Metadata-Version: 2.4
Name: pyraph
Version: 1.1.1
Summary: Pyraph - The Luraph of Python. Extreme Python obfuscation with custom VM virtualization and native compilation.
Author: AchillesHubTeam
License: Proprietary
Requires-Python: >=3.9
Description-Content-Type: text/markdown

# Pyraph

**The Luraph of Python.** Extreme Python obfuscation engine with custom VM virtualization, multi-layer encryption, and native compilation.

## Installation

```bash
pip install pyraph
```

## Usage

### Protect a single .py file (outputs obfuscated .py)

```bash
pyraph app.py
pyraph app.py -o protected.py --vm-layers 3
pyraph app.py --one-liner
```

### Protect a folder → native binary (.exe / ELF)

```bash
pyraph ./my_project -o ./dist
```

### Options

| Flag | Description |
|------|-------------|
| `-o, --output` | Output path |
| `--vm-layers N` | Number of VM virtualization layers (default: 3) |
| `--one-liner` | Compress output into a single line |
| `--no-anti-debug` | Disable anti-debug protections |
| `--no-integrity` | Disable integrity checks |

## How It Works

Pyraph applies multiple protection layers that make reverse engineering extremely difficult:

### .py Mode (single file)

1. **MultiVirtual Engine** — Code is fragmented into N micro-chunks. Each chunk is compiled to bytecode, marshalled, then encrypted with its own unique VM opcode table. Fake decoy chunks are mixed in.
2. **Multi-round Encryption** — Each fragment is encrypted with 3 rounds of SHA256-derived XOR keys, bound to an irremovable watermark.
3. **Polymorphic Output** — Every protection run generates completely different output: different variable names, different opcode mappings, different keys, different structure. No two outputs are alike.
4. **Anti-Debug** — Continuous watchdog thread monitoring `sys.settrace`/`sys.getprofile`, import hooking blocker, `prctl(PR_SET_DUMPABLE, 0)` on Linux, `SetProcessMitigationPolicy` on Windows.
5. **Anti-Dump** — GC disabled during execution, code object metadata stripped, `marshal.loads` called via C API (`ctypes.pythonapi.PyMarshal_ReadObjectFromString`) to bypass Python-level hooks.
6. **Junk Code Injection** — Realistic-looking fake decrypt functions, hash checks, XOR loops, and dispatch tables that are indistinguishable from real protection logic.

### Native Mode (folder → executable)

1. **Cython/C Compilation** — All .py files compiled to C with encrypted source embedding.
2. **Anti-Trace** — `sys.settrace(None)` called at C level immediately after `Py_Initialize()`, `PYTHONPATH` nuked to prevent `sitecustomize.py` injection.
3. **Anti-Ptrace** — `ptrace(PTRACE_TRACEME)`, `prctl(PR_SET_DUMPABLE, 0)`, TracerPid checking, timing checks.
4. **String Obfuscation** — All sensitive strings in the binary are assembled from char arrays at runtime, invisible to `strings` command.
5. **C-level Mutation** — Junk code injected into compiled C functions.
6. **Memory Wipe** — Source decrypted in memory → executed → `memset(0)` → freed.

