python-obfuscation-framework 1.7.4__tar.gz → 1.8.0__tar.gz

{python_obfuscation_framework-1.7.4 → python_obfuscation_framework-1.8.0}/LICENSE

@@ -632,7 +632,7 @@ state the exclusion of warranty; and each file should have at least
 the "copyright" line and a pointer to where the full notice is found.
 
     POF, a free and open source Python obfuscation framework.
-    Copyright (C) 2022 - 2025  POF Team
+    Copyright (C) 2022 - 2026  Deoktr
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -652,7 +652,7 @@ Also add information on how to contact you by electronic and paper mail.
   If the program does terminal interaction, make it output a short
 notice like this when it starts in an interactive mode:
 
-    POF  Copyright (C) 2022 - 2025  POF Team
+    POF  Copyright (C) 2022 - 2026  Deoktr
     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
     This is free software, and you are welcome to redistribute it
     under certain conditions; type `show c' for details.

{python_obfuscation_framework-1.7.4/python_obfuscation_framework.egg-info → python_obfuscation_framework-1.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-obfuscation-framework
-Version: 1.7.4
+Version: 1.8.0
 Summary: Python Obfuscation Framework
 Author-email: deoktr <35725720+deoktr@users.noreply.github.com>
 Maintainer-email: deoktr <35725720+deoktr@users.noreply.github.com>
@@ -47,15 +47,17 @@ Dynamic: license-file
 
 [![python-obfuscation-framework-pypi](https://img.shields.io/pypi/v/python-obfuscation-framework.svg)](https://pypi.org/project/python-obfuscation-framework)
 
+Test it at [pof.run](https://pof.run).
+
 Python Obfuscation Framework, a complete Python offensive security toolkit to generate staged obfuscated payloads.
 
 pof will allow you to:
 
-- **Create staged payloads**, store stages inside images, on trusted sites, encrypt, compress, or encode them, and much more.
-- **Slow down static analysis** of the payload or the stage.
+- **Slow down static analysis** with layered obfuscation and novel techniques.
 - **Evade sandbox** by checking host information like MAC addresses, CPU count, memory count, uptime, and much more.
 - **Add guardrails** to ensure the payload only execute on the desired target host by verifying for username, hostname, domainame and much more.
 - **Prevent dynamic analysis** by detecting debugging or tracing via malloc.
+- **Create staged payloads**, store stages inside images, on trusted sites, encrypt, compress, or encode them, and much more.
 - **Enable automation** to produce numerous variant of the same payload.
 
 The main benefit of POF is customizability, you can generate your payload however you want, choose the obfuscation you want and combine them.
@@ -188,6 +190,15 @@ to
 on virus total:
 ![](./examples/images/lazarus.png)
 
+Obfuscating
+[RedTigerStealer](https://bazaar.abuse.ch/sample/9b4c37e3e994ad0222740e4c51dae48cc415957f8ad066da25e977e5031fa374/)
+we go from
+[26/63](https://www.virustotal.com/gui/file/9b4c37e3e994ad0222740e4c51dae48cc415957f8ad066da25e977e5031fa374)
+to
+[1/62](https://www.virustotal.com/gui/file/5616cb69576b11fa4a024023bcf0f66e66b84f426067e597075dfcbba945d5e3)
+on virus total:
+![](./examples/images/red_tiger_stealer.png)
+
 Obfuscating [BTC-Clipper](https://github.com/NightfallGT/BTC-Clipper), we go
 from
 [13/64](https://www.virustotal.com/gui/file/9817d8de9bf7d2740b5b66e30ec1afdd98d7d119074a61cbba05514d4ebdc149)
@@ -215,43 +226,30 @@ on virus total:
 
 ## Install
 
-There are multiple installation options, with PIP, a virtualenv, a container, or with Nix.
-
-There is also the option to run the web server, see [server/README.md](./server/README.md).
-
-### 1. PIP
-
-From [pypi](https://pypi.org/project/python-obfuscation-framework):
+You can install POF with pip install, inside a container or try it online at [pof.run](https://pof.run):
 
 ```bash
-pip install python-obfuscation-framework
+echo 'print("Hello, world!")' | curl -X POST -d @- https://pof.run
 ```
 
-### 2. Source
+### PIP
 
-Install from source inside a virtual env:
+From [pypi](https://pypi.org/project/python-obfuscation-framework):
 
 ```bash
-git clone https://github.com/deoktr/pof
-cd pof
-python -m venv venv
-source ./venv/bin/activate
-pip install .
+pip install python-obfuscation-framework
 ```
 
-This will install pof inside a virtual env, so you'll need to activate it every time you want to use it.
-
-### 3. Docker
+### Docker
 
 ```bash
-docker pull ghcr.io/deoktr/pof:latest
 docker run --rm ghcr.io/deoktr/pof:latest --help
 ```
 
