
AST-level Python obfuscation engine with AES-256 encryption, runtime payload protection, and control-flow flattening for security research and defensive analysis.
ObfuXtreme is an advanced Python obfuscation engine focused on structural obfuscation, AST-level transformations, and runtime payload protection.
It is designed for security research, defensive analysis, and reverse-engineering studies — not for malicious use.
✔ Produces heavily obfuscated Python code
✔ Breaks static analysis and signature-based detection
✔ Uses safe AST transformations (no bytecode patching)
✔ Runtime loader with encrypted payload execution
Use responsibly and ethically.
ObfuXtreme is a Proof-of-Concept (PoC) project intended strictly for:
The authors take no responsibility for misuse.
By using this project, you accept full responsibility for how it is used.
ObfuXtreme automatically locks the output to the Python version used during obfuscation.
Example:
Build with Python 3.12 → output runs only on Python 3.12
This is intentional and prevents:
If you change Python versions, rebuild the script.
Install dependency:
pip install pycryptodome
The obfuscated output also requires
pycryptodomeunless packaged with PyInstaller.
git clone https://github.com/spyboy-productions/ObfuXtreme.git
cd ObfuXtreme
pip install -r requirements.txt
python ObfuXtreme.py your_script.py
or
python ObfuXtreme.py your_script.py obfuscated.py
obfuscated.py
python obfuscated.py
Without ObfuXtreme
With ObfuXtreme
These results demonstrate structural obfuscation effectiveness for research and analysis only.
.exe (No Python Required)If you want to distribute without requiring Python or pycryptodome:
pip install pyinstaller
pyinstaller --onefile --noconsole obfuscated.py
This bundles:
“ObfuXtreme already obfuscates the code, so why does the OS matter?”
Because obfuscation and packaging are two different steps:
ObfuXtreme outputs Python code
The obfuscated .py file is cross-platform
It still requires Python + pycryptodome
PyInstaller produces native binaries
Native binaries are OS-specific
Obfuscation ≠ packaging
.py file is portable| Feature | Status | Notes |
|---|
| AES-256-CBC Encryption | ✅ | Encrypts payload, strings, and bytes |
| Per-String Random IV | ✅ | Prevents frequency & pattern analysis |
| XOR-Split Key Storage | ✅ | AES key and IV split into multiple XOR parts |
| AST-Level Obfuscation | ✅ | Safe transformations using Python ast |
| Local Variable Renaming | ✅ | Arguments, globals, nonlocals preserved |
| Safe Control-Flow Flattening | ✅ | Only applied to simple, linear functions |
| Encrypted Runtime Loader | ✅ | Payload decrypted & executed at runtime |
| Auto-Rebuild per Python Version | ✅ | Build version enforced at runtime |
| Cross-Platform | ✅ | Windows, Linux, macOS |
| Clean Failure Handling | ✅ | Clear errors instead of crashes |
| VT-Friendly (Research) | ⚠️ | Structural obfuscation only |