5

I am developing a paid application in python. I do not want the users to see the source code or decompile it. How can I accomplish this task to hiding the source code from the user but running the code perfectly with the same performance.

24

To a determined user, you can't.

From a practical standpoint, you can do some tricks, such as wrapping it into a binary executable or using obfuscation.

See here for full details: https://stackoverflow.com/questions/261638/how-do-i-protect-python-code

5

There's no use in doing that.

If your application is not incredibly small and simple, then even if the client (or other programmers they hired) were to work on that code, they'd still need a lot of your help with it.

If it is incredibly small and simple, don't even bother with it. The client could just get someone to rewrite it from scratch anyway.

-1

I was in a similar situation to this not too long ago. But i managed to find a way to hide my source code, at least, enough to deter most from trying to hack it.

Contrary to common belief, obfuscation and/or encryption of interpreted language scripts is possible. The question is, do you have the time (and motivation) to devote to it? You'll need to make sure whichever "obfuscation/encryption" method you use is very difficult to crack, and that it does not slow down the execution time of the script in any noticeable way.

If you wish to encrypt a python script, without having to do any work on your end, you can do so using this site.

I tested the following script using the aforementioned site and it produced a very intimidating output, which worked (at least for my purposes):

#!/usr/bin/env python2
# vim: ft=python

import sys, json, urllib2

URL = 'http://127.0.0.1:8080/optimization/resources/_harness/status?_fields=health.summary'

try:
    response = urllib2.urlopen(URL).read()
except:
    print('HEALTHCHECKS CRITICAL - Error fetching health check at %s' % URL)
    sys.exit(2)

parsed = json.loads(response)
resource = parsed["resource"] if "resource" in parsed else parsed
status = resource["health"]["summary"]["status"]
incidents = resource["health"]["summary"].get("incidents", [])
warning = len([incident for incident in incidents if incident["status"] == "WARNING"])
critical = len([incident for incident in incidents if incident["status"] == "CRITICAL"])

if warning or critical:
    print('HEALTHCHECKS %s - %d WARNING - %d CRITICAL' % (status, warning, critical))
else:
    print('HEALTHCHECKS OK - no incidents')

print(json.dumps(resource, indent=2))

sys.exit({"OK":0, "WARNING":1, "CRITICAL":2}.get(status, 3))

Can the obfuscated code produced be broken into? Maybe, maybe not. But it is sure to deter most people from even attempting it.

If you do have some time on your hands and wish to encrypt your script on your own using your own improvised method, you'll want to use the openssl command. Why? Because it appears to be the one encryption tool that is available across most Unix systems. I've verified it exists on Linux (ubuntu, centos, redhat, mac), and AIX. SunOS i believe uses the "crypt" command instead.

The simplest way to use Openssl to encrypt a script is:

1. cat <thescript> | openssl aes-128-cbc -a -salt -k "specify-a-password" > thescript.enc

OR

2. openssl aes-128-cbc -a -salt -in <path-to-your-script> -k "yourpassword"

To decrypt a script using Openssl (notice the '-d'):

1. cat thescript.enc | openssl aes-128-cbc -a -d -salt -k "specify-a-password" > thescript.dec

OR

2. openssl aes-128-cbc -a -d -salt -in <path-to-your-script> -k "yourpassword" > thescript.dec

The trick here would be to automate the supply of password so your users need not specify a password each time they wanted to run the script.

  • 3
    Your solution to prevent your script from being accessed is giving it away to a third-party website you don't trust? Or decrypting it on the fly with a command the user can see and easily run himself to get the original source code? That doesn't seem like a very good solution. – Vincent Savard Oct 14 '16 at 14:31
  • 1
    Does this "premium" website cost money? If so, perhaps your answer should mention that more clearly ;) – Tersosauros Oct 14 '16 at 14:47
  • AES? I suggest using ROT26 for enhanced security. – Mael Oct 14 '16 at 17:02

protected by gnat Oct 14 '16 at 13:49

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.