python-obfuscation-framework 1.7.5__tar.gz → 1.9.0__tar.gz

{python_obfuscation_framework-1.7.5/python_obfuscation_framework.egg-info → python_obfuscation_framework-1.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-obfuscation-framework
-Version: 1.7.5
+Version: 1.9.0
 Summary: Python Obfuscation Framework
 Author-email: deoktr <35725720+deoktr@users.noreply.github.com>
 Maintainer-email: deoktr <35725720+deoktr@users.noreply.github.com>
@@ -190,6 +190,15 @@ to
 on virus total:
 ![](./examples/images/lazarus.png)
 
+Obfuscating
+[RedTigerStealer](https://bazaar.abuse.ch/sample/9b4c37e3e994ad0222740e4c51dae48cc415957f8ad066da25e977e5031fa374/)
+we go from
+[26/63](https://www.virustotal.com/gui/file/9b4c37e3e994ad0222740e4c51dae48cc415957f8ad066da25e977e5031fa374)
+to
+[1/62](https://www.virustotal.com/gui/file/5616cb69576b11fa4a024023bcf0f66e66b84f426067e597075dfcbba945d5e3)
+on virus total:
+![](./examples/images/red_tiger_stealer.png)
+
 Obfuscating [BTC-Clipper](https://github.com/NightfallGT/BTC-Clipper), we go
 from
 [13/64](https://www.virustotal.com/gui/file/9817d8de9bf7d2740b5b66e30ec1afdd98d7d119074a61cbba05514d4ebdc149)
@@ -217,17 +226,13 @@ on virus total:
 
 ## Install
 
-There are multiple installation options, with PIP, a virtualenv, a container, or with Nix.
-
-There is also the option to run the web server, see [server/README.md](./server/README.md).
-
-And you can try it without installing anything:
+You can install POF with pip install, inside a container or try it online at [pof.run](https://pof.run):
 
 ```bash
 echo 'print("Hello, world!")' | curl -X POST -d @- https://pof.run
 ```
 
-### 1. PIP
+### PIP
 
 From [pypi](https://pypi.org/project/python-obfuscation-framework):
 
@@ -235,31 +240,16 @@ From [pypi](https://pypi.org/project/python-obfuscation-framework):
 pip install python-obfuscation-framework
 ```
 
-### 2. Source
-
-Install from source inside a virtual env:
+### Docker
 
 ```bash
-git clone https://github.com/deoktr/pof
-cd pof
-python -m venv venv
-source ./venv/bin/activate
-pip install .
-```
-
-This will install pof inside a virtual env, so you'll need to activate it every time you want to use it.
-
-### 3. Docker
-
-```bash
-docker pull ghcr.io/deoktr/pof:latest
 docker run --rm ghcr.io/deoktr/pof:latest --help
 ```
 
 Run inside Docker from a local file `in.py`:
 
 ```bash
-docker run --rm -v $(pwd):/tmp ghcr.io/deoktr/pof:latest /tmp/in.py -o /tmp/out.py
+docker run --rm -v $(pwd):/tmp -w /tmp ghcr.io/deoktr/pof:latest in.py -o out.py
 ```
 
 Or pipe input and output:
@@ -268,29 +258,6 @@ Or pipe input and output:
 cat in.py | docker run --rm -i ghcr.io/deoktr/pof:latest > out.py
 ```
 
-### 4. Docker Source
-
-```bash
-git clone https://github.com/deoktr/pof
-cd pof
-docker build -t pof .
-docker run --rm pof --help
-```
-
-Run inside Docker from a local file `in.py`:
-
-```bash
-docker run --rm -v $(pwd):/tmp pof /tmp/in.py -o /tmp/out.py
-```
-
-### 5. Nix
-
-From [github.com/onix-sec/nixsecpkgs](https://github.com/onix-sec/nixsecpkgs):
-
-```bash
-nix shell github:onix-sec/nixsecpkgs#pof
-```
-
 ## Usage
 
 ```bash
@@ -346,51 +313,48 @@ echo "print('Hello, world')" | pof -f obfuscator -k UUIDObfuscator | python
 
 ### Obfuscator
 
-`NamesObfuscator` the most basic obfuscator is renaming variables, classes, functions, and imports.
+`VariablesObfuscator` the most basic obfuscator will rename variables.
 
 Source in `examples/source.py`.
 
