How to Obfuscate Code in Python: A Thought Experiment

As with most articles in this series, I was doing some browsing on Google, and I found that some folks had an interest in learning how to obfuscate code in Python. Naturally, I thought that would be a fun topic. By no means am I an expert, but I’m familiar with the idea. As a result, treat this like a fun thought experiment.

Problem Description

Unlike most articles in this series, I’m not looking for a quick answer to code obfuscation—the process of making code unreadable. Instead, I want to look at various obfuscation methods. To do that, we’ll need some piece of nicely formatted source code:

Cool! Here’s a standalone function that I pulled from my auto-grader project. It’s not the best code in the world, but I figured it would serve as a nice example. After all, it’s a short snippet that performs a simple function: reads a file and dumps the results as a list of lines.

In this article, we’ll take a look at a few ways of making this code snippet as unintelligible as possible. Keep in mind that I’m not an expert at this. Rather, I thought this would be a fun exercise where we could all learn something.

Solutions

In this section, we’ll take a look at several ways to obfuscate code. In particular, we’ll be taking the original solution and gradually manipulating it throughout this article. As a result, each solution will not be a standalone solution. Instead, it will be an addition to all previous solutions.

Obfuscate Code by Removing Comments

One surefire way to make code hard to read is to begin by avoiding best practices. For instance, we could start by removing any comments and docstrings:

In this case, the solution is self-documenting, so it’s fairly easy to read. That said, the removal of the comment does make it slightly harder to see exactly what this method accomplishes.

Obfuscate Code by Removing Type Hints

With the comments out of the way, we can begin removing other helpful pieces of syntax. For example, we have a few bits of syntax which help people track variable types throughout the code. In particular, we indicated that the input parameter solution_path should be a string. Likewise, we also indicated that the function returns a list. Why not remove those type hints?

Again, this function is still fairly manageable, so it wouldn’t be too hard to figure out what it does. In fact, almost all Python code looked like this at one point, so I wouldn’t say we’ve reached any level of obfuscation yet.

Obfuscate Code by Removing Whitespace

Another option for visual obfuscation is removing all extraneous whitespace. Unfortunately, in Python, whitespace has value. In fact, we use it to indicate scope. That said, there’s still some work we can do:

Here, we were only able to remove three spaces: one between solution_path and encoding, one between data and =, and one between = and solution.readlines(). As a result, the code is still fairly readable. That said, as we begin to obfuscate our code a bit more, we’ll see this solution pay dividends.

Obfuscate Code by Abandoning Naming Conventions

One thing we have full control over in code is naming conventions. In other words, we decide what we name our functions and variables. As a result, it’s possible to come up with names that completely obfuscate the intent of a variable or function:

Here, we’ve lost all semantic value that we typically get from variable and function names. As a result, it’s even hard to figure out what this program does.

Personally, I don’t think this goes far enough. If we were particularly sinister, we’d generate long sequences of text for each name, so it’s even more difficult to understand:

Hell, I might even use a single random string of characters and only modify bits of it. For example, we could try using the function name repeatedly with slight alterations (e.g. 1 for l, O for 0, etc.):

Of course, while this looks harder to read, nothing is really stopping the user from using an IDE to follow each reference. Likewise, compiling and decompiling this function (i.e. .py -> .pyc -> .py) would probably undo all our hard labor. As a result, we’ll have to go deeper.

Obfuscate Code by Manipulating Strings

Another way to make code unintelligible is to find hardcoded strings like “utf8” in our example and add an unnecessary layer of abstraction to them:

Here, we’ve constructed the string “utf8” from its ordinal values. In other words, ‘u’ corresponds to 117, ‘t’ corresponds to 116, ‘f’ corresponds to 102, and ‘8’ corresponds to 56. This additional complexity is still pretty easy to map. As a result, it might be worthwhile to introduce even more complexity:

Instead of direct concatenation, we’ve introduced the join method. Now, we have a list of characters as numbers. Let’s reverse the list just to add a bit of entropy to the system:

How about that? Now, we have even more code we can begin modifying.

Obfuscate Code by Manipulating Numbers

With our “utf8” string represented as a reversed list of numbers, we can begin changing their numeric representation. For example, 56 is really 28 * 2 or 14 * 2 * 2 or 7 * 2 * 2 * 2. Likewise, Python supports various bases, so why not introduce hexadecimal, octal, and binary to the mix?

Suddenly, it’s unclear what numbers we’re even working with. To add a bit of chaos, I thought it would be fun to insert a whitespace character:

Then, we can call the strip method to remove that extra space.

Obfuscate Code by Introducing Dead Code

In the previous example, we added a whitespace character to our string to make it slightly more difficult to decode. We can now take that idea and begin to add code that doesn’t really do anything:

Here, I’ve introduce a dead branch. In other words, we’re operating under the assumption that the input is a valid string. As a result, we can add a silly case where we check if the string has a length greater than -1—which is always true. Then, on the dead branch, we return some generic value.

