How do I protect Python code

Question

I am developing a piece of software in Python that will be distributed to my employer s customers  My employer wants to limit the usage of the software with a time restricted license file   If we distribute the  py files or even  pyc files it will be easy to  decompile and  remove the code that checks the license file   Another aspect is that my employer does not want the code to be read by our customers  fearing that the code may be stolen or at least the  novel ideas    Is there a good way to handle this problem  Preferably with an off-the-shelf solution   The software will run on Linux systems  so I don t think py2exe will do the trick

User · Answer

I think there is one more method to protect your Python code; part of the Obfuscation method. I believe there was a game like Mount and Blade or something that changed and recompiled their own python interpreter (the original interpreter which i believe is open source) and just changed the OP codes in the OP code table to be different then the standard python OP codes.

So the python source is unmodified but the file extensions of the *.pyc files are different and the op codes don't match to the public python.exe interpreter. If you checked the games data files all the data was in Python source format.

All sorts of nasty tricks can be done to mess with immature hackers this way. Stopping a bunch of inexperienced hackers is easy. It's the professional hackers that you will not likely beat. But most companies don't keep pro hackers on staff long I imagine (likely because things get hacked). But immature hackers are all over the place (read as curious IT staff).

You could for example, in a modified interpreter, allow it to check for certain comments or doc strings in your source. You could have special OP codes for such lines of code. For example:

OP 234 is for source line "# Copyright I wrote this" or compile that line into op codes that are equivalent to "if False:" if "# Copyright" is missing. Basically disabling a whole block of code for what appears to be some obscure reason.

One use case where recompiling a modified interpreter may be feasible is where you didn't write the app, the app is big, but you are paid to protect it, such as when you're a dedicated server admin for a financial app.

I find it a little contradictory to leave the source or opcodes open for eyeballs, but use SSL for network traffic. SSL is not 100% safe either. But it's used to stop MOST eyes from reading it. A wee bit precaution is sensible.

Also, if enough people deem that Python source and opcodes are too visible, it's likely someone will eventually develop at least a simple protection tool for it. So the more people asking "how to protect Python app" only promotes that development.

User · Answer

I was surprised in not seeing pyconcrete in any answer  Maybe because it s newer than the question   It could be exactly what you need ed    Instead of obfuscating the code  it encrypts it and decrypts at load time   From pypi page      Protect python script work flow          your script py import pyconcrete   pyconcrete will hook import module    when your script do import MODULE    pyconcrete import hook will try to find MODULE pye first and then   decrypt MODULE pye via  pyconcrete pyd and execute decrypted data  as    pyc content     encrypt  amp  decrypt secret key record in  pyconcrete pyd    like DLL or SO  the secret key would be hide in binary code  can   t   see it directly in HEX view

User · Answer

What about signing your code with standard encryption schemes by hashing and signing important files and checking it with public key methods   In this way you can issue license file with a public key for each customer   Additional you can use an python obfuscator like this one  just googled it

User · Answer

Though there s no perfect solution  the following can be done    Move some critical piece of startup code into a native library  Enforce the license check in the native library    If the call to the native code were to be removed  the program wouldn t start anyway  If it s not removed then the license will be enforced   Though this is not a cross-platform or a pure-Python solution  it will work

User · Answer

There is a comprehensive answer on concealing the python source code  which can be find here   Possible techniques discussed are  - use compiled bytecode  python -m compileall  - executable creators  or installers like PyInstaller  - software as an service  the best solution to conceal your code in my opinion  - python source code obfuscators

User · Answer

using cxfreeze   py2exe for linux   will do the job   http   cx-freeze sourceforge net   it is available in ubuntu repositories

User · Answer

You should take a look at how the guys at getdropbox com do it for their client software  including Linux  It s quite tricky to crack and requires some quite creative disassembly to get past the protection mechanisms

