python-obfuscation-framework 1.9.1__py3-none-any.whl → 1.9.3__py3-none-any.whl

pof/obfuscator/__init__.py

@@ -25,6 +25,7 @@ from .compression.gzip import GzipObfuscator
 from .compression.lzma import LzmaObfuscator
 from .compression.zlib import ZlibObfuscator
 from .constants import ConstantsObfuscator
+from .controlflow.control_flow_flatten import ControlFlowFlattenObfuscator
 from .definitions import DefinitionsObfuscator
 from .encoding.a85 import ASCII85Obfuscator
 from .encoding.b16 import Base16Obfuscator
@@ -76,6 +77,7 @@ __all__ = [
     "CharFromDocObfuscator",
     "CommentsObfuscator",
     "ConstantsObfuscator",
+    "ControlFlowFlattenObfuscator",
     "DeepEncryptionObfuscator",
     "DefinitionsObfuscator",
     "DocstringObfuscator",

pof/obfuscator/cipher/deep_encryption.py

@@ -14,9 +14,19 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
-# FIXME (deoktr): work in progress !
 from base64 import b64encode
-from tokenize import DEDENT, INDENT, LPAR, NAME, NEWLINE, OP, RPAR, STRING, untokenize
+from tokenize import (
+    DEDENT,
+    INDENT,
+    LPAR,
+    NAME,
+    NEWLINE,
+    NL,
+    OP,
+    RPAR,
+    STRING,
+    untokenize,
+)
 
 from pof.logger import logger
 
@@ -25,14 +35,56 @@ class DeepEncryptionObfuscator:
     def __init__(self, encryption_depth=0) -> None:
         self.encryption_depth = encryption_depth
 
+    @staticmethod
+    def _nested_depth_at(tokens):
+        nested = 0
+        awaiting = False
+        for i, (toknum, tokval) in enumerate(tokens):
+            if toknum == NAME and tokval in ("def", "class") and nested == 0:
+                awaiting = True
+            if awaiting and toknum == INDENT:
+                awaiting = False
+                nested += 1
+            elif nested > 0 and toknum == INDENT:
+                nested += 1
+            elif nested > 0 and toknum == DEDENT:
+                nested -= 1
+            yield i, nested
+
+    @staticmethod
+    def _is_empty_return(tokens, pos):
+        """Check if the return at pos has no value (bare return)."""
+        for j in range(pos + 1, len(tokens)):
+            nt = tokens[j][0]
+            if nt in (NEWLINE, NL):
+                return True
+            if nt != DEDENT:
+                return False
+        return True
+
+    @classmethod
+    def _replace_returns(cls, tokens):
+        """Replace return with r= at the function body level.
+
+        Returns inside nested def/class are left intact.
+        """
+        depths = dict(cls._nested_depth_at(tokens))
+        result = []
+        for i, (toknum, tokval) in enumerate(tokens):
+            if toknum == NAME and tokval == "return" and depths.get(i, 0) == 0:
+                result.extend([(NAME, "r"), (OP, "=")])
+                if cls._is_empty_return(tokens, i):
+                    result.append((NAME, "None"))
+            else:
+                result.append((toknum, tokval))
+        return result
+
     def obfuscate_tokens(self, tokens):  # noqa: C901 PLR0912
         """Encrypt every function's source code.
 
-        Encrypt every function's source code with different keys, and decrypt
-        only when needed (just-in-time).
-        This will prevent the entire source code being accessible at once in the
-        memory, of course the draw back is the speed will be reduced.
-        Also verify integrity dynamically, maybe also sign encrypted code.
+        Encrypt every function's source code and decrypt only when needed
+        (just-in-time) via exec(). This prevents the entire source code being
+        accessible at once in memory.
 
         Convert functions into the following:
 
@@ -47,12 +99,8 @@ class DeepEncryptionObfuscator:
             del r_dict
             return r_val
         ```
-
-        Todo:
-        - create a function 'exec_return' and call it with en encrypted source
         """
         result = []  # obfuscated tokens
-        # just for testing
         result.extend(
             [
                 (NAME, "from"),
@@ -91,11 +139,9 @@ class DeepEncryptionObfuscator:
                 inside_function and depth <= self.encryption_depth and toknum == DEDENT
             ):
                 inside_function = False
-                # [2:-1] is to remove indent/dedent
 
                 fixed_function_tokens = []
-                # FIXME (deoktr): fix
-                fixed_depth = -1  # should it be - (self.encryption_depth) ??
+                fixed_depth = -1
                 for ftnum, ftval in function_tokens:
                     ftval_d = ftval
                     if ftnum == INDENT:
@@ -105,59 +151,43 @@ class DeepEncryptionObfuscator:
                         fixed_depth -= 1
                     fixed_function_tokens.append((ftnum, ftval_d))
 
