Variable & Function Renaming: Python Obfuscation's First Layer

Your variable and function names are for humans — the interpreter throws them away when it runs. total, label, classify: those words carry all the meaning a reader uses to understand the code, but Python only needs *consistent* names, not *meaningful* ones. Renaming exploits that: it walks the AST and swaps every identifier you defined for a unique, meaningless token, keeping references consistent so the program still works.

def classify(n):
    if n < 0:
        label = "negative"
    else:
        label = "positive"
    total = 0
    for i in range(n):
        total += i
    return label, total

print(classify(5))

With only the Rename layer on, the obfuscator produces this — classify becomes lIlllIllllIIlllIlll, label becomes IllllIIIIIllIlIlIIl, and so on, consistently everywhere they're used:

def lIlllIllllIIlllIlll(n):
    if n < 0:
        IllllIIIIIllIlIlIIl = 'negative'
    else:
        IllllIIIIIllIlIlIIl = 'positive'
    lIIIIIllIIllIIIIIlIIllIl = 0
    for lIllllIIllIlllIllllIIIII in range(n):
        lIIIIIllIIllIIIIIlIIllIl += lIllllIIllIlllIllllIIIII
    return (IllllIIIIIllIlIlIIl, lIIIIIllIIllIIIIIlIIllIl)
print(lIlllIllllIIlllIlll(5))

This is the key property most people miss: the original names are destroyed, not encoded. There's no key, no lookup table shipped with the code — total is simply *gone*. Decompilers like uncompyle6 or pycdc can rebuild structure and even re-indent, but they can only invent generic names (var_1, a, b); they can never recover total or classify, because that information doesn't exist in the compiled program anymore. String encryption can be run backwards; renaming can't.

For real code with descriptive names — validate_license, decrypt_payload, api_secret — that loss is significant. Half of reading unfamiliar code is reading the names; strip them and the reader is flying blind.

Renaming removes one clue — names — but leaves everything else in plain sight. Look again at the output: the strings 'positive'/'negative' are readable, the structure (if/for/return) is intact, and the logic is followable. An analyst can still see *what* the code does; they just can't lean on the names to do it faster.