User · Answer

Python is not the tool you need  You must use the right tool to do the right thing  and Python was not designed to be obfuscated  It s the contrary  everything is open or easy to reveal or modify in Python because that s the language s philosophy   If you want something you can t see through  look for another tool  This is not a bad thing  it is important that several different tools exist for different usages   Obfuscation is really hard  Even compiled programs can be reverse-engineered so don t think that you can fully protect any code  You can analyze obfuscated PHP  break the flash encryption key  etc  Newer versions of Windows are cracked every time   Having a legal requirement is a good way to go  You cannot prevent somebody from misusing your code  but you can easily discover if someone does  Therefore  it s just a casual legal issue   Code protection is overrated  Nowadays  business models tend to go for selling services instead of products  You cannot copy a service  pirate nor steal it  Maybe it s time to consider to go with the flow

User · Answer

I understand that you want your customers to use the power of python but do not want expose the source code   Here are my suggestions    a  Write the critical pieces of the code as C or C   libraries and then use SIP or swig to expose the C C   APIs to Python namespace    b  Use cython instead of Python   c  In both  a  and  b   it should be possible to distribute the libraries as licensed binary with a Python interface

User · Answer

Though there s no perfect solution  the following can be done    Move some critical piece of startup code into a native library  Enforce the license check in the native library    If the call to the native code were to be removed  the program wouldn t start anyway  If it s not removed then the license will be enforced   Though this is not a cross-platform or a pure-Python solution  it will work

User · Answer

Long story short    Encrypt your source code Write your own python module loader to decrypt your code when importing Implement the module loader in C C   You can add more features to the module loader  for example anti-debugger  license control  hardware fingerprint binding  etc    For more detail  look this answer   If you are interested in the topic  this project will help you - pyprotect

User · Answer

Is your employer aware that he can  steal  back any ideas that other people get from your code  I mean  if they can read your work  so can you theirs  Maybe looking at how you can benefit from the situation would yield a better return of your investment than fearing how much you could lose    EDIT  Answer to Nick s comment   Nothing gained and nothing lost  The customer has what he wants  and paid for it since he did the change himself   Since he doesn t release the change  it s as if it didn t happen for everyone else   Now if the customer sells the software  they have to change the copyright notice  which is illegal  so you can sue and will win -  simple case    If they don t change the copyright notice  the 2nd level customers will notice that the software comes from you original and wonder what is going on  Chances are that they will contact you and so you will learn about the reselling of your work   Again we have two cases  The original customer sold only a few copies  That means they didn t make much money anyway  so why bother  Or they sold in volume  That means better chances for you to learn about what they do and do something about it   But in the end  most companies try to comply to the law  once their reputation is ruined  it s much harder to do business   So they will not steal your work but work with you to improve it  So if you include the source  with a license that protects you from simple reselling   chances are that they will simply push back changes they made since that will make sure the change is in the next version and they don t have to maintain it  That s win-win  You get changes and they can make the change themselves if they really  desperately need it even if you re unwilling to include it in the official release

User · Answer

Another attempt to make your code harder to steal is to use jython and then use java obfuscator    This should work pretty well as jythonc translate python code to java and then java is compiled to bytecode  So ounce you obfuscate the classes it will be really hard to understand what is going on after decompilation  not to mention recovering the actual code    The only problem with jython is that you can t use python modules written in c

User · Answer

Python is not the tool you need  You must use the right tool to do the right thing  and Python was not designed to be obfuscated  It s the contrary  everything is open or easy to reveal or modify in Python because that s the language s philosophy   If you want something you can t see through  look for another tool  This is not a bad thing  it is important that several different tools exist for different usages   Obfuscation is really hard  Even compiled programs can be reverse-engineered so don t think that you can fully protect any code  You can analyze obfuscated PHP  break the flash encryption key  etc  Newer versions of Windows are cracked every time   Having a legal requirement is a good way to go  You cannot prevent somebody from misusing your code  but you can easily discover if someone does  Therefore  it s just a casual legal issue   Code protection is overrated  Nowadays  business models tend to go for selling services instead of products  You cannot copy a service  pirate nor steal it  Maybe it s time to consider to go with the flow

User · Answer

Shipping  pyc files has its problems - they are not compatible with any other python version than the python version they were created with  which means you must know which python version is running on the systems the product will run on  That s a very limiting factor