-                # TODO (deoktr): need to change ALL indents tokens
+                # [2:-1] removes the outer indent/dedent wrapper
                 source = untokenize(fixed_function_tokens[2:-1])
 
-                # obviously doesn't work with yield
                 if not any(i in source for i in ["yield", "super"]):
-                    # TODO (deoktr): find a way better way
-                    # FIXME (deoktr): this should replace empty return statements
-                    source = source.replace("return\n", "r=None")
-                    source = source.replace("return", "r=")
+                    body_tokens = fixed_function_tokens[2:-1]
+                    replaced_tokens = self._replace_returns(body_tokens)
+                    source = untokenize(replaced_tokens)
 
                     encoded = b64encode(source.encode())
                     globals_dict_name = "r_dict"
                     new_tokens = [
                         (NEWLINE, "\n"),
-                        (
-                            INDENT,
-                            "    " * (self.encryption_depth + 1),
-                        ),  # TODO (deoktr): change me
+                        (INDENT, "    " * (self.encryption_depth + 1)),
+                        # r_dict = globals().copy()
                         (NAME, globals_dict_name),
                         (OP, "="),
                         (NAME, "globals"),
                         (LPAR, "("),
-                        (LPAR, ")"),
+                        (RPAR, ")"),
                         (OP, "."),
-                        (OP, "copy"),
+                        (NAME, "copy"),
                         (LPAR, "("),
-                        (LPAR, ")"),
+                        (RPAR, ")"),
                         (NEWLINE, "\n"),
+                        # r_dict.update(locals())
                         (NAME, globals_dict_name),
                         (OP, "."),
                         (NAME, "update"),
                         (LPAR, "("),
                         (NAME, "locals"),
                         (LPAR, "("),
-                        (LPAR, ")"),
-                        (LPAR, ")"),
-                        (NEWLINE, "\n"),
-                        # print the code before executing it, for testing
-                        (NAME, "print"),
-                        (LPAR, "("),
-                        (NAME, "b64decode"),
-                        (LPAR, "("),
-                        (STRING, repr(encoded)),
-                        (RPAR, ")"),
-                        (OP, "."),
-                        (NAME, "decode"),
-                        (LPAR, "("),
                         (RPAR, ")"),
                         (RPAR, ")"),
                         (NEWLINE, "\n"),
+                        # exec(b64decode(b'...'), r_dict)
                         (NAME, "exec"),
                         (LPAR, "("),
-                        # just for testing
                         (NAME, "b64decode"),
                         (LPAR, "("),
                         (STRING, repr(encoded)),
@@ -166,6 +196,7 @@ class DeepEncryptionObfuscator:
                         (NAME, globals_dict_name),
                         (RPAR, ")"),
                         (NEWLINE, "\n"),
+                        # if 'r' not in r_dict:
                         (NAME, "if"),
                         (STRING, "'r'"),
                         (NAME, "not"),
@@ -173,14 +204,13 @@ class DeepEncryptionObfuscator:
                         (NAME, globals_dict_name),
                         (OP, ":"),
                         (NEWLINE, "\n"),
-                        (
-                            INDENT,
-                            "    " * (self.encryption_depth + 2),
-                        ),  # TODO (deoktr): change me
+                        # return None
+                        (INDENT, "    " * (self.encryption_depth + 2)),
                         (NAME, "return"),
                         (NAME, "None"),
                         (DEDENT, ""),
                         (NEWLINE, "\n"),
+                        # r_val = r_dict['r']
                         (NAME, "r_val"),
                         (OP, "="),
                         (NAME, globals_dict_name),
@@ -188,9 +218,11 @@ class DeepEncryptionObfuscator:
                         (STRING, "'r'"),
                         (OP, "]"),
                         (NEWLINE, "\n"),
+                        # del r_dict
                         (NAME, "del"),
                         (NAME, globals_dict_name),
                         (NEWLINE, "\n"),
+                        # return r_val
                         (NAME, "return"),
                         (NAME, "r_val"),
                         (NEWLINE, "\n"),

pof/obfuscator/cipher/shift.py

@@ -23,13 +23,12 @@ from pof.utils.tokens import untokenize
 class ShiftObfuscator(ShiftCipher):
     """Shift cipher obfuscator."""
 