 ```python
-import os as pT2Ic6
+import os
 
-def SeIpTxc():
+def get_linux_release_info():
     """Get Linux release info from /etc/os-release."""
-    pDkFbLZO = '/etc/os-release'
-    if not pT2Ic6.path.exists(pDkFbLZO):
+    uggNx = '/etc/os-release'
+    if not os.path.exists(uggNx):
         print('OS release file not found. This might not be a Linux system.')
         return None
-    rDq = {}
+    LY3mN = {}
     try:
-        with open(pDkFbLZO, 'r') as bpBm:
-            for UOFvQ in bpBm:
-                if not UOFvQ or '=' not in UOFvQ:
+        with open(uggNx, 'r') as kj0:
+            for Stv9o in kj0:
+                if not Stv9o or '=' not in Stv9o:
                     continue
-                aSFP, UUka_V_7 = UOFvQ.ObwKdQ6LVz().g54Qp('=', 1)
-                UUka_V_7 = UUka_V_7.ObwKdQ6LVz('"\'\n')
-                rDq[aSFP] = UUka_V_7
+                l0j, QE5kCKYwMe = Stv9o.strip().split('=', 1)
+                QE5kCKYwMe = QE5kCKYwMe.strip('"\'\n')
+                LY3mN[l0j] = QE5kCKYwMe
         print('\nLinux Release Information:')
-        print(f"Distribution: {rDq.IDiXt2('NAME', 'Unknown')}")
-        print(f"Version: {rDq.IDiXt2('VERSION', 'Unknown')}")
-        print(f"Version ID: {rDq.IDiXt2('VERSION_ID', 'Unknown')}")
-        print(f"Pretty Name: {rDq.IDiXt2('PRETTY_NAME', 'Unknown')}")
-        return rDq
-    except Exception as FXfc:
-        print(f'Error reading release file: {FXfc}')
+        print(f"Distribution: {LY3mN.get('NAME', 'Unknown')}")
+        print(f"Version: {LY3mN.get('VERSION', 'Unknown')}")
+        print(f"Version ID: {LY3mN.get('VERSION_ID', 'Unknown')}")
+        print(f"Pretty Name: {LY3mN.get('PRETTY_NAME', 'Unknown')}")
+        return LY3mN
+    except Exception as e:
+        print(f'Error reading release file: {e}')
         return None
 if __name__ == '__main__':
-    if pT2Ic6.name == 'posix' and pT2Ic6.path.exists('/etc/os-release'):
-        Sd65C = SeIpTxc()
+    if os.name == 'posix' and os.path.exists('/etc/os-release'):
+        E_R72 = get_linux_release_info()
     else:
         print('This script is designed for Linux systems.')
 ```
 
-> [!WARNING]
-> Right now this obfuscator can fail under very specific circumstances, see `pof/obfuscator/names.py`.
-
-An alternative is `DefinitionsObfuscator`, that will only obfuscate function declarations.
+`DefinitionsObfuscator` obfuscate function names.
 
-> [!NOTE]
-> There is an alternative implementation at `NamesRopeObfuscator` that uses `rope`, it's a work in progress and currently does not obfuscate variables declared inside functions.
+> [!WARNING]
+> `NamesObfuscator` obfuscator is renaming variables, classes, functions, and imports. Right now this obfuscator can fail under very specific circumstances, see `pof/obfuscator/names.py`. There is an alternative implementation at `NamesRopeObfuscator` that uses `rope`, it's a work in progress and currently does not obfuscate variables declared inside functions.
 
 Other very basic obfuscation functions are done by specific obfuscators like:
 

{python_obfuscation_framework-1.7.5 → python_obfuscation_framework-1.9.0}/README.md

@@ -145,6 +145,15 @@ to
 on virus total:
 ![](./examples/images/lazarus.png)
 
+Obfuscating
+[RedTigerStealer](https://bazaar.abuse.ch/sample/9b4c37e3e994ad0222740e4c51dae48cc415957f8ad066da25e977e5031fa374/)
+we go from
+[26/63](https://www.virustotal.com/gui/file/9b4c37e3e994ad0222740e4c51dae48cc415957f8ad066da25e977e5031fa374)
+to
+[1/62](https://www.virustotal.com/gui/file/5616cb69576b11fa4a024023bcf0f66e66b84f426067e597075dfcbba945d5e3)
+on virus total:
+![](./examples/images/red_tiger_stealer.png)
+
 Obfuscating [BTC-Clipper](https://github.com/NightfallGT/BTC-Clipper), we go
 from
 [13/64](https://www.virustotal.com/gui/file/9817d8de9bf7d2740b5b66e30ec1afdd98d7d119074a61cbba05514d4ebdc149)
@@ -172,17 +181,13 @@ on virus total:
 
 ## Install
 
-There are multiple installation options, with PIP, a virtualenv, a container, or with Nix.
-
-There is also the option to run the web server, see [server/README.md](./server/README.md).
-
-And you can try it without installing anything:
+You can install POF with pip install, inside a container or try it online at [pof.run](https://pof.run):
 