User · Answer

In some circumstances  it may be possible to move  all  or at least a key part  of the software into a web service that your organization hosts   That way  the license checks can be performed in the safety of your own server room

User · Answer

You should take a look at how the guys at getdropbox com do it for their client software  including Linux  It s quite tricky to crack and requires some quite creative disassembly to get past the protection mechanisms

User · Answer

Depending in who the client is  a simple protection mechanism  combined with a sensible license agreement will be far more effective than any complex licensing encryption obfuscation system   The best solution would be selling the code as a service  say by hosting the service  or offering support - although that isn t always practical   Shipping the code as  pyc files will prevent your protection being foiled by a few  s  but it s hardly effective anti-piracy protection  as if there is such a technology   and at the end of the day  it shouldn t achieve anything that a decent license agreement with the company will   Concentrate on making your code as nice to use as possible - having happy customers will make your company far more money than preventing some theoretical piracy

User · Answer

quot Is there a good way to handle this problem  quot   No   Nothing can be protected against reverse engineering   Even the firmware on DVD machines has been reverse engineered and the AACS Encryption key exposed   And that s in spite of the DMCA making that a criminal offense  Since no technical method can stop your customers from reading your code  you have to apply ordinary commercial methods   Licenses   Contracts   Terms and Conditions   This still works even when people can read the code   Note that some of your Python-based components may require that you pay fees before you sell software using those components   Also  some open-source licenses prohibit you from concealing the source or origins of that component   Offer significant value   If your stuff is so good -- at a price that is hard to refuse -- there s no incentive to waste time and money reverse engineering anything   Reverse engineering is expensive   Make your product slightly less expensive   Offer upgrades and enhancements that make any reverse engineering a bad idea   When the next release breaks their reverse engineering  there s no point   This can be carried to absurd extremes  but you should offer new features that make the next release more valuable than reverse engineering   Offer customization at rates so attractive that they d rather pay you to build and support the enhancements   Use a license key which expires   This is cruel  and will give you a bad reputation  but it certainly makes your software stop working   Offer it as a web service   SaaS involves no downloads to customers

User · Answer

Is your employer aware that he can  steal  back any ideas that other people get from your code  I mean  if they can read your work  so can you theirs  Maybe looking at how you can benefit from the situation would yield a better return of your investment than fearing how much you could lose    EDIT  Answer to Nick s comment   Nothing gained and nothing lost  The customer has what he wants  and paid for it since he did the change himself   Since he doesn t release the change  it s as if it didn t happen for everyone else   Now if the customer sells the software  they have to change the copyright notice  which is illegal  so you can sue and will win -  simple case    If they don t change the copyright notice  the 2nd level customers will notice that the software comes from you original and wonder what is going on  Chances are that they will contact you and so you will learn about the reselling of your work   Again we have two cases  The original customer sold only a few copies  That means they didn t make much money anyway  so why bother  Or they sold in volume  That means better chances for you to learn about what they do and do something about it   But in the end  most companies try to comply to the law  once their reputation is ruined  it s much harder to do business   So they will not steal your work but work with you to improve it  So if you include the source  with a license that protects you from simple reselling   chances are that they will simply push back changes they made since that will make sure the change is in the next version and they don t have to maintain it  That s win-win  You get changes and they can make the change themselves if they really  desperately need it even if you re unwilling to include it in the official release

User · Answer

Though there s no perfect solution  the following can be done    Move some critical piece of startup code into a native library  Enforce the license check in the native library    If the call to the native code were to be removed  the program wouldn t start anyway  If it s not removed then the license will be enforced   Though this is not a cross-platform or a pure-Python solution  it will work