At this point, what is stopping us from writing a completely ridiculous dead block? In other words, instead of returning a simple junk value, we could construct a complex junk value:

Honestly, I could have put anything in the dead block. For fun, I decided to play with the input string. For instance, I constructed a substring and repeated it. Then, I constructed a list from the characters in that new string.

Obfuscate Code by Adding Dead Parameters

If we can introduce dead branches, we can absolutely introduce dead parameters. However, we don’t want to alter the behavior of the underlying function, so we’ll want to introduce default parameters:

Of course, this parameter is of no use currently. In other words, let’s try doing something with it:

Now, there is something beautiful about the expression LdDG0v51X42t%2!=0. To me, it looks like a password—not a test for odd numbers.

Of course, why stop there? Another cool thing we can do with parameters is take advantage of variable length arguments:

Now, we’ve opened the door to an unlimited number of arguments. Let’s add some code to make this interesting:

Again, we’ll never hit this branch because the first condition is always true. Of course, the casual reader doesn’t know that. At any rate, let’s have some fun with it:

Yep, that’s an infinite loop! Unfortunately, it’s sort of obvious. That said, I suspect that the variable names will obscure the intent for a little while.

Other Ways to Obfuscate Code

Once again, I’ll mention that this article was more of a thought experiment for me. I had seen obfuscated code in the past, and I thought it would be fun to give it a try myself. As a result, here’s the original snippet and the final snippet for comparison:

At this point, I suppose we could continue to iterate, but I’m not sure that would be the best use of my time. That said, there were a few things I considered trying. For instance, I thought about compressing lines of code such as:

Into something like:

However, part of me felt like this would actually make the code easier to read since we wouldn’t have to map variable names.

In addition, I thought about making some methods just to pollute the namespace a little bit. For example, we could create functions that overwrite some of the standard library. Then, give them totally different behavior. In our case, we might redefine reversed to confuse the reader into thinking it has its typical behavior:

Then, we could pass whatever we wanted into it as bait. Wouldn’t that be sinister?

Beyond that, I’m aware that there are obfuscation tools out there, but I’m not sure how widely used they are. Here are a few examples:

• pyarmor: “A tool used to obfuscate python scripts, bind obfuscated scripts to fixed machine or expire obfuscated scripts.”
• pyminifier: “Minify, obfuscate, and compress Python code”
• Opy: “Obfuscator for Python”
• Oxyry: “the power to protect your python source code”

I haven’t tried many of these tools, but Oxyry is definitely the most convenient. When I plug our function into it, it generates the following code:

Clearly, that’s not great, but I suppose it’s effective. If you know of any other tools or cool techniques, feel free to share them in the comments.

Challenge

For today’s challenge, pick a piece of code and try to obfuscate it. Feel free to use all of the ideas leveraged in this article. However, the challenge will be to come up with your own ideas. What other ways can we obfuscate Python code?

If you’re looking for some ideas, I mentioned a couple in the previous section. Of course, there are other things you could try. For instance, you could always add a logger which prints erroneous messages to the console. Something like this would have no effect on your program’s behavior, but it could confuse a reader.

If you want to go the extra mile, try writing a program which performs your favorite obfuscation technique. For instance, could you write a program which could identify Python variables? If so, you could generate your own symbol table which would track all variables. Then, you could generate new names without any worries about clashes.

At the end of the day, however, treat this challenge like a fun thought experiment. I don’t expect any of these methods to be all that practical. After all, if a machine can run the code even in an obfuscated state, so can a human (eventually).

A Little Recap

Typically, in this section, I would list off all the solutions. However, the code snippets are quite long, and I don’t think it makes a lot of sense for me to dump them here. As a result, I’ll just share the options as a list:

• Remove comments, type hints, and whitespace
• Abandon naming conventions
• Manipulate strings and numbers
• Introduce dead code and parameters
• Try something else

With that, I think we’re don for the day. If you like this sort of content, I’d appreciate it if you checked out an article on the different ways you can support the site.

Finally, here are some related articles:

• How to Compare Strings in Python: Equality and Identity
• How to Perform a Reverse Dictionary Lookup in Python: Generator Expressions and More

Once again, thanks for stopping by. See you next time!

Do you want to know how to develop your skillset to become a Web Rockstar?

Subscribe to our newsletter to start Rocking right now!

To get you started we give you our best selling eBooks for FREE!

1. Building web apps with Node.js

2. HTML5 Programming Cookbook

3. CSS Programming Cookbook

4. AngularJS Programming Cookbook

5. jQuery Programming Cookbook

6. Bootstrap Programming Cookbook

and many more ....

I agree to the Terms and Privacy Policy

Sign up

Thank you!

We will contact you soon.