 ```bash
 echo 'print("Hello, world!")' | curl -X POST -d @- https://pof.run
 ```
 
-### 1. PIP
+### PIP
 
 From [pypi](https://pypi.org/project/python-obfuscation-framework):
 
@@ -190,31 +195,16 @@ From [pypi](https://pypi.org/project/python-obfuscation-framework):
 pip install python-obfuscation-framework
 ```
 
-### 2. Source
-
-Install from source inside a virtual env:
+### Docker
 
 ```bash
-git clone https://github.com/deoktr/pof
-cd pof
-python -m venv venv
-source ./venv/bin/activate
-pip install .
-```
-
-This will install pof inside a virtual env, so you'll need to activate it every time you want to use it.
-
-### 3. Docker
-
-```bash
-docker pull ghcr.io/deoktr/pof:latest
 docker run --rm ghcr.io/deoktr/pof:latest --help
 ```
 
 Run inside Docker from a local file `in.py`:
 
 ```bash
-docker run --rm -v $(pwd):/tmp ghcr.io/deoktr/pof:latest /tmp/in.py -o /tmp/out.py
+docker run --rm -v $(pwd):/tmp -w /tmp ghcr.io/deoktr/pof:latest in.py -o out.py
 ```
 
 Or pipe input and output:
@@ -223,29 +213,6 @@ Or pipe input and output:
 cat in.py | docker run --rm -i ghcr.io/deoktr/pof:latest > out.py
 ```
 
-### 4. Docker Source
-
-```bash
-git clone https://github.com/deoktr/pof
-cd pof
-docker build -t pof .
-docker run --rm pof --help
-```
-
-Run inside Docker from a local file `in.py`:
-
-```bash
-docker run --rm -v $(pwd):/tmp pof /tmp/in.py -o /tmp/out.py
-```
-
-### 5. Nix
-
-From [github.com/onix-sec/nixsecpkgs](https://github.com/onix-sec/nixsecpkgs):
-
-```bash
-nix shell github:onix-sec/nixsecpkgs#pof
-```
-
 ## Usage
 
 ```bash
@@ -301,51 +268,48 @@ echo "print('Hello, world')" | pof -f obfuscator -k UUIDObfuscator | python
 
 ### Obfuscator
 
-`NamesObfuscator` the most basic obfuscator is renaming variables, classes, functions, and imports.
+`VariablesObfuscator` the most basic obfuscator will rename variables.
 
