Why does pyarmor 8 work much slower than 7 when --obf-code 1 is using?

[dvkovner]

Hi. I'm using pyarmor 8.4.6 with the basic license installed to obfuscate my Python 3.10 package.

The command which is using for obfuscation is pyarmor gen --enable-jit --mix-str -O build <somefolder>.

After that I'm calling a method from the obfuscated package in a CPU-intensive demo application like that:

import math
import time
import cProfile

def isPrime(num):
    if num == 2:
        return True
    **<THE OBFUSCATED METHOD IS CALLING HERE>** <---------------------------------------------
    if num < 2 or num % 2 == 0:
        return False
    sqrt_num = int(math.sqrt(num))
    for i in range(3, sqrt_num + 1, 2):
        if num % i == 0:
            return False
    return True


def main():
    print("Calculating number of primes")
    cnt = 0
    start = time.time()
    for i in range(2, 10 ** 5):
        if isPrime(i):
            cnt += 1
    print("Total number of primes: ", cnt)
    print("Took ", time.time() - start, " seconds")


if __name__ == '__main__':
    with cProfile.Profile() as pr:
        main()
    pr.print_stats(sort='name')

According to results of cProfile the process of obfuscation and deobfuscation of the code object which corresponds to the calling method takes most of the time.

Took  3.3139572143554688  seconds
         2304471 function calls (2304467 primitive calls) in 3.314 seconds

   Ordered by: function name

   ncalls  tottime  percall  cumtime  percall filename:lineno(function)
   204924    0.029    0.000    0.029    0.000 {built-in method C_ASSERT_ARMORED_INDEX}
   503693    1.275    0.000    1.275    0.000 {built-in method C_ENTER_CO_OBJECT_INDEX}
   503693    1.264    0.000    1.264    0.000 {built-in method C_LEAVE_CO_OBJECT_INDEX}
   ... more lines here ...

When I disable obfuscation of each function by adding --obf-code 0 it starts to work much faster and info about C_ENTER_CO_OBJECT_INDEX and C_LEAVE_CO_OBJECT_INDEX disappears.

Took  0.5403845310211182  seconds
         1278959 function calls (1278955 primitive calls) in 0.540 seconds

   Ordered by: function name

   ncalls  tottime  percall  cumtime  percall filename:lineno(function)
   203028    0.024    0.000    0.024    0.000 {built-in method C_ASSERT_ARMORED_INDEX}
   ... more lines here ...

After that I performed the same experiment using pyarmor 7.6.1. The command to obfuscate the package was: pyarmor obfuscate --src <somefolder> --output build/<somefolder> --bootstrap 2 __init__.py __main__.py. The test application was also the same, however, it takes much less time in comparison with 8.4.6:

Took  0.6378297805786133  seconds
         1683592 function calls (1683588 primitive calls) in 0.638 seconds

   Ordered by: function name

   ncalls  tottime  percall  cumtime  percall filename:lineno(function)
        3    0.000    0.000    0.000    0.000 {__armor__}
   302502    0.028    0.000    0.028    0.000 {__armor_enter__}
   302502    0.030    0.000    0.030    0.000 {__armor_exit__}
   ... more lines here ...

Which options of pyarmor 8 do I need to use to have the same perfomance as it was in pyarmor 7 for the case described? It looks like usage of --obf-code 0 is not an option as it is less secure.

[jondy]

Both `--ena reduce the performance, please test the difference options to balance security and performance.

[dvkovner]

@jondy Obfuscating of the package without both options using the command pyarmor gen -O build <somefolder> changes almost nothing according to my experiments:

Took  3.014462471008301  seconds
         2096305 function calls (2096301 primitive calls) in 3.015 seconds

   Ordered by: function name

   ncalls  tottime  percall  cumtime  percall filename:lineno(function)
   503450    1.150    0.000    1.150    0.000 {built-in method C_ENTER_CO_OBJECT_INDEX}
   503450    1.148    0.000    1.148    0.000 {built-in method C_LEAVE_CO_OBJECT_INDEX}

1. Is it secure to use pyarmor gen --obf-module 1 --obf-code 0 -O build <somefolder>? setting both options to 0 is not secure as I understand from https://pyarmor.readthedocs.io/en/stable/how-to/security.html#what-s-the-best-performance-pyarmor-could-do.
2. Any other recommendations what to do with it except setting of --obf-code 0?
3. Isn't it a bug that it worked much faster for pyarmor 7?

[jondy]

Please check https://pyarmor.readthedocs.io/en/latest/how-to/security.html

[jondy]

I don't think it's a bug, because Pyarmor 8 is totally different from Pyarmor 7, it uses different algorithm to obfuscate the scripts.

[jondy]

There is also some tests about performance
https://pyarmor.readthedocs.io/en/latest/topic/performance.html

[dvkovner]

Whether in your opinion "Remarkable reduce" of security because of "--obf-code 0" is fully compensated with "Remarkable increase" of security because of "--enable-rft" when they are used together?

BTW https://pyarmor.readthedocs.io/en/latest/topic/performance.html#id3 - it looks like headers "Pyarmor" in this table should be renamed to "Origin" according to the code snippet above it.

[dvkovner]

Is there any option to check the performance of the advanced flags (--enable-rft, --enable-bcc and so on) on pyarmor 8 and python 3.11 for my case before purchasing the pro license? (for instance, the pro license which works only for a week and expires after that)

[jondy]

Sorry, there is no trial license for --enable-rft and --enable-bcc