How to secure an offline Python app?

[aranvir]

Hi, I recently started to look into licensing models in general and specifically for Python applications. I'm comfortable with Python, but have not yet dealt with releasing anything that might need licensing protection so my question could be a bit naive.

I looked at the different guides of keygen and the principle is very clear. However, I feel like securing a Python application with a license only works if there is an online component that the app needs to function, right? Because for an offline/air-gapped system, what would stop the customer from peeking into the code and just replacing the validation code with a return True line (or something like this).

My thoughts went then to shipping compiled Python code, but that can be uncompiled. So, I guess it's still the same arms race between attacker and defender and that anything can be cracked given enough time. I just wanted to double check if I understand the problem correctly and what techniques are out there to make it difficult for the attacker. What I've gathered so far:

• Checksum verification (from your guide)
• Clock tampering (from your guide)
• Compiling to .pyc or similar
• Code obfuscation

[ezekg]

You have the general idea, and it sounds like you've already read all the information we've shared i.r.t. cracking so I won't link them. You can't 100% protect your application from cracking (because after all, it's just 1s and 0s on the end-user's computer, which can always be modified), but with the things you listed above, a lot of the low-effort cracks and licensing bypasses can be diminished.

[HanShijia999]

Hi,
I would suggest to compile to .pyd with Cython than .pyc .
There may be better options, but .pyc is a bad idea. One can easily retrieve the source code from .pyc

[aranvir]

Thanks for the tip! Also saw that nuitka might be an option for compiling to standalone executables.

[HanShijia999]

Yes. Nuitka sounds like a good idea.
It has known bugs with PyQt5 and that was why we didn't go deeper with that solution.
But for licensing issues, we latter changed to Pyside2. And you just remind me this option!