 Source in `examples/source.py`.
 
 ```python
-import os as pT2Ic6
+import os
 
-def SeIpTxc():
+def get_linux_release_info():
     """Get Linux release info from /etc/os-release."""
-    pDkFbLZO = '/etc/os-release'
-    if not pT2Ic6.path.exists(pDkFbLZO):
+    uggNx = '/etc/os-release'
+    if not os.path.exists(uggNx):
         print('OS release file not found. This might not be a Linux system.')
         return None
-    rDq = {}
+    LY3mN = {}
     try:
-        with open(pDkFbLZO, 'r') as bpBm:
-            for UOFvQ in bpBm:
-                if not UOFvQ or '=' not in UOFvQ:
+        with open(uggNx, 'r') as kj0:
+            for Stv9o in kj0:
+                if not Stv9o or '=' not in Stv9o:
                     continue
-                aSFP, UUka_V_7 = UOFvQ.ObwKdQ6LVz().g54Qp('=', 1)
-                UUka_V_7 = UUka_V_7.ObwKdQ6LVz('"\'\n')
-                rDq[aSFP] = UUka_V_7
+                l0j, QE5kCKYwMe = Stv9o.strip().split('=', 1)
+                QE5kCKYwMe = QE5kCKYwMe.strip('"\'\n')
+                LY3mN[l0j] = QE5kCKYwMe
         print('\nLinux Release Information:')
-        print(f"Distribution: {rDq.IDiXt2('NAME', 'Unknown')}")
-        print(f"Version: {rDq.IDiXt2('VERSION', 'Unknown')}")
-        print(f"Version ID: {rDq.IDiXt2('VERSION_ID', 'Unknown')}")
-        print(f"Pretty Name: {rDq.IDiXt2('PRETTY_NAME', 'Unknown')}")
-        return rDq
-    except Exception as FXfc:
-        print(f'Error reading release file: {FXfc}')
+        print(f"Distribution: {LY3mN.get('NAME', 'Unknown')}")
+        print(f"Version: {LY3mN.get('VERSION', 'Unknown')}")
+        print(f"Version ID: {LY3mN.get('VERSION_ID', 'Unknown')}")
+        print(f"Pretty Name: {LY3mN.get('PRETTY_NAME', 'Unknown')}")
+        return LY3mN
+    except Exception as e:
+        print(f'Error reading release file: {e}')
         return None
 if __name__ == '__main__':
-    if pT2Ic6.name == 'posix' and pT2Ic6.path.exists('/etc/os-release'):
-        Sd65C = SeIpTxc()
+    if os.name == 'posix' and os.path.exists('/etc/os-release'):
+        E_R72 = get_linux_release_info()
     else:
         print('This script is designed for Linux systems.')
 ```
 
-> [!WARNING]
-> Right now this obfuscator can fail under very specific circumstances, see `pof/obfuscator/names.py`.
-
-An alternative is `DefinitionsObfuscator`, that will only obfuscate function declarations.
+`DefinitionsObfuscator` obfuscate function names.
 
-> [!NOTE]
-> There is an alternative implementation at `NamesRopeObfuscator` that uses `rope`, it's a work in progress and currently does not obfuscate variables declared inside functions.
+> [!WARNING]
+> `NamesObfuscator` obfuscator is renaming variables, classes, functions, and imports. Right now this obfuscator can fail under very specific circumstances, see `pof/obfuscator/names.py`. There is an alternative implementation at `NamesRopeObfuscator` that uses `rope`, it's a work in progress and currently does not obfuscate variables declared inside functions.
 
 Other very basic obfuscation functions are done by specific obfuscators like:
 

{python_obfuscation_framework-1.7.5 → python_obfuscation_framework-1.9.0}/pof/main.py

@@ -41,6 +41,7 @@ from pof.evasion.utils import FILE_SYSTEM
 from pof.logger import logger
 from pof.obfuscator import (
     AddCommentsObfuscator,
+    BooleanObfuscator,
     BuiltinsObfuscator,
     CommentsObfuscator,
     ConstantsObfuscator,
@@ -55,6 +56,7 @@ from pof.obfuscator import (
     NumberObfuscator,
     PrintObfuscator,
     StringsObfuscator,
+    VariablesObfuscator,
     XORObfuscator,
 )
 from pof.stager import ImageStager, RC4Stager
@@ -177,6 +179,8 @@ class Obfuscator(BaseObfuscator):
         # In this context, `baz` would be obfuscated, but it shouldn't because
         # the function is part of the `foo` imported module
         # tokens = NamesObfuscator(generator=generator).obfuscate_tokens(tokens)
+        # TODO: use alternative variable obfuscator using the AST
+        # tokens = VariablesObfuscator().obfuscate_tokens(tokens)
 
