Python Obfuscator (pretty heavy)

A multi-layered, AST-based Python source code obfuscator designed to heavily deter reverse engineering, static analysis, and code theft. This tool chains together 9 different obfuscation techniques, ranging from identifier renaming to control flow flattening and payload encryption to turn readable Python scripts into heavily obfuscated, self decrypting payloads.

---

features

• AST-Based: Operates on the Abstract Syntax Tree, ensuring syntactically valid output.
• Naming: Renames all possible variables/functions to combinations of I, l, 1, O, 0, and o to ruin readability.
• String Encryption: XOR-encrypts all strings and injects a runtime decryptor.
• Integer Obfuscation: Replaces numbers with complex arithmetic expressions (e.g., (n ^ mask) ^ mask).
• Payload Encoding: Compiles, marshals, compresses (zlib), XOR-encrypts, and Base85-encodes the final payload.
• Self-Healing Loader: Injects a tiny loader script that decrypts and executes the payload in memory.
• Anti-Debugging: Exits immediately if a tracer/debugger is detected (sys.gettrace()).
• Integrity Check: Verifies a SHA-256 hash of the encrypted payload before execution to prevent tampering.

---

usage

Method 1: Windows Batch Script (easier)

If you are on Windows, you can use the provided obfuscate.bat file for a non CLI experience.

1. Ensure obfuscator.py and obfuscate.bat are in the same folder.
2. Drag and Drop: Simply drag your target .py file and drop it directly onto obfuscate.bat.
3. Manual Input: Double-click obfuscate.bat and type/paste the path to your .py file.
4. The obfuscated file will be saved as yourfile_obfuscated.py in the same directory as the original.

Method 2: Command Line Interface (CLI)

For cross-platform usage (Mac/Linux/Windows) or scripting, run the Python script directly.

Basic usage:

python obfuscator.py input.py output.py

Disable Control-Flow Flattening: If you encounter edge cases with top-level flattening, you can disable it using the --no-flatten flag.

python heavy_obfuscator.py input.py output.py --no-flatten

---

How It Works (Obfuscation Layers)

1. Dead-code Injection: 3-6 junk functions with random arithmetic are injected into the module.
2. Identifier Renaming: All non-reserved variables and functions are renamed to confusable Il1O0o_ tokens.
3. Integer Obfuscation (Pass 1): Integers are replaced with (a + (n - a)) or (n ^ mask) ^ mask expressions.
4. String Encryption: Strings are XOR-encrypted. A runtime decryptor function is injected into the AST.
5. Integer Obfuscation (Pass 2): Runs again to mangle the integer byte-array of the injected string encryption key.
6. Control-Flow Flattening: Top-level statements are wrapped in a while True: state-machine dispatcher with scrambled state IDs.
7. Payload Encoding: The AST is unparsed, compiled to bytecode, marshaled, zlib compressed, XOR-encrypted, and base85 encoded.
8. Integrity & Anti-Trace: A SHA-256 hash of the encrypted payload and a sys.gettrace() check are embedded.
9. Loader Wrapper: The encoded payload is embedded in a small Python script that reverses the encryption in memory and execs it.

---

Disclaimer

This tool is intended for educational purposes, malware analysis, and protecting intellectual property. Do not use this tool to obfuscate malicious code intended for deployment on systems you do not own or have explicit permission to test. The authors are not responsible for any misuse of this software.