User · Answer

Use the same way to protect binary file of c c    that is  obfuscate each function body in executable or library binary file  insert an instruction  jump  at the begin of each function entry  jump to special function to restore obfuscated code  Byte-code is binary code of Python script  so    First compile python script to code object Then iterate each code object  obfuscate co code of each code object as the following        0   JUMP ABSOLUTE            n   3   len bytecode       3                 Here it s obfuscated bytecode              n   LOAD GLOBAL                   pyarmor        n 3 CALL FUNCTION            0     n 6 POP TOP     n 7 JUMP ABSOLUTE            0    Save obfuscated code object as  pyc or  pyo file   Those obfuscated file   pyc or  pyo  can be used by normal python interpreter  when those code object is called first time   First op is JUMP ABSOLUTE  it will jump to offset n At offset n  the instruction is to call a PyCFunction  This function will restore those obfuscated bytecode between offset 3 and n  and put the original byte-code at offset 0  The obfuscated code can be got by the following code       char  obfucated bytecode      Py ssize t len      PyFrameObject  frame   PyEval GetFrame        PyCodeObject  f code   frame- f code      PyObject  co code   f code- co code            PyBytes AsStringAndSize co code   obfucated bytecode   len   After this function returns  the last instruction is to jump to offset 0  The really byte-code now is executed    There is a tool Pyarmor to obfuscate python scripts by this way

User · Answer

Do not rely on obfuscation  As You have correctly concluded  it offers very limited protection  UPDATE  Here is a link to paper which reverse engineered obfuscated python code in Dropbox  The approach - opcode remapping is a good barrier  but clearly it can be defeated   Instead  as many posters have mentioned make it    Not worth reverse engineering time  Your software is so good  it makes sense to pay  Make them sign a contract and do a license audit if feasible     Alternatively  as the kick-ass Python IDE WingIDE does  Give away the code  That s right  give the code away and have people come back for upgrades and support

User · Answer

Have you had a look at pyminifier  It does Minify  obfuscate  and compress Python code  The example code looks pretty nasty for casual reverse engineering     pyminifier --nonlatin --replacement-length 50  tmp tumult py    usr bin env python3                            ImportError                            print                           False                            object try   import demiurgic except                                                          Warning  You re not demiurgic  Actually  I think that s normal    try   import mystificate except                                                          Warning  Dark voodoo may be unreliable                                                         class                                                         def   init   self  args   kwargs     pass  def                            self dactyl                                demiurgic palpitation dactyl                              mystificate dark voodoo                               return                            def                           self whatever                                whatever  if   name       main                                  Forming                                                             epicaricacy   perseverate                                                          Codswallop     Created by pyminifier  https   github com liftoff pyminifier

User · Answer

Python  being a byte-code-compiled interpreted language  is very difficult to lock down   Even if you use a exe-packager like py2exe  the layout of the executable is well-known  and the Python byte-codes are well understood   Usually in cases like this  you have to make a tradeoff   How important is it really to protect the code   Are there real secrets in there  such as a key for symmetric encryption of bank transfers   or are you just being paranoid   Choose the language that lets you develop the best product quickest  and be realistic about how valuable your novel ideas are   If you decide you really need to enforce the license check securely  write it as a small C extension so that the license check code can be extra-hard  but not impossible   to reverse engineer  and leave the bulk of your code in Python

User · Answer

Shipping  pyc files has its problems - they are not compatible with any other python version than the python version they were created with  which means you must know which python version is running on the systems the product will run on  That s a very limiting factor

User · Answer

Use Cython  It will compile your modules to high-performant C files  which can then be compiled to native binary libraries  This is basically un-reversable  compared to  pyc bytecode   I ve written a detailed article on how to set up Cython for a Python project  check it out   Protecting Python Sources With Cython

User · Answer

What about signing your code with standard encryption schemes by hashing and signing important files and checking it with public key methods   In this way you can issue license file with a public key for each customer   Additional you can use an python obfuscator like this one  just googled it

User · Answer

The reliable only way to protect code is to run it on a server you control and provide your clients with a client which interfaces with that server

User · Answer

Python  being a byte-code-compiled interpreted language  is very difficult to lock down   Even if you use a exe-packager like py2exe  the layout of the executable is well-known  and the Python byte-codes are well understood   Usually in cases like this  you have to make a tradeoff   How important is it really to protect the code   Are there real secrets in there  such as a key for symmetric encryption of bank transfers   or are you just being paranoid   Choose the language that lets you develop the best product quickest  and be realistic about how valuable your novel ideas are   If you decide you really need to enforce the license check securely  write it as a small C extension so that the license check code can be extra-hard  but not impossible   to reverse engineer  and leave the bulk of your code in Python

