Strong vs Weak Python Obfuscation: How to Tell the Difference

This is the fastest way to judge obfuscation strength. Take the loader and ask: *is there a single expression that gives the original code back?* For the classic "free obfuscator" output, there always is — because the transform is just encode → compress → reverse, and every one of those steps is trivially invertible.

_ = lambda __ : __import__('zlib').decompress(__import__('base64').b64decode(__[::-1]))
exec((_)(b'==AlD4HGAQg0…truncated…KMrwJe'))

The "attack" is just running the loader's own decode logic instead of exec()-ing the result — reverse the bytes, base64-decode, decompress:

import base64, zlib
source = zlib.decompress(base64.b64decode(blob[::-1]))
print(source.decode())

If you see any of these shapes, treat the code as encoded, not protected — it will decode straight back:

• `exec`/`eval` of a decode chain — exec(base64.b64decode(...)), exec(zlib.decompress(...)), exec(bytes.fromhex(...)). The payload is one decode away.
• A `lambda` loader — _ = lambda __: ...decompress(...b64decode(__[::-1])) then exec((_)(b'…')). Cosmetic; the lambda *is* the recipe to reverse it.
• `marshal.loads(...)` — exec(marshal.loads(b'…')). Not encryption either; it's a serialized code object you can unmarshal and decompile.
• Nested versions of the above — a loader whose payload is another loader. It looks scarier, but each layer peels the same way (more on that below).
• Your identifiers still present — if function and variable names survive anywhere readable, no real renaming happened.

There's a second, practical reason to avoid these: antivirus engines flag `exec(b64decode(...))` as a malware pattern. Real packers use exactly this shape, so shipping it can get your legitimate app quarantined — you inherit the downside of obfuscation with none of the protection.

Some obfuscators wrap the loader inside itself several times to look more impressive. It changes nothing about the strength — each layer is the same reversible transform, so you just peel them one at a time until you reach real code.

Strong obfuscation doesn't rely on a reversible wrapper. It transforms the *program itself* so that even after you strip away every outer layer, there's nothing readable to find. Concretely, that means several independent techniques stacked together:

• Identifier renaming — every function, class and variable becomes a meaningless name. The originals are discarded, so they can't be recovered (this is the one thing *no* deobfuscator gets back).
• String encryption — literals (including your secrets and messages) are replaced with keyed decode calls, so a plain-text search finds nothing.
• Integer encoding (MBA) — numeric constants become opaque mixed boolean-arithmetic expressions a static analyzer can't fold.
• Control-flow flattening — the straight-line logic is rewritten into a state machine, so the order of operations is no longer readable.
• Builtin / import / attribute hiding — even exec, __import__ and getattr are reached indirectly, so there's no literal exec( tell to grep for.
• A per-file, key-locked encryption layer — the payload is only decrypted at runtime with a key derived from the file, so it can't be pre-computed offline.

I ran the same script from Test 1 — the one with the API_KEY — through our Python Obfuscator and then grepped the output. Here's what survived:

You don't have to do this by hand. The Python Deobfuscator & strength checker does both jobs: paste (or upload) a snippet, and it either peels the weak loader and shows you the real source — decoding the payload in a sandbox without ever executing it — or it tells you the code is protected in depth and can't be trivially reversed. It's the quickest honest answer to "is this obfuscation any good?"

If a layer turns out to be a marshal blob or a compiled .pyc rather than source, hand it to the Marshal Decrypt tool or the .pyc decompiler. And if you're on the *other* side of this — you want protection that passes the one-line test — the advanced Python Obfuscator applies all of the layers above and returns standalone, runnable Python.