 Run inside Docker from a local file `in.py`:
 
 ```bash
-docker run --rm -v $(pwd):/tmp ghcr.io/deoktr/pof:latest /tmp/in.py -o /tmp/out.py
+docker run --rm -v $(pwd):/tmp -w /tmp ghcr.io/deoktr/pof:latest in.py -o out.py
 ```
 
 Or pipe input and output:
@@ -260,29 +258,6 @@ Or pipe input and output:
 cat in.py | docker run --rm -i ghcr.io/deoktr/pof:latest > out.py
 ```
 
-### 4. Docker Source
-
-```bash
-git clone https://github.com/deoktr/pof
-cd pof
-docker build -t pof .
-docker run --rm pof --help
-```
-
-Run inside Docker from a local file `in.py`:
-
-```bash
-docker run --rm -v $(pwd):/tmp pof /tmp/in.py -o /tmp/out.py
-```
-
-### 5. Nix
-
-From [github.com/onix-sec/nixsecpkgs](https://github.com/onix-sec/nixsecpkgs):
-
-```bash
-nix shell github:onix-sec/nixsecpkgs#pof
-```
-
 ## Usage
 
 ```bash
@@ -343,24 +318,37 @@ echo "print('Hello, world')" | pof -f obfuscator -k UUIDObfuscator | python
 Source in `examples/source.py`.
 
 ```python
-import random as dZoHe5KQ5T
-import string as BOu1uhdV
-
-def hrEnWnn_d():
-    """This is a docstring."""
-    return dZoHe5KQ5T.choice(BOu1uhdV.ascii_lowercase)
-
-def a_D(wYKTr7D5Ex):
-    JfQdd = hrEnWnn_d()
-    for kEw73z in range(wYKTr7D5Ex - 1):
-        JfQdd += hrEnWnn_d()
-    return JfQdd
-
-def VLBQn3():
-    mxO = a_D(8)
-    tBceS = 'My pet is name: ' + mxO
-    print(tBceS)
-VLBQn3()
+import os as pT2Ic6
+
+def SeIpTxc():
+    """Get Linux release info from /etc/os-release."""
+    pDkFbLZO = '/etc/os-release'
+    if not pT2Ic6.path.exists(pDkFbLZO):
+        print('OS release file not found. This might not be a Linux system.')
+        return None
+    rDq = {}
+    try:
+        with open(pDkFbLZO, 'r') as bpBm:
+            for UOFvQ in bpBm:
+                if not UOFvQ or '=' not in UOFvQ:
+                    continue
+                aSFP, UUka_V_7 = UOFvQ.ObwKdQ6LVz().g54Qp('=', 1)
+                UUka_V_7 = UUka_V_7.ObwKdQ6LVz('"\'\n')
+                rDq[aSFP] = UUka_V_7
+        print('\nLinux Release Information:')
+        print(f"Distribution: {rDq.IDiXt2('NAME', 'Unknown')}")
+        print(f"Version: {rDq.IDiXt2('VERSION', 'Unknown')}")
+        print(f"Version ID: {rDq.IDiXt2('VERSION_ID', 'Unknown')}")
+        print(f"Pretty Name: {rDq.IDiXt2('PRETTY_NAME', 'Unknown')}")
+        return rDq
+    except Exception as FXfc:
+        print(f'Error reading release file: {FXfc}')
+        return None
+if __name__ == '__main__':
+    if pT2Ic6.name == 'posix' and pT2Ic6.path.exists('/etc/os-release'):
+        Sd65C = SeIpTxc()
+    else:
+        print('This script is designed for Linux systems.')
 ```
 
 > [!WARNING]
@@ -436,32 +424,58 @@ print((True+True+True+True+True+True+True+True+True+True+True+True+True+True+Tru
 Move every variable at the top of the file with random names.
 
 ```python
-gfdd_j=print
-uVu8Mq=8
-GqTsw9ZK="My pet is name: "
-u4F5X=range
-rSO2F=1
-# source file that will be obfuscated
-import random
-import string
-
-def get_random_letter():
-    """This is a docstring."""
-    return random.choice(string.ascii_lowercase)
-
-def get_random_name(name_len):
-# this is a comment
-    name=get_random_letter()
-    for _ in u4F5X(name_len-rSO2F):
-        name+=get_random_letter()
-    return name
-
-def present_my_pet():
-    pet_name=get_random_name(uVu8Mq)
-    message=GqTsw9ZK+pet_name
-    gfdd_j(message)
-
-present_my_pet()
+N842V="\"'\n"
+gvBXIX='NAME'
+Lzxdy='VERSION'
+NklI="__main__"
+IoTpEBJ='VERSION_ID'
+eQqDDpOL=1
+IpEPxvQ="This script is designed for Linux systems."
+ka6U_Q='PRETTY_NAME'
+hCf5UQQT="="
+GMUC6z="/etc/os-release"
+eOa=Exception
+CCCs=None
+EUr2fN=open
+wGDb="r"
+hm8="OS release file not found. This might not be a Linux system."
+QElu="posix"
+fNdZY9=__name__
+LvMs="\nLinux Release Information:"
+uFCf7Vy='Unknown'
+joyHA=print
+import os
+
+def get_linux_release_info():
+    """Get Linux release info from /etc/os-release."""
+    release_file=GMUC6z
+    if not os.path.exists(release_file):
+        joyHA(hm8)
+        return CCCs
+    release_info={}
+    try:
+        with EUr2fN(release_file,wGDb)as f:
+            for line in f:
+                if not line or hCf5UQQT not in line:
+                    continue
+                key,value=line.strip().split(hCf5UQQT,eQqDDpOL)
+                value=value.strip(N842V)
+                release_info[key]=value
+        joyHA(LvMs)
+        joyHA(f"Distribution: {release_info.get(gvBXIX,uFCf7Vy)}")
+        joyHA(f"Version: {release_info.get(Lzxdy,uFCf7Vy)}")
+        joyHA(f"Version ID: {release_info.get(IoTpEBJ,uFCf7Vy)}")
+        joyHA(f"Pretty Name: {release_info.get(ka6U_Q,uFCf7Vy)}")
+        return release_info
+    except eOa as e:
+        joyHA(f"Error reading release file: {e}")
+        return CCCs
+
+if fNdZY9==NklI:
+    if os.name==QElu and os.path.exists(GMUC6z):
+        release_details=get_linux_release_info()
+    else:
+        joyHA(IpEPxvQ)
 ```
 
