Nuitka + VMprotector?

[penahuse]

Hello fellows! Im a beginner coder and I wonder how type of protection will give you a good chalenge?  I have a program with modules to check credentials in my webpage (public and nothing fancy) and compiled it with Nuitka and used VMprotector to mutate and virtualize. From 0 to 10 how good is Nuitka + VMprotector to prevent reverse engineering? I have for sure that my code is bad but lets wonder if a medium and a expert coder try to bypass the "security" how likely is them to get in? May the weak spot is the conection that my program make with my webpage using "requests https" or it may be not a huge problem?

 

- The code was made on python

- it get some UUID from user pc and check with my webpage if it is in there (HTML)

- compiled to c with nuitka

- mutated and virtualized with VMprotector

 

How it should be to get acess like a "autorizated" user?

Edited March 31, 2022 by penahuse

[Washi]

2 hours ago, penahuse said:

May the weak spot is the conection that my program make with my webpage using "requests https" or it may be not a huge problem?

Remember that no amount of obfuscation will protect you from observable side-effects. You can slap virtualizers on top of recompilers / packers / mutations; if the program was originally making a HTTP request to a web server, then it is still going to do that and it will be noticeable, regardless of the type(s) of obfuscation applied. Obfuscation is about hiding implementation details, not about hiding actual program behavior.

2 hours ago, penahuse said:

How it should be to get acess like a "autorizated" user?

Requests can be spoofed and servers can be emulated. This is generally speaking not that difficult, as it does not require a lot of understanding of the inner workings of the original program.

[penahuse]

17 minutes ago, Washi said:

Remember that no amount of obfuscation will protect you from observable side-effects. You can slap virtualizers on top of recompilers / packers / mutations; if the program was originally making a HTTP request to a web server, then it is still going to do that and it will be noticeable, regardless of the type(s) of obfuscation applied. Obfuscation is about hiding implementation details, not about hiding actual program behavior.

Requests can be spoofed and servers can be emulated. This is generally speaking not that difficult, as it does not require a lot of understanding of the inner workings of the original program.

First of all thanks for answering. Apreciate that

 

"This is generally speaking not that difficult" any tips of how to turn it more difficult? What can I do?

[svenskithesource]

You can use an algorithm that's the same on your server to which you connect and the program itself. You will encrypt the message you send and the server will encrypt the response. Both sides will be able to read the real message as they have the algorithm to decrypt it. When an attacker wants to spoof this he will also need to reverse the algorithm which will be hard because of the obfuscation.