## Output Example

**Input** (readable Python):
```python
def hello(name):
    return f"Hello, {name}!"
print(hello("World"))
```

**Output** (protected):
```python
_zh26851=434662881;_eu51007=1816782498;_chk38310=1260696835;_ztrh38420=1580385636;exec(__import__('zlib').decompress(__import__('base64').b85decode('c-pO6d4J+K(*8f60u~5%fQ;{BxWW-2B-~d>{~F^9Fc{nT2sfYomBA2_bob8gzRYxxrBYR?RC-iZMwuJBY5OL;HBlA8$6G$mSev{t;U+g6g&;VKCpk_zQgIv<7I;ghh%kIFFr*}lx+FtkZnjP*%fc%2+>1NfP|t?p8;&Ls45gC7+Lo>Rk*Uuo@(K#`^hgkSnj%D$4#Sb-DD;EGqdt@*qdta?`Y`u_K|q5<L5s$Iy4)B9C6E(0$kXcwr~Djva@@9Wq?<lY@hO_m<h8L3sj_yag<<$cl2xDg81<&za5zenG@HCE`rexG7)e2%MEG7(#<FEY@QpI^9T}cx!2TqT{e5j2-2ztO<dtGWs3+{qH0p7SdXsN%Zcg)j*4jGS9DJX<^iz+1>98lJ%u9+kKK9#_bH8Y>4f#YY+BZPr$Xy;vF*F4Ked7Zkpt8&P-cWfP7-#NFCVigCQG|)22pL6D1pK3;D2Dt5i#_eAH{Jc%=KABo{cyldL|@XCd7sO_yg*+VvP_g^qXY%Gy4+E>NfKAQqdv!yIoUKdJ=r!L8UD`x-Y`X5g@~vR`TZzLuq;W^7*O7aevrv4Q8sKJRBJt&rfx=k8QV4$!LjAzGyHiq25(u%4q5$^u~7D6EZ~&nKQ+}1$2?0d6-`pr`<ZNNvWjD$$u#>jm1cv#-#Fd3WV^%z0{KaE_2X?t2kz*O6lFW-n5L}RbyF8*%W|!Zf&V{SPgKEbeO$d+%W;*b_ERy_eyUX=S8~fX9np47`HOvy!bgg%N)`u{`~m%|pz>quU(ut!BIl^OHimzGR@Tr}cR^p}z~89ukIVoqvO<5kUT--S#a710_11M&5!VoQk}s@Hc?7wf;8TaCY-HW*fxjC0zG?%OSH?RV>-&m-XVh<$K=IM{-YeZctOOzOFBlM?dj7E+M}1vhb$;*CCo~{QmZjLUj~>0-k^vuHl%cAwc}MTuZ<zW>QLjhNM`C=Q1p5@rr|GuOrTGvG!0H3}zDzuG{ZFU<e`3~Bu_r#=0O&mm{{<8h|Ju58UF{SJg7<%gBbSrzvZtafef&B~LCH_(6*j~05p+l2kIL}|QWZ^hFQH!%oLA`5+*>wp+Lo)_8AKTZh$CF-tcy74@d@08$5kT$e3&a$;9s-%L@1gKd14F|m^b`)82*9&1VT;40F!-waO{51;g@^!OUHbw{SjC>Nf?6@z6~3a5RQhG)0eT9<aY@)Bw29A#u~ItZ^Su%3CF*ZVu8PoChBuzt;*DKg7<)j_ZNq8W!(CJ4?{=and_3Hg0N#IudPpZ`tEJs6??f!Z6oRv97VMi?bIPCH<z8&+--%z@=6wgCaxa9vq9@43;++VpMfvnTs$~6pk;ZjD?NbD?om)IAjRf2aI!pd2*`_a8XN_R+-FaE6u|mjxM~9>zgYR(dfX0Kdsj?dyEk;>;#WwNVWYsiXe>&zQJQg`iXu-vpS=4D7Cu=0_$?cXIr9U4N=F&ckGpM(jZ&0H?6zr_3=mW7m9(G0FT!Zp11l5<|6!NV#oHKVE+3zl6JTne8!ud)b1-;ssj_T9$UTC8_~`GD?$2oVpCI0EkH<epzJJT&e?Y)rqTv5G68;GYKfv%$NO(cR{}~E>ATaVE?