         tokens = GlobalsObfuscator().obfuscate_tokens(tokens)
         tokens = BuiltinsObfuscator().obfuscate_tokens(tokens)
@@ -195,9 +199,16 @@ class Obfuscator(BaseObfuscator):
 
         for _ in range(2):
             tokens = NumberObfuscator().obfuscate_tokens(tokens)
+
         tokens = BuiltinsObfuscator().obfuscate_tokens(tokens)
+
         for _ in range(2):
             tokens = string_obfuscator.obfuscate_tokens(tokens)
+
+        # TODO (deoktr): enable once fully tested
+        # for _ in range(2):
+        #     tokens = BooleanObfuscator().obfuscate_tokens(tokens)
+
         tokens = AddCommentsObfuscator().obfuscate_tokens(tokens)
 
         # clean output
@@ -230,7 +241,9 @@ class Obfuscator(BaseObfuscator):
         tokens = self._get_tokens(source)
         tokens = CommentsObfuscator().obfuscate_tokens(tokens)
         generator = BasicGenerator.alphabet_generator()
-        tokens = NamesObfuscator(generator=generator).obfuscate_tokens(tokens)
+        # tokens = NamesObfuscator(generator=generator).obfuscate_tokens(tokens)
+        tokens = VariablesObfuscator(generator=generator).obfuscate_tokens(tokens)
+        tokens = DefinitionsObfuscator(generator=generator).obfuscate_tokens(tokens)
         tokens = IndentsObfuscator().obfuscate_tokens(tokens)
         tokens = NewlineObfuscator().obfuscate_tokens(tokens)
         return self._untokenize(tokens)
@@ -305,7 +318,9 @@ class Obfuscator(BaseObfuscator):
         #     # FIXME (deoktr): breaks if obf_builtins_rate=1 with NamesObfuscator
         #     obf_builtins_rate=0,
         # ).obfuscate_tokens(tokens)
-        tokens = NamesObfuscator(generator=generator).obfuscate_tokens(tokens)
+        # tokens = NamesObfuscator(generator=generator).obfuscate_tokens(tokens)
+        tokens = VariablesObfuscator(generator=generator).obfuscate_tokens(tokens)
+        tokens = DefinitionsObfuscator(generator=generator).obfuscate_tokens(tokens)
         tokens = ConstantsObfuscator(
             generator=generator,
             obf_number_rate=1,
@@ -370,9 +385,10 @@ class Obfuscator(BaseObfuscator):
 
         tokens = CommentsObfuscator().obfuscate_tokens(tokens)
         # tokens = DeepEncryptionEvasion().add_evasion(tokens)  # TODO (deoktr): fix
-        tokens = NamesObfuscator(
-            generator=AdvancedGenerator.fixed_length_generator(),
-        ).obfuscate_tokens(tokens)
+        # tokens = NamesObfuscator(
+        #     generator=AdvancedGenerator.fixed_length_generator(),
+        # ).obfuscate_tokens(tokens)
+        tokens = BooleanObfuscator().obfuscate_tokens(tokens)
         tokens = IndentsObfuscator().obfuscate_tokens(tokens)
         tokens = NewlineObfuscator().obfuscate_tokens(tokens)
 

{python_obfuscation_framework-1.7.5 → python_obfuscation_framework-1.9.0}/pof/obfuscator/__init__.py

@@ -14,6 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
+from .boolean import BooleanObfuscator
 from .builtins import BuiltinsObfuscator
 from .cipher.deep_encryption import DeepEncryptionObfuscator
 from .cipher.rc4 import RC4Obfuscator
@@ -56,6 +57,7 @@ from .stegano.ipv6encoding import IPv6Obfuscator
 from .stegano.macencoding import MACObfuscator
 from .stegano.uuidencoding import UUIDObfuscator
 from .strings import StringsObfuscator
+from .variables import VariablesObfuscator
 