-    @classmethod
-    def obfuscate_tokens(cls, tokens):
+    def obfuscate_tokens(self, tokens):
         code = untokenize(tokens)
         return [
             (NAME, "exec"),
             (LPAR, "("),
-            *cls.decode_tokens(cls.encode_tokens(code)),
+            *self.decode_tokens(self.encode_tokens(code)),
             (RPAR, ")"),
             (NEWLINE, "\n"),
         ]

pof/obfuscator/constants.py

@@ -41,6 +41,7 @@ import random
 from tokenize import DEDENT, ENCODING, INDENT, NAME, NEWLINE, NUMBER, OP, STRING
 
 from pof.utils.generator import BasicGenerator
+from pof.utils.tokens import merge_implicit_strings
 
 
 class ConstantsObfuscator:
@@ -233,6 +234,7 @@ class ConstantsObfuscator:
         return [(NAME, variables[tokval][0])], variables
 
     def obfuscate_tokens(self, tokens):
+        tokens = merge_implicit_strings(tokens)
         variables = {}
         result = []
         parenthesis_depth = 0  # parenthesis depth

pof/obfuscator/controlflow/__init__.py

@@ -0,0 +1,19 @@
+# POF, a free and open source Python obfuscation framework.
+# Copyright (C) 2022 - 2026  Deoktr
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+from .control_flow_flatten import ControlFlowFlattenObfuscator
+
+__all__ = ["ControlFlowFlattenObfuscator"]

pof/obfuscator/controlflow/control_flow_flatten.py

@@ -0,0 +1,208 @@
+# POF, a free and open source Python obfuscation framework.
+# Copyright (C) 2022 - 2026  Deoktr
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+import ast
+import io
+import random
+from tokenize import ENCODING, ENDMARKER, generate_tokens
+
+from pof.utils.tokens import untokenize
+
+
+class ControlFlowFlattenObfuscator:
+    """Transform sequential function code into a state-machine dispatcher."""
+
+    def __init__(self, min_statements: int = 3) -> None:
+        self.min_statements = min_statements
+
+    @staticmethod
+    def _should_skip_function(body: list[ast.stmt]) -> bool:
+        """Return True if the function body contains unsupported constructs."""
+        for node in ast.walk(ast.Module(body=body, type_ignores=[])):
+            if isinstance(
+                node,
+                (
+                    ast.Yield,
+                    ast.YieldFrom,
+                    ast.AsyncFor,
+                    ast.AsyncWith,
+                    ast.Await,
+                ),
+            ):
+                return True
+        return False
+
+    @staticmethod
+    def _has_return(stmts: list[ast.stmt]) -> bool:
+        """Check if any statement in the list is or contains a return."""
+        for node in ast.walk(ast.Module(body=stmts, type_ignores=[])):
+            if isinstance(node, ast.Return):
+                return True
+        return False
+
+    @classmethod
+    def _flatten_body(cls, body: list[ast.stmt]) -> list[ast.stmt]:
+        """Transform a list of sequential statements into a state-machine dispatcher."""
+        num_blocks = len(body)
+        all_states = random.sample(range(100, 999), num_blocks + 1)
+        exit_state = all_states[-1]
+        block_states = all_states[:num_blocks]
+
+        state_var = "_state"
+        ret_var = "_ret"
+        has_ret = cls._has_return(body)
+
+        dispatcher_cases: list[ast.If | None] = []
+
+        for idx, (state_num, stmt) in enumerate(zip(block_states, body)):
+            next_state = block_states[idx + 1] if idx + 1 < num_blocks else exit_state
+
+            case_body: list[ast.stmt] = []
+
+            if isinstance(stmt, ast.Return):
+                # return value -> _ret = value; _state = exit
+                if stmt.value is not None:
+                    case_body.append(
+                        ast.Assign(
+                            targets=[ast.Name(id=ret_var, ctx=ast.Store())],
+                            value=stmt.value,
+                            lineno=0,
+                        ),
+                    )
+                case_body.append(
+                    ast.Assign(
+                        targets=[ast.Name(id=state_var, ctx=ast.Store())],
+                        value=ast.Constant(value=exit_state),
+                        lineno=0,
+                    ),
+                )
+            elif isinstance(stmt, ast.If):
+                # if/else -> execute block, then set state based on which branch
+                # for simplicity, keep the if/else inside the state block and
+                # set next state after
+                case_body.append(stmt)
+                case_body.append(
+                    ast.Assign(
+                        targets=[ast.Name(id=state_var, ctx=ast.Store())],
+                        value=ast.Constant(value=next_state),
+                        lineno=0,
+                    ),
+                )
+            else:
+                case_body.append(stmt)
+                case_body.append(
+                    ast.Assign(
+                        targets=[ast.Name(id=state_var, ctx=ast.Store())],
+                        value=ast.Constant(value=next_state),
+                        lineno=0,
+                    ),
+                )
+
+            test = ast.Compare(
+                left=ast.Name(id=state_var, ctx=ast.Load()),
+                ops=[ast.Eq()],
+                comparators=[ast.Constant(value=state_num)],
+            )
+            dispatcher_cases.append((test, case_body))
+
+        if not dispatcher_cases:
+            return body
+
+        random.shuffle(dispatcher_cases)
+
+        current: ast.stmt | None = None
+        for test, case_body in reversed(dispatcher_cases):
+            if current is None:
+                current = ast.If(test=test, body=case_body, orelse=[])
+            else:
+                current = ast.If(test=test, body=case_body, orelse=[current])
+
+        init_state = ast.Assign(
+            targets=[ast.Name(id=state_var, ctx=ast.Store())],
+            value=ast.Constant(value=block_states[0]),
+            lineno=0,
+        )
+
+        init_ret: list[ast.stmt] = []
+        if has_ret:
+            init_ret.append(
+                ast.Assign(
+                    targets=[ast.Name(id=ret_var, ctx=ast.Store())],
+                    value=ast.Constant(value=None),
+                    lineno=0,
+                ),
+            )
+
+        while_loop = ast.While(
+            test=ast.Compare(
+                left=ast.Name(id=state_var, ctx=ast.Load()),
+                ops=[ast.NotEq()],
+                comparators=[ast.Constant(value=exit_state)],
+            ),
+            body=[current],
+            orelse=[],
+        )
+
+        result: list[ast.stmt] = [init_state, *init_ret, while_loop]
+
+        if has_ret:
+            result.append(ast.Return(value=ast.Name(id=ret_var, ctx=ast.Load())))
+
+        return result
+
+    def obfuscate_tokens(self, tokens: list) -> list:
+        source = untokenize(tokens)
+
+        try:
+            tree = ast.parse(source)
+        except SyntaxError:
+            return tokens
+
+        modified = False
+
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.FunctionDef):
+                continue
+
+            body = node.body
+            if len(body) < self.min_statements:
+                continue
+
+            if self._should_skip_function(body):
+                continue
+
+            node.body = self._flatten_body(body)
+            modified = True
+
+        if not modified:
+            return tokens
+
+        ast.fix_missing_locations(tree)
+        new_source = ast.unparse(tree)
+
+        try:
+            new_tokens = list(generate_tokens(io.StringIO(new_source + "\n").readline))
+        except Exception:  # noqa: BLE001
+            return tokens
+
+        # strip ENCODING and ENDMARKER
+        result: list[tuple[int, str]] = []
+        for toknum, tokval, *_ in new_tokens:
+            if toknum in (ENCODING, ENDMARKER):
+                continue
+            result.append((toknum, tokval))
+
+        return result

