Pyraph

The Luraph of Python. Extreme Python obfuscation engine with custom VM virtualization, multi-layer encryption, and native compilation.

Installation

pip install pyraph

Usage

Protect a single .py file (outputs obfuscated .py)

pyraph app.py
pyraph app.py -o protected.py --vm-layers 3
pyraph app.py --one-liner

Protect a folder → native binary (.exe / ELF)

pyraph ./my_project -o ./dist

Options

How It Works

Pyraph applies multiple protection layers that make reverse engineering extremely difficult:

.py Mode (single file)

1. MultiVirtual Engine — Code is fragmented into N micro-chunks. Each chunk is compiled to bytecode, marshalled, then encrypted with its own unique VM opcode table. Fake decoy chunks are mixed in.
2. Multi-round Encryption — Each fragment is encrypted with 3 rounds of SHA256-derived XOR keys, bound to an irremovable watermark.
3. Polymorphic Output — Every protection run generates completely different output: different variable names, different opcode mappings, different keys, different structure. No two outputs are alike.
4. Anti-Debug — Continuous watchdog thread monitoring sys.settrace/sys.getprofile, import hooking blocker, prctl(PR_SET_DUMPABLE, 0) on Linux, SetProcessMitigationPolicy on Windows.
5. Anti-Dump — GC disabled during execution, code object metadata stripped, marshal.loads called via C API (ctypes.pythonapi.PyMarshal_ReadObjectFromString) to bypass Python-level hooks.
6. Junk Code Injection — Realistic-looking fake decrypt functions, hash checks, XOR loops, and dispatch tables that are indistinguishable from real protection logic.

Native Mode (folder → executable)

1. Cython/C Compilation — All .py files compiled to C with encrypted source embedding.
2. Anti-Trace — sys.settrace(None) called at C level immediately after Py_Initialize(), PYTHONPATH nuked to prevent sitecustomize.py injection.
3. Anti-Ptrace — ptrace(PTRACE_TRACEME), prctl(PR_SET_DUMPABLE, 0), TracerPid checking, timing checks.
4. String Obfuscation — All sensitive strings in the binary are assembled from char arrays at runtime, invisible to strings command.
5. C-level Mutation — Junk code injected into compiled C functions.
6. Memory Wipe — Source decrypted in memory → executed → memset(0) → freed.

Output Example

Input (readable Python):

def hello(name):
    return f"Hello, {name}!"
print(hello("World"))

Output (protected):

import hashlib as _pyraph_h
_285000=__import__('base64').b85decode('^N*y~dZDPE0<<XyA^')
_513918=bytes.fromhex('a3f6d6b70ac9')+bytes([136, 232, 51, 154, 25, 41, 18])
_517821=bytes(_285000[_i]^_513918[_i] for _i in range(len(_285000)))
del _285000,_513918
_919520=_pyraph_h.sha256(_517821).digest()
if len(_919520)!=32:__import__('os')._exit(1)
del _pyraph_h,_517821,_919520
import sys as _sys
import os as _os
import threading as _th
...
exec(__import__('zlib').decompress(__import__('base64').b85decode(_a+_b+_c)).decode())

Security Properties

• No source recovery — Code is compiled to bytecode → marshalled → encrypted. Source text never exists at runtime.
• Anti-hook — marshal.loads called via ctypes.pythonapi (C-level), bypasses any Python monkey-patching.
• Anti-trace — Watchdog thread kills process if sys.gettrace() is not None (checks every 30ms).
• Watermark integrity — Obfuscated watermark is cryptographically bound to decryption keys. Removing it breaks all execution.
• Polymorphic — Each run produces unique output with different VM opcodes, variable names, and encryption keys.

Tested Against

• ✅ sys.settrace hook via sitecustomize.py
• ✅ builtins.exec / builtins.compile patching
• ✅ marshal.loads hook
• ✅ gc.get_objects() code object dump
• ✅ PYTHONPATH injection attacks
• ✅ strings command on native binary
• ✅ Memory dump via ReadProcessMemory (Windows) / ptrace (Linux)

Compatibility

• Python 3.9+
• Linux, macOS, Windows
• Native mode requires gcc and Python dev headers

License

Proprietary. Closed source.