286 lines
9.6 KiB
Python
286 lines
9.6 KiB
Python
__name__ = "rose_obfuscator"
|
|
__author__ = "gumbobr0t"
|
|
__version__ = "1.0.3"
|
|
|
|
from logging import INFO, DEBUG, getLogger, Formatter, FileHandler
|
|
from ast import (
|
|
parse,
|
|
unparse,
|
|
walk,
|
|
Name,
|
|
Assign,
|
|
ClassDef,
|
|
FunctionDef,
|
|
AsyncFunctionDef,
|
|
)
|
|
from random import choice
|
|
from string import ascii_letters, ascii_uppercase, digits, punctuation
|
|
from os import path, getcwd
|
|
from re import sub
|
|
from lzma import compress, decompress
|
|
from argparse import ArgumentParser
|
|
from colorlog import StreamHandler, ColoredFormatter
|
|
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
|
|
from cryptography.hazmat.primitives import padding
|
|
from cryptography.hazmat.backends import default_backend
|
|
from base64 import urlsafe_b64encode, urlsafe_b64decode
|
|
|
|
log_format = "%(asctime)s [%(levelname)s] [%(module)s.%(funcName)s] %(message)s"
|
|
handler = StreamHandler()
|
|
handler.setFormatter(ColoredFormatter(log_format))
|
|
handler.setLevel(INFO)
|
|
file_handler = FileHandler("rose-obf.log", encoding="utf-8")
|
|
file_handler.setLevel(DEBUG)
|
|
file_formatter = Formatter(log_format)
|
|
file_handler.setFormatter(file_formatter)
|
|
root_logger = getLogger()
|
|
root_logger.addHandler(handler)
|
|
root_logger.addHandler(file_handler)
|
|
root_logger.setLevel(DEBUG)
|
|
|
|
|
|
def generate_key(length=16):
|
|
characters = ascii_letters + punctuation
|
|
key = "".join(choice(characters) for _ in range(length))
|
|
return key
|
|
|
|
|
|
def generate_random_string(length):
|
|
characters = ascii_uppercase + digits
|
|
return "".join(choice(characters) for _ in range(length))
|
|
|
|
|
|
def getCustom():
|
|
dec = choice([1, 2, 3])
|
|
|
|
if dec == 1:
|
|
return generate_pattern1()
|
|
elif dec == 2:
|
|
return generate_pattern2()
|
|
elif dec == 3:
|
|
return generate_pattern3()
|
|
|
|
|
|
def generate_pattern1():
|
|
return "__" + "".join(choice("O0") for _ in range(10))
|
|
|
|
|
|
def generate_pattern2():
|
|
return "__" + "".join(choice("0123456789") for _ in range(10)) + "__"
|
|
|
|
|
|
def generate_pattern3():
|
|
return "".join(choice("Il") for _ in range(15)) + "I"
|
|
|
|
|
|
def encryptData(text, key):
|
|
cipher = Cipher(algorithms.AES(key), modes.ECB(), backend=default_backend())
|
|
encryptor = cipher.encryptor()
|
|
|
|
padder = padding.PKCS7(128).padder()
|
|
padded_data = padder.update(text.encode()) + padder.finalize()
|
|
|
|
ciphertext = encryptor.update(padded_data) + encryptor.finalize()
|
|
return urlsafe_b64encode(ciphertext).decode()
|
|
|
|
|
|
def decryptData(ciphertext, key):
|
|
cipher = Cipher(algorithms.AES(key), modes.ECB(), backend=default_backend())
|
|
decryptor = cipher.decryptor()
|
|
|
|
decrypted_data = (
|
|
decryptor.update(urlsafe_b64decode(ciphertext)) + decryptor.finalize()
|
|
)
|
|
|
|
unpadder = padding.PKCS7(128).unpadder()
|
|
unpadded_data = unpadder.update(decrypted_data) + unpadder.finalize()
|
|
|
|
return unpadded_data.decode()
|
|
|
|
|
|
def process_node(node, name_dict):
|
|
if isinstance(node, Name) and node.id in name_dict:
|
|
node.id = name_dict[node.id]
|
|
|
|
|
|
def obfuscate_code(input_file):
|
|
with open(input_file, "r", encoding="utf-8", errors="ignore") as f:
|
|
content = f.read()
|
|
|
|
content = sub(r"\n\s*\n", "\n", content)
|
|
|
|
tree = parse(content)
|
|
|
|
name_dict = {}
|
|
|
|
root_logger.info(
|
|
"Renaming Classes, Functions, Arguments, Keyword Arguments and Variables..."