pof/obfuscator/esoteric/doc.py

@@ -20,6 +20,7 @@ from tokenize import NAME, NUMBER, OP, STRING
 
 from pof.errors import PofError
 from pof.logger import logger
+from pof.utils.tokens import merge_implicit_strings
 
 
 class CharFromDocObfuscator:
@@ -228,6 +229,7 @@ class CharFromDocObfuscator:
     def obfuscate_tokens(self, tokens):
         # print.__doc__[0] = 'P'
         # __builtins__.__doc__[0] = 'B'
+        tokens = merge_implicit_strings(tokens)
         result = []
 
         for _index, (toknum, tokval, *_) in enumerate(tokens):

pof/obfuscator/extract_variables.py

@@ -14,55 +14,11 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
-# TODO (deoktr): WORK IN PROGRESS !
-#
-# Look at `Ruff` for "variable extraction"
-#
-# IDEA: maybe put every declaration at the start of the function, so that it has way
-#   less chance to break the actual function
-#
-# example output:
-#
-# ```
-# import os
-# BASE = "/home/test/"
-# path = os.path.join(BASE, "file.txt")
-# print(path)
-# ```
-#
-# ```
-# import os
-# u = "/home/test/"
-# BASE = u
-# a = "file.txt"
-# path = os.path.join(BASE, a)
-# x = path
-# print(x)
-# ```
-#
-# FIXME (deoktr): parenthesis variables:
-# ```
-# if (
-#    x < 1 and y > 2
-# )
-# ```
-# this would break because the variables would be added INSIDE the parenthesis
-#
-#
-# FIXME (deoktr): decorators:
-# ```
-# class Foo:
-#     @classmethod
-#     def bar(a=1, b=2):
-#        pass
-# ```
-# after classmethod and before def variables a and b will be obfuscated,
-# breaking the code
-#
 import keyword
 from tokenize import DEDENT, ENCODING, INDENT, NAME, NEWLINE, NL, NUMBER, OP, STRING
 
 from pof.utils.generator import BasicGenerator
+from pof.utils.tokens import merge_implicit_strings
 
 
 class ExtractVariablesObfuscator:
@@ -241,6 +197,8 @@ class ExtractVariablesObfuscator:
     RESERVED = RESERVED_WORDS + BUILTINS + tuple(keyword.kwlist)
     KEYWORDS = tuple(keyword.kwlist)
 
