Encrypting modules..

[jbi130]

So I wrote a custom importer in C that loads in encrypted files,
decrypts, then unmarshals them and loads them as modules, there is
also a quick little compiler to generate our encrypted modules.

Works pretty good. The intention is to distribute python modules and
limit access to the source.

My question now is, from the interpreter can a user extract the
bytecode from a loaded module (which could then be written to a file
and 'decompyled')? If so, any effort I put into an encrypted module
loader has gone to waste (only 2 hours and worth the time to learn
about custom importers). I don't mean to bring up an old thread about
hiding source, but searching google for getting bytecode from an in
memory module didn't bring up much.

If this is the case, is the only alternative to hack up the
interpreter and the bytecode in generates/reads? Building python is
part of our build/distribution process so it would not be that big of
a deal.

Thanks!

 

[Frithiof Andreas Jensen]

If this is the case, is the only alternative to hack up the
interpreter and the bytecode in generates/reads?

... Which will not stop any dedicated reverse engineering for very long and
probably trigger subtle bugs in extention modules because people will have
made assumptions about how the interpreter works. In any case, it blows up
when the user upgrades Python which will piss the users off (or maybe not:
Java is still around

It would be easiest to stick "the secret bit" on a secure server and access
it via Pyro;

A little harder to stick "the secret bit" in an C/C++ extension module.

In both cases, of course, one can see the interface and the protocol it uses
and "route around the damage" i.e. provide a module that does the same but
is unemcumbered by IPR.