Metadata-Version: 2.4
Name: pyraph
Version: 1.0.0
Summary: Pyraph - The Luraph of Python. Extreme Python obfuscation with custom VM virtualization and native compilation.
Author: AchillesHubTeam
License: Proprietary
Requires-Python: >=3.9
Description-Content-Type: text/markdown

# Pyraph

**The Luraph of Python.** Extreme Python obfuscation engine with custom VM virtualization, multi-layer encryption, and native compilation.

## Installation

```bash
pip install pyraph
```

## Usage

### Protect a single .py file (outputs obfuscated .py)

```bash
pyraph app.py
pyraph app.py -o protected.py --vm-layers 3
pyraph app.py --one-liner
```

### Protect a folder → native binary (.exe / ELF)

```bash
pyraph ./my_project -o ./dist
```

### Options

| Flag | Description |
|------|-------------|
| `-o, --output` | Output path |
| `--vm-layers N` | Number of VM virtualization layers (default: 3) |
| `--one-liner` | Compress output into a single line |
| `--no-anti-debug` | Disable anti-debug protections |
| `--no-integrity` | Disable integrity checks |

## How It Works

Pyraph applies multiple protection layers that make reverse engineering extremely difficult:

### .py Mode (single file)

1. **MultiVirtual Engine** — Code is fragmented into N micro-chunks. Each chunk is compiled to bytecode, marshalled, then encrypted with its own unique VM opcode table. Fake decoy chunks are mixed in.
2. **Multi-round Encryption** — Each fragment is encrypted with 3 rounds of SHA256-derived XOR keys, bound to an irremovable watermark.
3. **Polymorphic Output** — Every protection run generates completely different output: different variable names, different opcode mappings, different keys, different structure. No two outputs are alike.
4. **Anti-Debug** — Continuous watchdog thread monitoring `sys.settrace`/`sys.getprofile`, import hooking blocker, `prctl(PR_SET_DUMPABLE, 0)` on Linux, `SetProcessMitigationPolicy` on Windows.
5. **Anti-Dump** — GC disabled during execution, code object metadata stripped, `marshal.loads` called via C API (`ctypes.pythonapi.PyMarshal_ReadObjectFromString`) to bypass Python-level hooks.
6. **Junk Code Injection** — Realistic-looking fake decrypt functions, hash checks, XOR loops, and dispatch tables that are indistinguishable from real protection logic.

### Native Mode (folder → executable)

1. **Cython/C Compilation** — All .py files compiled to C with encrypted source embedding.
2. **Anti-Trace** — `sys.settrace(None)` called at C level immediately after `Py_Initialize()`, `PYTHONPATH` nuked to prevent `sitecustomize.py` injection.
3. **Anti-Ptrace** — `ptrace(PTRACE_TRACEME)`, `prctl(PR_SET_DUMPABLE, 0)`, TracerPid checking, timing checks.
4. **String Obfuscation** — All sensitive strings in the binary are assembled from char arrays at runtime, invisible to `strings` command.
5. **C-level Mutation** — Junk code injected into compiled C functions.
6. **Memory Wipe** — Source decrypted in memory → executed → `memset(0)` → freed.

## Output Example

**Input** (readable Python):
```python
def hello(name):
    return f"Hello, {name}!"
print(hello("World"))
```

**Output** (protected):
```python
import hashlib as _pyraph_h
_285000=__import__('base64').b85decode('^N*y~dZDPE0<<XyA^')
_513918=bytes.fromhex('a3f6d6b70ac9')+bytes([136, 232, 51, 154, 25, 41, 18])
_517821=bytes(_285000[_i]^_513918[_i] for _i in range(len(_285000)))
del _285000,_513918
_919520=_pyraph_h.sha256(_517821).digest()
if len(_919520)!=32:__import__('os')._exit(1)
del _pyraph_h,_517821,_919520
import sys as _sys
import os as _os
import threading as _th
...
exec(__import__('zlib').decompress(__import__('base64').b85decode(_a+_b+_c)).decode())
```

## Security Properties

- **No source recovery** — Code is compiled to bytecode → marshalled → encrypted. Source text never exists at runtime.
- **Anti-hook** — `marshal.loads` called via `ctypes.pythonapi` (C-level), bypasses any Python monkey-patching.
- **Anti-trace** — Watchdog thread kills process if `sys.gettrace() is not None` (checks every 30ms).
- **Watermark integrity** — Obfuscated watermark is cryptographically bound to decryption keys. Removing it breaks all execution.
- **Polymorphic** — Each run produces unique output with different VM opcodes, variable names, and encryption keys.

## Tested Against

- ✅ `sys.settrace` hook via `sitecustomize.py`
- ✅ `builtins.exec` / `builtins.compile` patching
- ✅ `marshal.loads` hook
- ✅ `gc.get_objects()` code object dump
- ✅ `PYTHONPATH` injection attacks
- ✅ `strings` command on native binary
- ✅ Memory dump via `ReadProcessMemory` (Windows) / `ptrace` (Linux)

## Compatibility

- Python 3.9+
- Linux, macOS, Windows
- Native mode requires `gcc` and Python dev headers

## License

Proprietary. Closed source.