+    CONTINUATION_KEYWORDS = ("elif", "else", "except", "finally")
+
     def __init__(self, generator=None) -> None:
         if generator is None:
             generator = BasicGenerator.alphabet_generator()
@@ -249,12 +207,15 @@ class ExtractVariablesObfuscator:
     def generate_new_name(self):
         return next(self.generator)
 
-    def obfuscate_tokens(self, tokens):
+    def obfuscate_tokens(self, tokens):  # noqa: C901
+        tokens = merge_implicit_strings(tokens)
         result = []
         new_line_buffer = []
         line_buffer = []
-        parenthesis_depth = 0  # parenthesis depth
+        parenthesis_depth = 0
         prev_toknum = None
+        in_decorator = False
+
         for toknum, tokval, *_ in tokens:
             new_tokens = [(toknum, tokval)]
 
@@ -263,17 +224,28 @@ class ExtractVariablesObfuscator:
             elif toknum == OP and tokval == ")":
                 parenthesis_depth -= 1
 
+            # track decorator context, suppress flushing between @ and def/class
+            if toknum == OP and tokval == "@":
+                in_decorator = True
+            elif in_decorator and toknum == NAME and tokval in ("def", "class"):
+                in_decorator = False
+
             is_docstring = toknum == STRING and (
-                prev_toknum
-                in [
-                    NEWLINE,
-                    DEDENT,
-                    INDENT,
-                    ENCODING,
-                ]
+                prev_toknum in [NEWLINE, DEDENT, INDENT, ENCODING]
             )
 
-            if (toknum == STRING and not is_docstring) or toknum == NUMBER:
+            # check if current line starts with a continuation keyword if so,
+            # skip extraction to avoid scope issues
+            first_name_in_line = None
+            for tok in line_buffer:
+                if tok[0] == NAME:
+                    first_name_in_line = tok[1]
+                    break
+            on_continuation_line = first_name_in_line in self.CONTINUATION_KEYWORDS
+
+            if (
+                (toknum == STRING and not is_docstring) or toknum == NUMBER
+            ) and not on_continuation_line:
                 random_name = self.generate_new_name()
                 new_line_buffer.extend(
                     [
@@ -285,19 +257,11 @@ class ExtractVariablesObfuscator:
                 )
                 new_tokens = [(NAME, random_name)]
 
-            # TODO (deoktr): ensure that this works
-            has_decorator = any("@" in t[1] for t in line_buffer)
-            newline_count = [t[1] for t in line_buffer].count("\n")
-
-            if (
-                ((toknum in (NEWLINE, NL)) and tokval == "\n") and not has_decorator
-            ) or (newline_count > 1):
-                if has_decorator:
-                    line_buffer = [(NEWLINE, "\n"), *line_buffer]
-                    new_tokens = new_line_buffer + line_buffer + new_tokens
-                else:
-                    new_tokens = new_line_buffer + new_tokens + line_buffer
+            is_newline = toknum in (NEWLINE, NL) and tokval == "\n"
+            can_flush = is_newline and parenthesis_depth == 0 and not in_decorator
 
+            if can_flush:
+                new_tokens = new_line_buffer + new_tokens + line_buffer
                 new_line_buffer = []
                 line_buffer = []
             elif toknum in (INDENT, DEDENT):

pof/obfuscator/remove/newline.py

@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
-from tokenize import INDENT, NEWLINE, NL
+from tokenize import COMMENT, NEWLINE, NL
 
 
 class NewlineObfuscator:
@@ -31,9 +31,8 @@ class NewlineObfuscator:
             # remove empty lines created after token manipulations
             # \n after \n --> 2 new lines in a row = one is useless
             # \n after NL --> same ^
-            # \n after INDENT --> docstrings are placed after an indent
-            if toknum == NL or (
-                toknum == NEWLINE and (prev_toknum in (NEWLINE, NL, INDENT))
+            if (toknum == NL and prev_toknum != COMMENT) or (
+                toknum == NEWLINE and (prev_toknum in (NEWLINE, NL))
             ):
                 new_tokens = None