Shulou(Shulou.com)06/01 Report--

About the encryption of python

At present, there may be two forms for software developers to encrypt Python. One is to convert python into exe.

Protection, the other is to directly protect .py or .pyc files, two forms of protection processes are listed below.

1. Shell python to exe

Download the latest version of the shell tool, and use the shell tool to shell the demo.exe directly.

2. Encrypt .py / .pyc

The first step is to use the shell tool to shell the python.exe under the python installation directory, drag the python.exe into the shell tool VirboxProtector, and click the shell directly after configuration.

The second step is to encrypt .py / .pyc and protect .py / .pyc using DSProtector.

Security technology:

Virtual machine shell: the shell protection tool of Elite 5 innovatively introduces a pre-analysis and automatic optimization engine to effectively solve the problem of security and performance balance when virtualizing code protection.

L fragmentation code execution: using the code extraction technology in its mature shell, a large amount of code is extracted and executed in a secure environment after encryption confusion, so as to minimize the dependence on the underlying technology and functions of the encryption lock. at the same time, a large number of large-scale transplantation ensures higher security.

L Virbox encryption compilation engine: it integrates security functions such as compilation and obfuscation. Due to the intervention in the compilation phase, the optimizable space is incomparable with general virtualization technology, and the degree of confusion of code and variables has been fundamentally improved.

L anti-black engine: built-in R0 core-state anti-black engine, (anti-black database) countermeasure based on * * behavior characteristics. Precise attack on debugging, injection, memory modification and other behaviors, from passive to active protection.

Encryption effect: unprotected #

The generated dis file can be viewed as the source code using notepad++

Solution #

As can be seen from the above figure, unencrypted .pyc files can easily decompile the source code through the Easy Python Decompiler v1.3.2 tool. The way to protect .pyc is to protect it through the DS Protector tool to prevent the source code from being decompiled.

DS Protector is a program data protection tool independently developed by Beijing Digital Shield, which makes up for the function of shell VirboxProtector. VirboxProtector protects the compiled binary code lines of the program, and cooperates with DS Protector data protection tools to form a trinity protection of code and data.

The program protection mode for python development is mainly to encrypt pyc files, which can protect the main code logic from decompilation, so as to protect the legitimate rights and interests of software developers to the maximum extent.

First encrypt the python.exe of the parsed file through Virbox Protector, open the DS Protector plug-in function when encrypting, then encrypt the pyc file through DS Protector, and use the configuration generated by the shell to associate the encrypted python.exe pyc file with the authorization.

After deliberate protection #

Failed to decompile the pyc file using the Easy Python Decompiler v1.3.2 tool after encryption.

Protect executable exe # without thoughtful protection #

The python script can be packaged into an executable file through the packaging tool py2exe and cross-platform PyInstaller tools. The packaged executable file does not rely on python and can be run directly on a machine without python. Note: different packaging methods have different principles, and the location of the source code is also different, so the specific modules that need to be protected are also different.

After packaging with Py2exe, simply use unpy2exe-master, put the exe file in the directory of the program to be decompiled, execute the python unpy2XXX.exe component, and decompile it into a pyc pyc file

After packaging with PyInstaller, put pyinstxtractor.py into the directory of the program to be decompiled, execute pyinstxtractorXXX.exe, and generate a folder in which you can find the same pyc file with the same name as the program. Then use Easy Python Decompiler v1.3.2 tool to decompile the pyc file, successfully generate a file with the suffix dis in the same directory, the generated dis file can use notepad++ to view the source code.

Solution #

The executable files packaged by python scripts can directly use Virbox Protector to shell exe programs. Many security technologies such as virtual machines and fragmentation code execution confusion are built into the shell software, which can effectively prevent exe programs from being decompiled and cannot dump memory.

Note: the principles of different packaging methods are different, and the location of the source code is also different, so the specific speed that needs to be protected is also different.

After deliberate protection: #

An attempt to decompress XXX.exe after encryption fails, and decompilation can no longer be performed, and it is impossible to analyze it with regular tools.

An attempt to decompress the log322.exe after encryption fails, and decompilation cannot be performed, nor can it be analyzed using conventional decompilation tools.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.