User · Answer

The best you can do with Python is to obscure things    Strip out all docstrings Distribute only the  pyc compiled files  freeze it Obscure your constants inside a class module so that help config  doesn t show everything   You may be able to add some additional obscurity by encrypting part of it and decrypting it on the fly and passing it to eval    But no matter what you do someone can break it   None of this will stop a determined attacker from disassembling the bytecode or digging through your api with help  dir  etc

User · Answer

Depending in who the client is  a simple protection mechanism  combined with a sensible license agreement will be far more effective than any complex licensing encryption obfuscation system   The best solution would be selling the code as a service  say by hosting the service  or offering support - although that isn t always practical   Shipping the code as  pyc files will prevent your protection being foiled by a few  s  but it s hardly effective anti-piracy protection  as if there is such a technology   and at the end of the day  it shouldn t achieve anything that a decent license agreement with the company will   Concentrate on making your code as nice to use as possible - having happy customers will make your company far more money than preventing some theoretical piracy

User · Answer

Another attempt to make your code harder to steal is to use jython and then use java obfuscator    This should work pretty well as jythonc translate python code to java and then java is compiled to bytecode  So ounce you obfuscate the classes it will be really hard to understand what is going on after decompilation  not to mention recovering the actual code    The only problem with jython is that you can t use python modules written in c

User · Answer

In some circumstances  it may be possible to move  all  or at least a key part  of the software into a web service that your organization hosts   That way  the license checks can be performed in the safety of your own server room

User · Answer

What about signing your code with standard encryption schemes by hashing and signing important files and checking it with public key methods   In this way you can issue license file with a public key for each customer   Additional you can use an python obfuscator like this one  just googled it

User · Answer

I have looked at software protection in general for my own projects and the general philosophy is that complete protection is impossible   The only thing that you can hope to achieve is to add protection to a level that would cost your customer more to bypass than it would to purchase another license   With that said I was just checking google for python obsfucation and not turning up a lot of anything   In a  Net solution  obsfucation would be a first approach to your problem on a windows platform  but I am not sure if anyone has solutions on Linux that work with Mono     The next thing would be to write your code in a compiled language  or if you really want to go all the way  then in assembler   A stripped out executable would be a lot harder to decompile than an interpreted language   It all comes down to tradeoffs   On one end you have ease of software development in python  in which it is also very hard to hide secrets   On the other end you have software written in assembler which is much harder to write  but is much easier to hide secrets   Your boss has to choose a point somewhere along that continuum that supports his requirements   And then he has to give you the tools and time so you can build what he wants    However my bet is that he will object to real development costs versus potential monetary losses

User · Answer

Compile python and distribute binaries   Sensible idea    Use Cython  Nuitka  Shed Skin or something similar to compile python to C code  then distribute your app as python binary libraries  pyd  instead   That way  no Python  byte  code is left and you ve done any reasonable amount of obscurification anyone  i e  your employer  could expect from regular Code  I think    NET or Java less safe than this case  as that bytecode is not obfuscated and can relatively easily be decompiled into reasonable source    Cython is getting more and more compatible with CPython  so I think it should work   I m actually considering this for our product   We re already building some thirdparty libs as pyd dlls  so shipping our own python code as binaries is not a overly big step for us    See This Blog Post  not by me  for a tutorial on how to do it   thx  hithwen   Crazy idea   You could probably get Cython to store the C-files separately for each module  then just concatenate them all and build them with heavy inlining  That way  your Python module is pretty monolithic and difficult to chip at with common tools   Beyond crazy   You might be able to build a single executable if you can link to  and optimize with  the python runtime and all libraries  dlls  statically  That way  it d sure be difficult to intercept calls to from python and whatever framework libraries you use  This cannot be done if you re using LGPL code though

