ObfuXtreme is an advanced Python obfuscation engine focused on structural obfuscation, AST-level transformations, and runtime payload protection.
It is designed for security research, defensive analysis, and reverse-engineering studies — not for malicious use.
✔ Produces heavily obfuscated Python code
✔ Breaks static analysis and signature-based detection
✔ Uses safe AST transformations (no bytecode patching)
✔ Runtime loader with encrypted payload execution
Use responsibly and ethically.
ObfuXtreme is a Proof-of-Concept (PoC) project intended strictly for:
- education
- research
- defensive cybersecurity testing
- malware obfuscation
- bypassing security products
- evading detection for malicious purposes
- any illegal or unethical activity
The authors take no responsibility for misuse.
By using this project, you accept full responsibility for how it is used.
| Feature | Status | Notes |
|---|---|---|
| AES-256-CBC Encryption | ✅ | Encrypts payload, strings, and bytes |
| Per-String Random IV | ✅ | Prevents frequency & pattern analysis |
| XOR-Split Key Storage | ✅ | AES key and IV split into multiple XOR parts |
| AST-Level Obfuscation | ✅ | Safe transformations using Python ast |
| Local Variable Renaming | ✅ | Arguments, globals, nonlocals preserved |
| Safe Control-Flow Flattening | ✅ | Only applied to simple, linear functions |
| Encrypted Runtime Loader | ✅ | Payload decrypted & executed at runtime |
| Auto-Rebuild per Python Version | ✅ | Build version enforced at runtime |
| Cross-Platform | ✅ | Windows, Linux, macOS |
| Clean Failure Handling | ✅ | Clear errors instead of crashes |
| VT-Friendly (Research) | Structural obfuscation only |
ObfuXtreme automatically locks the output to the Python version used during obfuscation.
Example:
Build with Python 3.12 → output runs only on Python 3.12
This is intentional and prevents:
- marshal incompatibility
- silent crashes
- undefined behavior
If you change Python versions, rebuild the script.
- Python 3.10+
- pycryptodome
Install dependency:
pip install pycryptodomeThe obfuscated output also requires
pycryptodomeunless packaged with PyInstaller.
git clone https://github.com/spyboy-productions/ObfuXtreme.git
cd ObfuXtreme
pip install -r requirements.txtpython ObfuXtreme.py your_script.pyor
python ObfuXtreme.py your_script.py obfuscated.pyobfuscated.py
python obfuscated.pyThese results demonstrate structural obfuscation effectiveness for research and analysis only.
If you want to distribute without requiring Python or pycryptodome:
pip install pyinstaller
pyinstaller --onefile --noconsole obfuscated.pyThis bundles:
- Python runtime
- Crypto dependencies
- Obfuscated payload
“ObfuXtreme already obfuscates the code, so why does the OS matter?”
Because obfuscation and packaging are two different steps:
ObfuXtreme outputs Python code
The obfuscated .py file is cross-platform
It still requires Python + pycryptodome
PyInstaller produces native binaries
Native binaries are OS-specific
Obfuscation ≠ packaging
- ✔ ObfuXtreme can be run on any OS
- ✔ The obfuscated
.pyfile is portable - ✔ PyInstaller must run on macOS to produce macOS binaries
- ✔ This is standard behavior for all Python packagers (PyInstaller, Nuitka, etc.)
- Optional metamorphic transformations
- Junk code intensity levels
- Machine-bound execution
- Password-protected loader
- Optional marshal-free mode
- CI multi-Python build support



