struct _pyc{
    char magic[4],  // 魔数，表明该pyc所对应的版本号
    u32 flag,  // 表示该pyc是否使用hash判断与其对应py文件一致性
    union{
        u32 hash,  // 用以和py文件做对应，hash
        u32 timestamp  // 用以和py文件做对应，时间戳
    }ht,
    u32 size,
    PyCodeObject codeobj
}

typedef struct {
    PyObject_HEAD
    int co_argcount;            /* #arguments, except *args */
    int co_kwonlyargcount;      /* #keyword only arguments */
    int co_nlocals;             /* #local variables */
    int co_stacksize;           /* #entries needed for evaluation stack */
    int co_flags;               /* CO_..., see below */
    int co_firstlineno;         /* first source line number */
    PyObject *co_code;          /* instruction opcodes */
    PyObject *co_consts;        /* list (该块所定义的所有常量，例如类，) */
    PyObject *co_names;         /* list of strings (names used) */
    PyObject *co_varnames;      /* tuple of strings (local variable names) */
    PyObject *co_freevars;      /* tuple of strings (free variable names) */
    PyObject *co_cellvars;      /* tuple of strings (cell variable names) */
    Py_ssize_t *co_cell2arg;    /* Maps cell vars which are arguments. */
    PyObject *co_filename;      /* unicode (where it was loaded from) */
    PyObject *co_name;          /* unicode (name, for reference) */
    PyObject *co_lnotab;        /* string (encoding addr<->lineno mapping) See
                                   Objects/lnotab_notes.txt for details. */
    void *co_zombieframe;       /* for optimization only (see frameobject.c) */
    PyObject *co_weakreflist;   /* to support weakrefs to code objects */
    void *co_extra;
} PyCodeObject;

    PYINST20_COOKIE_SIZE = 24           # For pyinstaller 2.0
    PYINST21_COOKIE_SIZE = 24 + 64      # For pyinstaller 2.1+
    MAGIC = b'MEI\014\013\012\013\016'  # Magic number which identifies pyinstaller
    def checkFile(self):
        print('[+] Processing {0}'.format(self.filePath))
        # Check if it is a 2.0 archive
        self.fPtr.seek(self.fileSize - self.PYINST20_COOKIE_SIZE, os.SEEK_SET)
        magicFromFile = self.fPtr.read(len(self.MAGIC))

        if magicFromFile == self.MAGIC:
            self.pyinstVer = 20     # pyinstaller 2.0
            print('[+] Pyinstaller version: 2.0')
            return True

        # Check for pyinstaller 2.1+ before bailing out
        self.fPtr.seek(self.fileSize - self.PYINST21_COOKIE_SIZE, os.SEEK_SET)
        magicFromFile = self.fPtr.read(len(self.MAGIC))

        if magicFromFile == self.MAGIC:
            print('[+] Pyinstaller version: 2.1+')
            self.pyinstVer = 21     # pyinstaller 2.1+
            return True

        print('[!] Error : Unsupported pyinstaller version or not a pyinstaller archive')
        return False
...........

while(not_eof(PC)){
    param=instr_param(PC);  // 获取当前PC指向指令的参数
    ins=instr_ins(PC);   // 获取当前PC指向指令的操作数
    switch PC:{
        case POP:...;break;
        case PUSH:...;break;
        case CALL:...;break;
        ....
    }
    PC=next_instr(PC);
}

#define JUMPTO(x)       (next_instr = first_instr + (x) / sizeof(_Py_CODEUNIT))  //绝对跳转
#define JUMPBY(x)       (next_instr += (x) / sizeof(_Py_CODEUNIT))  // 相对跳转