User · Answer

Python is not the tool you need  You must use the right tool to do the right thing  and Python was not designed to be obfuscated  It s the contrary  everything is open or easy to reveal or modify in Python because that s the language s philosophy   If you want something you can t see through  look for another tool  This is not a bad thing  it is important that several different tools exist for different usages   Obfuscation is really hard  Even compiled programs can be reverse-engineered so don t think that you can fully protect any code  You can analyze obfuscated PHP  break the flash encryption key  etc  Newer versions of Windows are cracked every time   Having a legal requirement is a good way to go  You cannot prevent somebody from misusing your code  but you can easily discover if someone does  Therefore  it s just a casual legal issue   Code protection is overrated  Nowadays  business models tend to go for selling services instead of products  You cannot copy a service  pirate nor steal it  Maybe it s time to consider to go with the flow

User · Answer

The best you can do with Python is to obscure things    Strip out all docstrings Distribute only the  pyc compiled files  freeze it Obscure your constants inside a class module so that help config  doesn t show everything   You may be able to add some additional obscurity by encrypting part of it and decrypting it on the fly and passing it to eval    But no matter what you do someone can break it   None of this will stop a determined attacker from disassembling the bytecode or digging through your api with help  dir  etc

User · Answer

Do not rely on obfuscation  As You have correctly concluded  it offers very limited protection  UPDATE  Here is a link to paper which reverse engineered obfuscated python code in Dropbox  The approach - opcode remapping is a good barrier  but clearly it can be defeated   Instead  as many posters have mentioned make it    Not worth reverse engineering time  Your software is so good  it makes sense to pay  Make them sign a contract and do a license audit if feasible     Alternatively  as the kick-ass Python IDE WingIDE does  Give away the code  That s right  give the code away and have people come back for upgrades and support

User · Answer

Have you had a look at pyminifier  It does Minify  obfuscate  and compress Python code  The example code looks pretty nasty for casual reverse engineering     pyminifier --nonlatin --replacement-length 50  tmp tumult py    usr bin env python3                            ImportError                            print                           False                            object try   import demiurgic except                                                          Warning  You re not demiurgic  Actually  I think that s normal    try   import mystificate except                                                          Warning  Dark voodoo may be unreliable                                                         class                                                         def   init   self  args   kwargs     pass  def                            self dactyl                                demiurgic palpitation dactyl                              mystificate dark voodoo                               return                            def                           self whatever                                whatever  if   name       main                                  Forming                                                             epicaricacy   perseverate                                                          Codswallop     Created by pyminifier  https   github com liftoff pyminifier

User · Answer

Do not rely on obfuscation  As You have correctly concluded  it offers very limited protection  UPDATE  Here is a link to paper which reverse engineered obfuscated python code in Dropbox  The approach - opcode remapping is a good barrier  but clearly it can be defeated   Instead  as many posters have mentioned make it    Not worth reverse engineering time  Your software is so good  it makes sense to pay  Make them sign a contract and do a license audit if feasible     Alternatively  as the kick-ass Python IDE WingIDE does  Give away the code  That s right  give the code away and have people come back for upgrades and support

User · Answer

using cxfreeze   py2exe for linux   will do the job   http   cx-freeze sourceforge net   it is available in ubuntu repositories

User · Answer

Use Cython  It will compile your modules to high-performant C files  which can then be compiled to native binary libraries  This is basically un-reversable  compared to  pyc bytecode   I ve written a detailed article on how to set up Cython for a Python project  check it out   Protecting Python Sources With Cython

User · Answer

It is possible to have the py2exe byte-code in a crypted resource for a C launcher that loads and executes it in memory  Some ideas here and here   Some have also thought of a self modifying program to make reverse engineering expensive   You can also find tutorials for preventing debuggers  make the disassembler fail  set false debugger breakpoints and protect your code with checksums  Search for   crypted code   execute  in memory   for more links   But as others already said  if your code is worth it  reverse engineers will succeed in the end

User · Answer

You should take a look at how the guys at getdropbox com do it for their client software  including Linux  It s quite tricky to crack and requires some quite creative disassembly to get past the protection mechanisms

User · Answer

The reliable only way to protect code is to run it on a server you control and provide your clients with a client which interfaces with that server

User · Answer