>BhoPyRP(_knodC!a1_FQ}qXhM_R;q7_tKoXOG=_D&Es=S`4Us4f6%mLZGwA7ITzM^SPS#x;ezK+s&B_~^oP?B*06_PGaV1cFBHgm{o8tD~q-<L7b|sAo@-NALcOJ7Cb=6PNV<tm)^)nKFn3PZSp^s?PsH$`xyqS1j50bUe1l3*o$x00)k43sQmOPSU5{M6Nv-zPY)iE;pC3<>u%?!u*7~Cj<N^=JRZJWyOp6u0x{pZQ<f2kaotv>#-k4=`LQmV_$~ODt#FSfX=yla1X|1(}qAs>v@U0UXaJ#w~vV(1Y94SzoZ9%QHhu5x^_y9PUiyh(#exuqMoIqKv!TkM<rPXCBG)x5=+S=L_!H36%j#TFd88xR>E;o5-?=MxGB0Z9!WGsvFN7^-zx=xWEOZV2@v@#;v*OS@i&hB1k0RBEXy)f5*)mvWX{XaFN}Zu&HRjp!Ev;~J?X8&;}-p(ie5O~aHGk1PT&YdB*P{>?xo@Oj(+F{Y`pupALX+e%#G0EhDMgk<H5Y^p$z_7wsov6cJ|Jqk&lN`a<}6corefC%%;L%k(Q(|I6^T0u8i>^8koje$~eKWWYTix&<79r7FiX*=d_Z`gy;vw=`NGC6~nsT%qbg+pb$`S&<%<}0q-+Jm^4FR*m2u<)8yCC=M6kh^wOB)Ntin0H4Um4%$E{}$Lmv|<MsXcnDle-#YZkGT@i&)>XgiR7~pN_S;7q`X<(yhI{C50FoKaX!-^t`Nf;uHNJhjFoE8vVWLbG6Fd`vi;OyZjL$icLVuVaHBc4VHRAhl?in4^0;s^!)aWWoD0aeH^fxzdOEcz*6yA)AQrWH+)E{eRHgZ>E1??=@AFGIGUSFxXmn-}(1#vW-v)<*;vJyBl=Q|FrwP=a9K7lFWU3rW8Z83D7X?;pmAe`F6>yY>XJ^BL4GA&aDlS2y3E*#vxf86d6g@^kI|muGEITzr>(f-GykB>-PTmd;WE)OaSlcPD_{isL*IurII=*!_ycWA~NnKUU8@?LKf5xNV!C8?x!v*4`D~H!^uI+`P^UPF^)~OBx_T0NZ>dgOH2yzU|BXh;xNRPxJ3{p#5c2ey{4q{ZANkdIC5<b>8QoMoNA|dVYk85-y^WNKy<gGC06}nx@DRC7>8F8o5YsIo=iUZ;<{X<Qvv6H2}{f@(t=QoPP!N7k1GPy6BnJxnfDs1jBqe?dKZk*Q3pAyt=j&i+cz0)bV^*GB3SM^O4I`GcWztQwtp4R;HTI)?Ps?*U3HCYM_znv}=`2`!WAPcXhPikLUUm?@u9<N1&h6p|3Ig?~j4$XqxL>jwZ<_aJ+Zf<j3+~hHE>JLj#WnS3QWYbO9VeS)6Ff!uhDZgwGSgNBNi2>7I-5iN}|b56#@*)YT=Us`~P{OjRBO-~yE|+2_s#YPp%N4I;a-r+025i?buG<yeLyD!OB-Yo9f7x8x+jrz)=E76`WmeRa|Fcnw{lN5Y39*ID<Kd!P5)E5{$7ZaiPWFcQPRrhpe0h>pc$V=SKStXRANbSmb2w(c`b`5hGN&L{gA=Yb>$V2^3>r*bNo3jF#w2|9094U8`Vq|0D?I5%HA0zKFjURAH5!g6Iy6!+Ow#)|ggK4AQ~3xGKQ2hJmhK8M{G90SAdJ#-NjKIJaq#OY;0>bRpIY5AxKe47yshv9#c>>V{r9>4BQ8Kjc{oUZsJ!--V*SE-H<a?$Ek-uYwo{8OPP;H!H(V9KInTHq#%xnY(BR>K3ok{kfv+W4c$=UVGRsw#8fAh0jxBN61<caF*W7c!7MAm{ySf@m3BFWeDvInKw6ZmrhmVw7*>-H4WJQ{4f6ErP55;tIeDCr`LI-pMIXPXKf6@k+rNjHIu^Gz`=kxP>fYAP6Uu0AWvAiXkse3S|-YBQ^t+Ua)uJ^W%f=XY#^j0DW}dQKuO5hSMi1NCznP{L<^f#MAQf9KA4#UM7Jgief=vmJEwA4Xw2jJ60x#xox6RsU<2j)7rQ2^jL4NT6g*)r^<oiBw4{$`Rs0IB*i_cr@GnfeqN!Mv>ty$W@+s<5ge!H`*!igt~=78l1T=*0rE;<gU}cgiv}@??@6q1Sj;P$jPXzA@Q!8mg82UMnubah<0;pY964L7K%vN!GA!XedRoKU$vT=35zB-Bd9YL~dOsT|@4I+>g;{he|3JXyPI}Yqu7|t8@=i-n%AI%u?I|&(P|T<!