|
|
)
|
|
for node in walk(tree):
|
|
if isinstance(node, (FunctionDef, AsyncFunctionDef)):
|
|
old_name = node.name
|
|
new_name = getCustom()
|
|
root_logger.debug(
|
|
f"Function Name: {old_name} ---> New Function Name: {new_name}"
|
|
)
|
|
name_dict[old_name] = new_name
|
|
node.name = new_name
|
|
|
|
for arg in node.args.args:
|
|
old_arg_name = arg.arg
|
|
new_arg_name = getCustom()
|
|
root_logger.debug(
|
|
f"Argument Name: {old_arg_name} ---> New Argument Name: {new_arg_name}"
|
|
)
|
|
name_dict[old_arg_name] = new_arg_name
|
|
arg.arg = new_arg_name
|
|
|
|
for keyword in node.args.kwonlyargs:
|
|
old_kwarg_name = keyword.arg
|
|
new_kwarg_name = getCustom()
|
|
root_logger.debug(
|
|
f"Keyword Argument Name: {old_kwarg_name} ---> New Keyword Argument Name: {new_kwarg_name}"
|
|
)
|
|
name_dict[old_kwarg_name] = new_kwarg_name
|
|
keyword.arg = new_kwarg_name
|
|
|
|
elif isinstance(node, ClassDef):
|
|
old_name = node.name
|
|
new_name = getCustom()
|
|
root_logger.debug(f"Class Name: {old_name} ---> New Class Name: {new_name}")
|
|
name_dict[old_name] = new_name
|
|
node.name = new_name
|
|
|
|
for node in walk(tree):
|
|
if isinstance(node, Assign):
|
|
for target in node.targets:
|
|
if isinstance(target, Name):
|
|
old_var_name = target.id
|
|
new_var_name = getCustom()
|
|
root_logger.debug(
|
|
f"Variable Name: {old_var_name} ---> New Variable Name: {new_var_name}"
|
|
)
|
|
name_dict[old_var_name] = new_var_name
|
|
target.id = new_var_name
|
|
|
|
process_node(node, name_dict)
|
|
root_logger.info(
|
|
"Renaming of classes, functions, arguments, keyword arguments and variables done."
|
|
)
|
|
|
|
return unparse(tree)
|
|
|
|
|
|
key = [ord(char) for char in generate_key()]
|
|
decryptionFun = getCustom()
|
|
ciphertextParam = getCustom()
|
|
base64decodeVar = getCustom()
|
|
lzmadecompressVar = getCustom()
|
|
keyVar = getCustom()
|
|
cipherVar = getCustom()
|
|
decryptorVar = getCustom()
|
|
decrypted_textVar = getCustom()
|
|
unpadderVar = getCustom()
|
|
unpadded_dataVar = getCustom()
|
|
|
|
|
|
def replace_string(match):
|
|
s = match.group(1)
|
|
encrypted_string = encryptData(s, bytes(key))
|
|
encrypted_string = encrypted_string.replace("'", r"\'")
|
|
chr_format = "+".join([f"chr({ord(char)})" for char in repr(encrypted_string)])
|
|
b_format = [ord(char) for char in encrypted_string]
|
|
stage_1 = f"{decryptionFun}(eval({base64decodeVar}({urlsafe_b64encode(f'bytes({b_format})'.encode('utf-8'))})).decode(\"utf-8\"))"
|
|
stringified_stage_1 = str(urlsafe_b64encode(stage_1.encode("utf-8")))
|
|
stage_2 = f'eval({base64decodeVar}({stringified_stage_1}).decode("utf-8"))[1:-1]'
|
|
decrypted_string = decryptData(encrypted_string, bytes(key))
|
|
root_logger.debug(
|
|
f"String: {s} ---> Encrypted String: {encrypted_string} ---> Char Encrypted String: {chr_format} ---> Bytes Encrypted String: {b_format} ---> Evalized encoded string: {stage_2} ---> Aes Decrypted String: {decrypted_string}"
|
|
)
|
|
return stage_2
|
|
|
|
|
|
def obfuscate_strings(content):
|
|
root_logger.info("Encrypting strings...")
