I spent a year+ cracking paid Python scripts, so I built an obfuscator that actually works
so about a year and a half ago i got bored and started learning python RE. like actually learning it, going through decompilers, understanding bytecode, the whole thing.
but here's the thing that really sent me down the rabbit hole: my friend kept sending me paid python scripts he'd bought. cheap/expensive ones. scripts people were actually paying for.
and i just... cracked them. all of them.
like genuinely every single paid script he sent me, i could break through the obfuscation/security it had in minutes.
and that's when i realized: the obfuscators protecting these aren't actually protecting anything.
the reality:
i'm talking scripts that cost $5-50+ monthly. scripts with/without obfuscation built in. scripts that were supposed to be "secure" or "uncrackable" or whatever.
none of them were.
because the obfuscation they used was just... bad. like really bad.
they were just renaming variables and encoding strings
decompilers don't care about variable names
string encoding is trivial to reverse
most of them you could just pylingual and read the logic in minutes
so i'm sitting there looking at all these paid scripts that i was able to completely reverse engineer, and i'm thinking: "how is this even possible?"
like people are paying money monthly for these scripts and anyone can break them in 5 minutes?
that's when i asked the real questions:
if the obfuscation is this weak on paid scripts, what's the obfuscator doing?
how bad must the obfuscation market be if people are selling protected scripts with this level of protection?
and most importantly: what would real protection actually look like?
so i spent a year researching python security and obfuscation.
because if i can break paid scripts that are supposed to be protected, then the obfuscators everyone's using are fundamentally broken.
what i learned:
most obfuscators are made by people who understand code but don't understand attacks.
they use static obfuscation so signature detection works. once you break one copy, every copy is broken.
they don't use polymorphism. they don't encrypt the bytecode. they don't think about actual defense in depth.
the market is broken.
so i built nyami:
because if i can break paid scripts protected with current obfuscators, then developers need real protection. full feature list @ https://nyami.cc/features
the 4 core features:
Python To C (PYTOC)
literally converts your python to C, then compiles it to machine code
your python source code basically doesn't exist anymore
still deploys as one .py file like normal
best one imo
Bytecode Encryption
encrypts the actual compiled bytecode
and the keys are polymorphic so every build is different
decompilers literally cannot read encrypted bytecode
Decompiler Breaker
i spent time understanding how pycdc, pylingual, uncompyle6 actually work
the tools that broke every paid script i tested
then built stuff specifically to break them
and it's different every build so signatures don't work
Polymorphic Obfuscator
every build is unique
v1.0 and v1.1 look different even though they do the same thing
this is why paid scripts fail, they use the same obfuscation pattern which if broken once, its over
real talk:
obfuscation isn't magic. if someone dedicates serious time they can probably still reverse your code. but that's not the point.
right now if you sell a python script protected with basic obfuscation, i can probably crack it in minutes. with nyami it would take weeks of serious work, which at that point most give up on even trying, because lets be real most of the times is not that important.
that's the difference that matters.
pricing:
€1 per token if you want to just test it out. €20/month if you're actually protecting production code or selling scripts.
i didn't want to gatekeep this. if i could break paid scripts, small devs should have access to something that actually works.
link: nyami.cc you can also find nyami on discord @ https://discord.nyami.cc and if you want to read documentation is @ https://documentation.nyami.cc if you want to try deobfuscating one of our files we offer test files on discord after almost every update, we also have the same file posted open-source on there
honestly just tired of seeing people trust broken tools so i built something better.
happy to answer questions if anyone's curious about the technical stuff or python security in general. or if you want to tell me why i'm wrong lol