%~B8R<Z3>&L{S?otfvSk)f^%?>(LI>w_zlmo4=P*caf)hz~AkU()nItRVJ&GjS-Qb@(DjuAUQFWN|zBXPgK?+C9$t|)t7B?6Vi5TgQ!T7K0WlH!D3T?kK|Svv_p@plWIrVn^S`0jji?C;4D2jELII<T6iBt%<YO&4$5l;3iSM43r`mx?`~JYhgTGvG+->2sdQJ4Ql(<C;;LNO75Q#K-j<)A3kf-%lbJ;*RAmde4jDD@j&fSBclX_VC{gBY!Fr+mkr@RGb1YZsyzQC6e72F(cX4e6y(XTKBDNjnpZB2=A56BI8>KyqJX=pw9ersd*1Ap1l54)t_be?r>97exd}-dU=4`A{o97<lwTEgE8S9+^iiet7Xpo-llTsVohZqu9XzJy;>$e!=7N5)u+mf)jqjT`MYe<>&+{ASdQ*_IjLEM@wxd(EwV{!vhy4zD?10-NL4#E;N8D4~@6-<9^&*M{hnm>T(B_+Nt;MjAg)Yx*Pw10}NUKZjC>u@dBdGDdC03&R(?JAjiuFHtcXz!9Zisi9+DBWS&tHL&*m6C-{Sy7UaVRyQH9OrS%YWjB%@p)&QC{IdaCNEAkCxTc@4sFePcp(!HZ4=xhQo@?$@*CZ;4%w+aYL1>lX*A@tW}zwmmhD+`fAQAgtoO%5xjeYVv4*hG?LNGvkzKruH}A4^Hm<&~iMQEmnCfA5X`6U^o9ih*m3_*B#8R2}9^mv7%Ang+Kk|@jY^hbEh^OE!U+q&bQjLJjWj`jAB^y^tS+%x~J+w1c`srmKgw_vsyCObJ(?lpq?I%2kBhP+4fXA}x$Y!y3xif3#uyK%uO0D{%n(_zm%6#(<rIQC4PMN}5xgFJu5Y?^+AP4D=Bw?e?TXL&iwRTvnoW-}cD4J54%2!t_X!9I+F65wcDYz&l1-+H;kyCZl-#_Z<@newNq=O1p-KO7z*mBgc9P!~G6#D_Vw4Rj`nF53kn{242&+Nd<+iivxBBcP=M;9+Jl)h~k)zTscL+W%&M)vik_NrjF=osl*^V<PD&!yg;iPbx!%hL06=;=}Nqb!9Ak(aI9idCzTfjoc7sgiDGG<&nNoycv&Z<Z4l+|3ZlSbn{m%-YM4X*w1<ff^<~4JuIGMDV)97wAF!!5m}bz^sorah&Uh-M|{7Fgh77zS>!PUoV;+3gw+e(~zrDzd=c_RB1O_RV0od;oO20vq6&Ub!So~C)@@Uv=CZm-(d<?R|#of*Bcuafr8uTw_AcN>2~lrm`b#}F}9G?^Q7hQ9dtJ8nV4N+my%^-{T!OyWMFjy?-bboTEntzQHBaC*V``M);!$azaYU{ZT246v?3d#8j{)CoY>y>*3~RN$V}FVRVHfnx-fDQBmd!HIK+eIssaZP&gcv<LU>f$gxn3LB9ZmDgilhtGyyGIyHWYBwf0xJn$eyXNHLytoLt~xx=z$8k)7STOO}f*96%VKtL@7NPPeJxvSukn$J#t3X{{uNR@)_!-EG(d-)d%<8T7(~=wPz1W!e&?bc1h6>H&(`Z)@SUi==~deDU-EvE5+TX@qha{1EGD+5Ak&L!`5T(PFHt68NF;Ovn$r9`$Z$x&T$*2%#!f@D^s8)4^2V?-R?sQ03o^C!rL4YmWVL<2Ie?>H)hF=q`ojEaqR?`OR}`j8xK-;E=wprnSW`H7ogXviWT8U@WsQ+@+M<SiyP;CHLA`H~4i&GT;FFy65stw!KX*(9RGYIQ=^YPK;~JwrSu`!`J=3zv|CB{+#3lML94GI{pS;={)QjaO<(&P6a4@O@`QEX*e3@W(8uW$OL~dM=whMfIE%1Y=G8jakLrWL<bI);e%8(QgO1oeN002n%_l4a5EF2Vi)d^3n}67rt+ZV_=w#v)g?8>@(8ZnHdg)Mus5E@Wvb+?is&Z3ZtQ3Hi;%E7IdnP-4pHSj@wSEowv!xAYfLZ=DMMuX7Q40j-6gbKmX&yMC|a#?jg>lG8-3wY?c#0laZ!ADPl`2g@*BP4OL=*Km!)C3nV2kiDAU0ME2|gaoZ%8G6g8Wtf}CWQh~OmQe@$)6g;=hh*T);VM(g#YJ++?R7*5Zk$sn8ZV_7b{kdxzFp-8oODX#7EQZORjYTE!4f9c!