|
|
data = sub(r"(\'[^\']*\'|\"[^\"]*\")", replace_string, content)
|
|
root_logger.info("Encryption of strings done.")
|
|
return data
|
|
|
|
|
|
def main(input_file, output_file):
|
|
root_logger.debug("Entered main function.")
|
|
content = obfuscate_code(input_file)
|
|
|
|
with open(output_file, "w") as f:
|
|
data = "".join(
|
|
[
|
|
"from cryptography.hazmat.primitives.ciphers import Cipher,algorithms,modes\n",
|
|
"from cryptography.hazmat.primitives import padding\n",
|
|
"from cryptography.hazmat.backends import default_backend\n",
|
|
f"def {decryptionFun}({ciphertextParam}):\n",
|
|
f" {keyVar}=bytes({key})\n"
|
|
f" {cipherVar}=Cipher(algorithms.AES({keyVar}),modes.ECB(),backend=default_backend())\n",
|
|
f" {decryptorVar}={cipherVar}.decryptor()\n",
|
|
f" {decrypted_textVar}={decryptorVar}.update({base64decodeVar}({ciphertextParam}))+{decryptorVar}.finalize()\n",
|
|
f" {unpadderVar}=padding.PKCS7(128).unpadder()\n",
|
|
f" {unpadded_dataVar}={unpadderVar}.update({decrypted_textVar}) + {unpadderVar}.finalize()\n",
|
|
f" return {unpadded_dataVar}.decode()\n\n",
|
|
obfuscate_strings(content),
|
|
]
|
|
)
|
|
|
|
compressed_data = compress(
|
|
f'str({base64decodeVar}({urlsafe_b64encode(str(data).encode("utf-8"))}).decode("utf-8"))'.encode(
|
|
"utf-8"
|
|
)
|
|
)
|
|
data = f"from base64 import urlsafe_b64decode as {base64decodeVar};from lzma import decompress as {lzmadecompressVar};exec(eval({lzmadecompressVar}({compressed_data})))"
|
|
data = (
|
|
"""# Obfuscated with Rose\n# github.com/rose-dll\n\n# ^..^ /\n# /_/\_____/\n# /\ /\\\n# / \ / \\\n\n"""
|
|
+ data
|
|
)
|
|
f.write(data)
|
|
|
|
|
|
if __name__ == "rose_obfuscator":
|
|
parser = ArgumentParser(
|
|
description="Obfuscate Python code efficiently with Rose-obf."
|
|
)
|
|
parser.add_argument(
|
|
"-i",
|
|
"--input",
|
|
help="Input file name (required, .py)",
|
|
dest="in_file",
|
|
metavar="<input_file>",
|
|
required=True,
|
|
)
|
|
parser.add_argument(
|
|
"-o",
|
|
"--output",
|
|
help="Output file name",
|
|
dest="out_file",
|
|
metavar="<output_file>",
|
|
required=False,
|
|
)
|
|
args = parser.parse_args()
|
|
|
|
input_file = args.in_file
|
|
output_file = (
|
|
path.join(getcwd(), f"obf-{generate_random_string(10)}.py")
|
|
if args.out_file is None
|
|
else args.out_file
|
|
)
|
|
|
|
if input_file.endswith(".py"):
|
|
try:
|
|
root_logger.info(f"{input_file} ---> {output_file}...")
|
|
root_logger.debug("Entering main function.")
|
|
main(input_file, output_file)
|
|
root_logger.info(f"Done. {input_file} ---> {output_file}")
|
|
except Exception as e:
|
|
root_logger.error(f"Error: {e}")
|
|
else:
|
|
root_logger.error(
|
|
"Invalid Python file entered. Please make sure the file has a .py extension."
|
|
)
|