How It Works
A single Python file enters a pipeline of 40+ protection modules and emerges as a hardened, polymorphically-encrypted binary with active runtime defense.
1. Parse & Prepare
AST Parsing
Your Python source is parsed and mapped in full before any transformation begins. Every function, class, import, and expression is tracked.
Variable Renaming
All identifiers (variables, functions, classes) are replaced with random, meaningless names using a cryptographically seeded generator.
Minification
Whitespace, comments, docstrings, and unnecessary tokens are stripped. Reduces file size and removes human-readable annotations.
Number Conversion
Numeric literals are converted to hex, octal, or binary representations. Integer constants are broken into arithmetic expressions.
All-Names Preservation
Public module exports are preserved through the entire obfuscation pipeline. Obfuscated scripts can still be used as importable modules with correct public APIs.
Multi-Layer Encoding
The entire payload is run through a chained encoding pipeline: compression, base64, base32, character scrambling, and string reversal. Each layer must be peeled in order at runtime.
2. Obfuscation
String Encryption
Every string literal is encrypted with ChaCha20 under per-session keys. Unicode-aware, so non-ASCII strings are handled correctly.
Function Obfuscation
Individual functions are extracted, encrypted, and replaced with wrapped execution contexts. The original function body is only decrypted at call time.
Lite Function Obfuscation
Functions are compressed and packed into compact byte arrays using the codec that shrinks each function best. Decompiler protections are applied before reinsertion.
Control Flow Flattening
Code structure is shattered into a switch-based state dispatch loop. All branching logic is collapsed into a single flat state machine -- the original if/else/loop structure becomes unrecoverable.
MBA Obfuscation
Mixed Boolean-Arithmetic transforms simple expressions (x + y) into algebraically equivalent but unrecognizable forms using MBA identities.
Opaque Predicates
Always-true or always-false conditions are injected throughout the code using mathematical invariants. Static analysis cannot distinguish real branches from fake ones.
Junk Code Injection
Non-functional dead code and unreachable branches are inserted. Every junk block looks legitimate -- it uses real variables and calls real functions, but never executes.
Function Wrapping
The entire codebase is wrapped into a single function call. All imports are extracted and re-injected inside the wrapper, altering global scope visibility.
3. Hardening & Anti-Tamper
Decompiler Breaking
Bytecode is deliberately corrupted in ways that specifically crash pylingual, pycdc, and uncompyle6. Decompilers see nonsense instructions or infinite loops and abort.
Anti-Debug (11 Methods)
Process scan for debugger modules, VM environment detection via hardware and firmware indicators, timing analysis, debugger DLL checks, process validation, hardware breakpoint detection, and stack frame analysis. On detection the process terminates.
Anti-Dump (Memory Zeroing)
Code objects are zeroed from memory as soon as they finish executing. Decrypted bytecode buffers are destroyed in place, so memory dumps cannot recover them.
Memory Page Protection
Code memory is marked read-only at the OS level. In-memory patching and hot-patching tools are blocked at the memory page level.
Hydra Anti-Tamper
Layered monitors run alongside the payload: a high-frequency monitor, a secondary background monitor, and the native kernel watchdog. Any layer that observes tampering wipes key material and terminates the process.
Anti-Monkey-Patching
HMAC-SHA256 challenge-response tokens are issued at startup. Every critical built-in function is verified against its original reference before each use. Any mismatch triggers immediate termination.
Integrity Checks
The code payload is loaded through a custom code-object serializer with no fallback to standard marshal. If the payload is tampered with, loading fails closed and the process exits.
Anti-VM Detection
12 detection methods covering CPU vendor strings, MAC address prefixes, BIOS and firmware patterns, hardware enumeration, display driver checks, and register-based heuristic flags. Signals are confidence-weighted, so one ambiguous result is not fatal.
Audit Hook Protection
Python audit hooks are installed at bootstrap that block unauthorized syscalls, subprocess creation, and debugger attachment. The audit hook itself is validated before each invocation.
Caller Frame Validation
Every execution context validates its call stack to ensure code is being invoked from a legitimate obfuscated context, not from injected or externally crafted calls.
Anti-Trace Anti-Profile
Tracer and profiler state is monitored continuously in the background. If a tracer or profiler is detected, the process terminates.
4. Encryption & Packaging
Bytecode Encryption (AES-256-GCM)
The entire code object is encrypted with AES-256-GCM using authenticated encryption. A random key and nonce are generated per build, then scrambled into the stub loader.
White-Box Cryptography
A Feistel network cipher of 8 to 12 rounds, randomised per build, with the key expanded via SHA-256 and embedded in the derived lookup tables. The key is never reconstructed at runtime, so key extraction is impossible.
Polymorphic Output
Every build is unique. Keys are generated fresh, operations are renamed, cipher rounds are randomised, and decoys are regenerated, so two obfuscations of the same file produce structurally different outputs.
Polymorphic Stub Generation
A self-extracting stub is generated with nested function wrappers, encrypted payloads, and version-locked bootstrap code. Each build uses a different decryption and loading strategy.
Custom N-Serialize Format
The obfuscated code object is serialized using a custom format that cannot be parsed by standard Python marshal or pickle. Custom deserializer code is injected into the output to reverse this at runtime.
Compression
The final encrypted payload is compressed before being embedded in the stub. Decompression happens inside the stub before decryption, further complicating static analysis.
Watermark Embedding
A tamper-proof watermark is embedded in the obfuscated output identifying it as Nyami-protected. If the watermark is removed or altered, the obfuscated code refuses to run.
5. Compilation & Distribution (Optional)
PYTOC (Python To C)
Obfuscated Python is compiled to a native .pyd extension via Cython. The transformation goes Python -> .pyx -> C -> compiled machine code, eliminating Python source entirely while maintaining a single-file import interface.
PyInstaller Automation
Automatic PyInstaller spec file generation with full dependency collection. The original script is scanned for all import statements, third-party modules are mapped to their package names, and transitive dependencies are resolved into a build-ready spec.
HWID Locking (AES-256-GCM)
Hardware-bound encryption locks the obfuscated output to specific machines. A hardware fingerprint (UUID, MAC, disk serial) is hashed via PBKDF2 and used as AES-GCM additional authenticated data. The file will only decrypt on the authorized machine.
Trial System
Time-limited licensing built into the obfuscated output. Supports multi-unit specifications (1h, 1d, 1w, 1mo, 1y). The deadline is MAC-bound, so moving the build to another machine breaks the trial rather than extending it, and clock rollback is detected.
Secure Cleanup
Temporary build artifacts, including intermediate C sources and build directories, are securely overwritten before deletion. Forensic recovery of intermediate compilation artifacts from disk is prevented.
Bootstrap Generation
A version-locked bootstrap loader is generated for each build. The bootstrap verifies the Python version at import time, installs audit hooks, validates the runtime environment, and only then proceeds to decrypt and execute the payload.
Ready to protect your code?
Start with a single obfuscation token for EUR 1 -- no subscription required.