~>im0d-MoX757|)Q5bVxOwRe}I;lrfSPp4m-8)35LW0Tis+K<lIhBJ$8`pF{gyuDTLc4fSldusbLDyFBH_#rJT?Krf4s&3W?x;=qlwY*y0qRaf7@ysJ)dc`1es~U?8TJcD`P#3ahZj}-q+T}Et>pE4jJa|eN$uuS%25hVjPhQJUq1fw7JO8{4><W+Vno0FCiEOTLJ5l&b_E8XC8-aKRi_H(SSobB~zN@hVwk*rzNCwW5$xLBEBpS<hx}?%ITjn}-NiP%<u{S=o=bFp;mTplB@mdkBnI;s9om~}4C1Nybt&C#e0f}M4LX|~I?pbd`Xj3%(cWf=W%@q4wy+vfq;XB5+q;{)M246${P$|-r=jeDpx|=no&XRU5qA~icpQCRbI5c%)3%+1D&+$$D`7s4Au$hu#YwdPuhYY5njU4ai3hveHCg)f(Jb8qP;IyKv!phuoYNuC$vYes^l;)UuqXMr8W+v2eyyy>38T|1*`}(ly>^pR`DEQY+b)PTj4BZkMo3~}M^U`}wi}O*bAACV-y~?W9>`^bd89eLN?AK>jPcT*!#FuD4fVYQ_k1>lV;*6H;i+%!bj^#`%HET_b)u1xlLb-I8;|pu-V5Ec;Bqt{hmCR?U{OusJw8+Gu+$>i}>sfNFxp}BAVdE|(wKlg;+u?SZnXzM@9voV^2QIrm#8b6m5f`QPyxVKon`z0B9+<aMwZKL2{x&|m<3htmQ!U&E3{}=k{E`-i{$~-s!?raR#>;VuS~hnjwUcGq*0ZwOWGd#1vuMYkU+Sv^Ip&&%)f!gFp1<?ZGWhK3;M9%&o(^Ju$!YG&^+Vi{_hg`O2MQ~RiY8J58yPCGRE>l;31Qq|voG^_vGQ7AZjDidY<5y|<vp@}(gF#3h-_w+Whv0ACrg!OJn$^~l~}hEnhiU5<KDbL=2yW?XcD57RbIg|)jAi<IQdkkMCIUJoVKtP%5M90E<$zU<eI51fB`DCwK%RyhFT>ThgU{~py@%^AK~4sw8ToaNI*+w-kO6U<Mc+i;%1*R*2Ou!p!GKSD!{$KOsP%$adngEJ_H_Pat7*!N>2UuZiqeETsIa-2&lfRl?LE)5q3}hWn)K$lyQF@*r)2fP?Cip4xtk<;no?N{_u@k|AVfJQ=3y|>hxmAbbo&H@9Oubj3?p+oDuK7k9cq!@w^?re(Q9sIw)g`q$wQYq>)IV$24m3P7@f*obxyEZq%j;%6rT5%X0mB?sdK1(Qq7;$iGzUFU&sG>o2`O&eOiv>(5$UNPbhT|BwL6hRPDmLBQLO^D@H-s1uUR2op#d$7q}<DS;8l5jvs>gpz2`jf$j%U<}2NXwt2kQxqcLBNjsm0VN4wG#S(w34X*-3`U8RTVdqqB1+KUUC<Uoh`-$eH+aRzdJPQq8q}$=zu`=S1#dT)BznWC>N}3pD0mBXX5v-`pfib=?w-e@=l<wr;^o(rptc3dOvfV8sd?I90>MDR;7eKQQcU_<V+4f(QC9&N+m{+qPch{0^`PUs^i$Qw2j1_3-}YJmYf(r9wF=wvN<zQ-b;uXO=<y9h)OG-9{gaB2TP``)flezqu0Wm}_WJi_oqzNe+^Zj|;A|Z21l}rx_b<mf`MG?a{8jP%^sA2Rp9dU^=f~;Rz3B40`q`k%#2pquIqAmRVNlo_gOa2SY;)RX&s|OrH~$B#usRq')).decode());_cc65078=2120128943;_grfh21537=1905868108;_vnn21679=2437401041
```

## Compatibility

- Python 3.9+
- Linux, macOS, Windows
- Native mode requires `gcc` and Python dev headers

## License

Proprietary. Closed source.