 __all__ = [
     "ASCII85Obfuscator",
@@ -67,6 +69,7 @@ __all__ = [
     "Base64Obfuscator",
     "Base85Obfuscator",
     "BinasciiObfuscator",
+    "BooleanObfuscator",
     "BuiltinsObfuscator",
     "Bz2Obfuscator",
     "CallObfuscator",
@@ -98,6 +101,7 @@ __all__ = [
     "StringsObfuscator",
     "TokensObfuscator",
     "UUIDObfuscator",
+    "VariablesObfuscator",
     "WhitespaceObfuscator",
     "XORObfuscator",
     "ZlibObfuscator",

python_obfuscation_framework-1.9.0/pof/obfuscator/boolean.py

@@ -0,0 +1,144 @@
+# POF, a free and open source Python obfuscation framework.
+# Copyright (C) 2022 - 2026  Deoktr
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+import random
+from tokenize import LPAR, LSQB, NAME, NUMBER, RPAR, RSQB, STRING
+
+
+class BooleanObfuscator:
+    """Obfuscate booleans with multiple methods."""
+
+    @staticmethod
+    def obf_true():
+        match random.randint(1, 6):
+            case 1:
+                # all([])
+                return [
+                    (NAME, "all"),
+                    (LPAR, "("),
+                    (LSQB, "["),
+                    (RSQB, "]"),
+                    (RPAR, ")"),
+                ]
+            case 2:
+                # any([True])
+                return [
+                    (NAME, "any"),
+                    (LPAR, "("),
+                    (LSQB, "["),
+                    (NAME, "True"),
+                    (RSQB, "]"),
+                    (RPAR, ")"),
+                ]
+            case 3:
+                # not False
+                return [
+                    (NAME, "not"),
+                    (NAME, "False"),
+                ]
+            case 4:
+                # not not True
+                return [
+                    (NAME, "not"),
+                    (NAME, "not"),
+                    (NAME, "True"),
+                ]
+            case 5:
+                # "" in ""
+                return [
+                    (STRING, "''"),
+                    (NAME, "in"),
+                    (STRING, "''"),
+                ]
+            case 6:
+                # bool(1)
+                return [
+                    (NAME, "bool"),
+                    (LPAR, "("),
+                    (NUMBER, "1"),
+                    (RPAR, ")"),
+                ]
+
+    @staticmethod
+    def obf_false():
+        match random.randint(1, 6):
+            case 1:
+                # False = all([[]])
+                return [
+                    (NAME, "all"),
+                    (LPAR, "("),
+                    (LSQB, "["),
+                    (LSQB, "["),
+                    (RSQB, "]"),
+                    (RSQB, "]"),
+                    (RPAR, ")"),
+                ]
+            case 2:
+                # all([False])
+                return [
+                    (NAME, "all"),
+                    (LPAR, "("),
+                    (LSQB, "["),
+                    (NAME, "False"),
+                    (RSQB, "]"),
+                    (RPAR, ")"),
+                ]
+            case 3:
+                # not True
+                return [
+                    (NAME, "not"),
+                    (NAME, "True"),
+                ]
+            case 4:
+                # not not False
+                return [
+                    (NAME, "not"),
+                    (NAME, "not"),
+                    (NAME, "False"),
+                ]
+            case 5:
+                # "" not in ""
+                return [
+                    (STRING, "''"),
+                    (NAME, "not"),
+                    (NAME, "in"),
+                    (STRING, "''"),
+                ]
+            case 6:
+                # bool(0)
+                return [
+                    (NAME, "bool"),
+                    (LPAR, "("),
+                    (NUMBER, "0"),
+                    (RPAR, ")"),
+                ]
+
+    def obfuscate_boolean(self, tokval):
+        if tokval == "True":
+            return self.obf_true()
+        return self.obf_false()
+
+    def obfuscate_tokens(self, tokens):
+        result = []
+        for toknum, tokval, *_ in tokens:
+            new_tokens = [(toknum, tokval)]
+
+            if toknum == NAME and tokval in ["True", "False"]:
+                new_tokens = self.obfuscate_boolean(tokval)
+
+            if new_tokens:
+                result.extend(new_tokens)
+        return result