Your Python code. Virtualized by design.
PyK7VM is a Python obfuscator and code protection tool via virtualization. Python source and bytecode are easy to inspect once shipped. PyK7VM moves protected logic through a custom VM, making source recovery a much harder reverse-engineering task.
From source to virtualized binary
Your .py file goes in. Five automated stages later, a native binary comes out. No Python bytecode, no source path, no eval loop for protected functions. The pipeline stages are: Python source, AST mutation (identifier renaming), custom bytecode compilation (64 randomized opcodes), C++ generation (native code emission), and output .pyd (native extension).
Works with your code
Protected functions are drop-in replacements. No rewrite, no API change, no new import.
- async / await coroutines
- Generators (yield, yield from, send(), throw(), close())
- Context managers (with, __enter__, __exit__)
- Closures and default arguments
- *args / **kwargs
- Full exception handling
- Python 3.11, 3.12, 3.13, and 3.13t (free-threaded)
- Windows x64 and Linux x64
Free-threaded Python 3.13t (no-GIL) is supported on Windows x64: concurrent VM exports, requires py -3.13t. Cython precompile is disabled; cold absorbers stay serialized. Not dump-proof.
Others patch Python. We replace the runtime.
Every existing solution still runs your logic through CPython's eval loop: open, hookable, well-documented. PyK7VM removes that path entirely.
Bundle tools pack your .pyc. We don't.
Tools that bundle Python into an executable often leave Python artifacts inside the package. Free unpackers can recover them quickly. PyK7VM removes that direct .pyc recovery path instead of hiding it in the bundle.
Obfuscators rename things. We replace the runtime.
Name-scrambling wrappers still expose behavior through Python's eval loop. Protected PyK7VM bytecode runs in a custom VM, forcing analysis below the normal Python tooling layer.
Native compilers still leak strings.
Translating Python to C or native code can still leave useful constants and control flow for a disassembler or strings dump. PyK7VM encrypts string constants with per-build keys and decrypts them only when needed.
Seven layers. Harder together.
Each layer removes a cheap shortcut. Stacked, they push attackers away from Python decompilers and into slower manual analysis.
- Code Renaming: Identifiers are rewritten and replaced with hashed representations before virtualization.
- Instruction shuffling: Standard bytecode is reordered and padded with junk operations to weaken simple pattern matching.
- Anti-Debug: Runtime integrity checks can halt execution when common debugger and tamper signals appear.
- Short-lived plaintext: Constants stay encrypted at rest and are cleared after runtime use to reduce easy memory and strings recovery.
- Unique VM signatures: Every binary gets build-specific VM details, reducing how reusable analysis from one build is against the next.
- Native-speed hot paths: Compute-heavy functions compile to native C. Sensitive logic stays inside the VM.
- Hardware lock (Coming Soon): Lock your compiled binary to a specific machine. Prevent license sharing without writing custom check logic.
Why the approach matters
Other tools patch around Python. PyK7VM removes the Python-level recovery path.
| What ships to the user | Standard tools: Bundled .pyc or renamed bytecode | PyK7VM: No normal .pyc or Python bytecode |
|---|---|---|
| Where your code runs | Standard tools: Standard Python interpreter | PyK7VM: Private VM, CPython not in the chain |
| String constants | Standard tools: Plaintext char arrays in the binary | PyK7VM: Per-build encrypted, wiped after use |
| Works on next release | Standard tools: Same crack often applies | PyK7VM: Opcodes randomized every build |
| Python-level recovery | Standard tools: Often available with free tools | PyK7VM: Requires VM/native analysis |
Automate protection in your pipeline - REST API
Submit files, poll build status, and download artifacts without touching the UI. One API key. Works with any CI/CD system.
Not uncrackable. Expensive to crack.
Analysis starts at native code and a VM instruction set that is generated per build. Free during beta. No credit card. Current scope: Windows x64 and Linux x64.