I'm developing a Windows desktop application in Python and currently use PyArmor to obfuscate and protect it. However, Windows Security and several antivirus products sometimes identify the protected build as malware, apparently because of the obfuscation and self-unpacking behavior. What practical options can reduce reverse engineering and unauthorized copying while minimizing false positives?
4 Answers
Digitally signing the installer and executable with a code-signing certificate can improve reputation and reduce warnings, although it does not guarantee that antivirus software will trust the file. Keep builds reproducible, avoid custom packers and unnecessary self-unpacking behavior, and submit any remaining detections to each vendor for review.
PyArmor and similar packers can resemble malware because they often encrypt or compress code and unpack it at runtime. You can submit false positives to the affected antivirus vendors, but there is no obfuscation method that guarantees clean results. Also, determined attackers can usually reverse engineer Python applications—and even compiled languages—so protection should focus on raising the effort rather than making the software impossible to crack.
If the most valuable logic can be moved to a server, keeping it behind an authenticated API is generally stronger than trying to hide it inside a distributed Python executable. For an offline app, use compilation or moderate obfuscation as a deterrent, but assume that anything shipped to a user's computer can eventually be inspected.
Nuitka is worth considering for packaging. It can compile the application and produce a Windows executable or standalone folder without relying on the same kind of runtime obfuscation used by PyArmor. A standalone folder build may be less suspicious than a self-extracting one-file package. It is mainly useful for deployment and making the source less immediately readable, not as serious anti-cracking protection.
I tried Nuitka, and it worked well for my use case.