Comments (2)
@VeNoMouS could you describe your attack model in more detail? Would the attacker have full root access to a system when you execute? Would they be able to do code injection? Would they start with only access to your .pyce
files?
Typically, what you're talking about is restricted by key distribution techniques which is not within the scope of this module.
This module handles the low-level encrypt/decrypt operations, but where the keys come from is up to you or your organization. For example, you could run a key server on the Internet and only provide them to licensed users.
Obviously, your code has to decrypt somewhere before hitting the CPU. Attackers could get the code at any point during that window of execution.
For example, a cloud provider could read the RAM of your VM and take the decrypted code from pages in your memory.
What matters here is:
- Your attack model
- Your key distribution technique
from pyce.
To recap this, if you had the pyce and you had the key, you can simply decode the whole thing without execution... with what i outlined in the original post.
The whole "key distribution technique" argument is head in a paper bag response, your simply pushing the issue/problem of this flaw back onto the user.
I originally looked at this project to distribute private code to users without them reverse engineering my work...
But once ANYONE has a key you can simply reverse engineer all the way back to source,
pyarmor is a better approach in the fact decryption is closed source and only distributed in binary form
While yes, you can place traces around the stack and still reverse engineer but that will take far more time / effort than the ~3 lines of code I provided to convert back to source that it takes with this project.
I'm sorry but I fail to see how this project is designed for distributed code encryption, when it can be reversed to full source so easily.
from pyce.
Related Issues (15)
- Failing on Python 3.7.0
- Version pinning cryptography causes dependency conflicts HOT 5
- Standardise encrypt_path result and PYCEPathFinder.KEYS input. HOT 2
- Encrypting entire package
- Update pinned version of cryptography HOT 2
- Add a `.gitignore`
- Add a helper function to simplify adding the import hook
- Cleanup `sdist`
- ImportError: bad magic number HOT 1
- NameError: name '__file__' is not defined HOT 4
- Parameterize `demo.sh`
- Installation Error on Debian (Kali Linux)
- Pip fails to install on python3.8 and above, >cryptogrpahy 2.3 HOT 2
- Encryption key lookup depends on location from where code is executed HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from pyce.