 #### BuiltinsObfuscator
@@ -503,26 +517,37 @@ Replaces call of global functions with `globals()['func_name']()`.
 Source in `examples/source.py`.
 
 ```python
-import random
-import string
-
-def get_random_letter():
-    """This is a docstring."""
-    return random.choice(string.ascii_lowercase)
-
-def get_random_name(name_len):
-# this is a comment
-    name=globals()['get_random_letter']()
-    for _ in range(name_len-1):
-        name+=globals()['get_random_letter']()
-    return name
-
-def present_my_pet():
-    pet_name=globals()['get_random_name'](8)
-    message="My pet is name: "+pet_name
-    print(message)
-
-globals()['present_my_pet']()
+import os
+
+def get_linux_release_info():
+    release_file="/etc/os-release"
+    if not os.path.exists(release_file):
+        print("OS release file not found. This might not be a Linux system.")
+        return None
+    release_info={}
+    try:
+        with open(release_file,"r")as f:
+            for line in f:
+                if not line or"="not in line:
+                    continue
+                key,value=line.strip().split("=",1)
+                value=value.strip("\"'\n")
+                release_info[key]=value
+        print("\nLinux Release Information:")
+        print(f"Distribution: {release_info.get('NAME','Unknown')}")
+        print(f"Version: {release_info.get('VERSION','Unknown')}")
+        print(f"Version ID: {release_info.get('VERSION_ID','Unknown')}")
+        print(f"Pretty Name: {release_info.get('PRETTY_NAME','Unknown')}")
+        return release_info
+    except Exception as e:
+        print(f"Error reading release file: {e}")
+        return None
+
+if __name__=="__main__":
+    if os.name=="posix"and os.path.exists("/etc/os-release"):
+        release_details=globals()['get_linux_release_info']()
+    else:
+        print("This script is designed for Linux systems.")
 ```
 
 #### ShiftObfuscator
@@ -556,6 +581,19 @@ def sntdecode(encoded):
 exec(sntdecode('\t\t\t     \t\t\t  \t  \t\t \t  \t \t\t \t\t\t  \t\t\t \t    \t \t     \t  \t\t\t \t  \t    \t\t  \t \t \t\t \t\t   \t\t \t\t   \t\t \t\t\t\t  \t \t\t    \t      \t\t\t \t\t\t \t\t \t\t\t\t \t\t\t  \t  \t\t \t\t   \t\t  \t    \t  \t\t\t  \t \t  \t    \t \t '))
 ```
 
+#### WhitespaceObfuscator
+
+Use whitespace and zero width whitespace `\u200B`.
+
+```python
+def wsdecode(encoded):
+    msg_bin=encoded.replace(" ","0").replace('\u200b',"1")
+    n=int(msg_bin,2)
+    return n.to_bytes((n.bit_length()+7)//8,"big")
+
+exec(wsdecode("​​​     ​​​  ​  ​​ ​  ​ ​​ ​​​  ​​​ ​    ​ ​     ​  ​​​ ​  ​    ​​  ​ ​ ​​ ​​   ​​ ​​   ​​ ​​​​  ​ ​​    ​      ​​​ ​​​ ​​ ​​​​ ​​​  ​  ​​ ​​   ​​  ​    ​  ​​​  ​ ​  ​    ​ ​ "))
+```
+
 #### RC4Obfuscator
 
 Warning: the RC4 obfuscator (and other cipher obfuscators) will combine both, the cipher text and the key in the same file, this is obviously not secure, and should never be used for security purposes. The idea behind this obfuscator is to fool humans, AV, EDR, network TAP etc. not to be secured and safe.