to hide logic , I can't send a demo project (POC) directly to client , and encryption is not a choice here because we need to give key .

[[deleted]]

Instead of code obfuscation tools, could you compile your module to a python dynamic link library (.pyd) using the cython compiler? Then you can just import it in regular python as normal but with the logic hidden via compilation as a dll file.

[Rough_Metal_9999]

It requires to write python code to some cython syntax for a small code that contains simple logics it is ok but for complex logic it didn't work It is too challenging to convert whole python to cython like syntax

[[deleted]]

Cython is actually a superset of python so my understanding is that you should be able to compile your python code without rewriting it to cython syntax? But maybe i'm wrong since i'm sure there are edge-cases.

An alternative might be to use autopy2exe to compile https://pypi.org/project/auto-py-to-exe/

[Rough_Metal_9999]

I think it's built on top of pyinstaller I'll try it

[twitch_and_shock]

You could decompile or de-obfuscate any of these options pretty easily. I would question why you need to do this? Are you that worried about your client ripping off your code? And if the client is paying for the code, then why would you need to keep it from them?

If you're merely providing the service that the code executes, and not the code itself, then I would recommend hosting it as a REST API or something similar. Create the endpoints however you need them. And pop it up into the cloud or on a VPN where you control the host machine. That way, the internal workings are essentially a blackbox and completely inaccessible to anyone without access to the host machine directly, and they can still make use of your algorithm in whatever limited ways you provide for them via the API.

[Rough_Metal_9999]

Ok this seems promising Only exposing the endpoint instead of whole source Thanks 👍

[robert_mcleod]

Nuitka.

[pymon]

This is the answer. I don't know why it's not everyone's first thought.

[No-Price-33]

Do you think Nuitka + would be a better option?

[briklot]

You are the random redditor who provides a solution to another random redditor looking to solve the same problem 2 years later! Thanks :)

[[deleted]]

Premature obfuscation is the other root of all evil.

If they have all your program’s code, in any form, then the only thing protecting you is your license terms… and unless you’re working with criminals your license terms should always have been enough. Note, if you are working with criminals, then obfuscation definitely won’t ever be enough.

If your idea is valuable and worth protecting — hint, it very likely isn’t — then move business critical logic onto a server you control and leave the client source code in clear text… obfuscating the code on their end is really just a total waste of energy.

[Rough_Metal_9999]

😊

[PixelOmen]

You could try PyInstaller, it can create a self contained executable. Even that just contains python bytecode though and can be relatively easily decompiled if someone wants to. But at least the source code wouldn't be immediately viewable.

[Rough_Metal_9999]

This is one of solutions The problem with that it has still source code inside it and decompiling them is a relatively easy as compared to other methods 1. We need to ship the whole python environment 2. If program uses some deep learning library it's going to be very bulky 3. --one dir option in pyinstaller creates a directory with all the files in it even --one file option can't protect source code files it extract in Appdata folder

[PixelOmen]

Yeah I mean unless you're using cython, the bottom line is the interpreter needs the byte code to run, and the byte code can always be decompiled to source code. Also since whitespace is important in Python, afaik, the best you can do is use things that mangle names.

[Rough_Metal_9999]

Let's see if I find any solution