FOR_ITER,JUMP_FORWARD,JUMP_IF_FALSE_OR_POP,JUMP_IF_TRUE_OR_POP,POP_JUMP_IF_FALSE,POP_JUMP_IF_TRUE,JUMP_ABSOLUTE,CONTINUE_LOOP,SETUP_LOOP,SETUP_EXCEPT,SETUP_FINALLY,SETUP_WITH,SETUP_ASYNC_WITH,

class CryptPathFinder(importlib.abc.PathEntryFinder):
    def find_loader(self, fullname):
        path = fullname.replace('.','/')
        try:
            with open(path, 'rb') as f:
                if f.read(4) == CRYPT_MAGIC:  # 通过魔数判断是否应该使用自定义的loader加载
                    return CryptModuleLoader()
        except:
            return None

class CryptModuleLoader(importlib.abc.SourceLoader):

    def load_module(self, fullname):
        code = self.get_code(fullname)
        mod = sys.modules.setdefault(fullname, imp.new_module(fullname))
        mod.__file__ = self.get_filename(fullname)
        mod.__loader__ = self
        mod.__package__ = fullname.rpartion('.')[0]
        exec(code, mod.__dict__)

    def get_code(self, fullname):
        code = self.get_source(fullname)
        code = decrypt_pyc(code)  # 解密函数
        return marshal.loads(code[16:])

sys.path_hooks.insert(0, CryptPathFinder())

imp.new_module(name)  // PyModule_NewObject
marshal.loads(bytes) //PyMarshal_ReadLastObjectFromFile
compile(source, filename, mode, flags=0, dont_inherit=False, optimize=-1) // PyAST_CompileObject
exec(object[, globals[, locals]]) // PyEval_EvalCode

# 小文件可直接使用cythonize编译：
cythonize.exe -b test.py


# 若文件过多最好使用distutils工具组织为setup.py文件
from distutils.core import setup
from Cython.Build import cythonize
setup(
    name = 'test',
    ext_modules = cythonize("test.py")
)

ls -lh
-rw-r--r-- 1 xxxxxxx 197121 108K 七月  4 14:56 test.c
-rw-r--r-- 1 xxxxxxx 197121  157 六月 15 18:35 test.py

+++ b/Modules/main.c
@@ -71,6 +71,205 @@ static int orig_argc = 0;

 #define PROGRAM_OPTS BASE_OPTS

+/***********************************/
+ SomeInitCode(void*);
+ SomeDecryptCode(void* inData, void* outData, unsigned int size);
+/****************************************/
+
@@ -3027,6 +3226,8 @@ pymain_init(_PyMain *pymain)
     _PyCoreConfig_GetGlobalConfig(config);

     int res = pymain_cmdline(pymain, config);
+
+    SomeInitCode(args);
     if (res < 0) {
         _Py_FatalInitError(pymain->err);
     }

+++ b/Python/pylifecycle.c
@@ -1029,6 +1029,7 @@ Py_InitializeEx(int install_sigs)
         /* bpo-33932: Calling Py_Initialize() twice does nothing. */
         return;
     }
+    SomeInitCode(args);

     _PyInitError err;
     _PyCoreConfig config = _PyCoreConfig_INIT;

+++ b/Python/ceval.c
@@ -22,6 +22,14 @@

 #include <ctype.h>

+#define CO_ENCRYPTED_CODE      0x0400
+#define CO_SUBSITUTE_CODE      0X0800
+#ifdef _Py_OPCODE
+#undef _Py_OPCODE
+#endif
+#define _Py_OPCODE(word) SomeAlternate（word）

+++ b/Python/ceval.c
    co = f->f_code;  // 获取代码对象
        ....
    first_instr = (_Py_CODEUNIT *) PyBytes_AS_STRING(co->co_code);  // 字节码首地址
    decrypt(first_instr, first_instr, PyBytes_GET_SIZE(co->co_code));  // 解密字节码
    for (;;) {  // 开始循环解释字节码
            switch (opcode) {
              TARGET(NOP)
                  FAST_DISPATCH();
              ......
            }
    }
    encrypt(first_instr, first_instr, PyBytes_GET_SIZE(co->co_code));   //运行结束，加密字节码

+++ Python/marshal.c
@@ -1554,6 +1564,20 @@ PyMarshal_ReadLastObjectFromFile(FILE *fp)
         char* pBuf = (char *)PyMem_MALLOC(filesize);
         if (pBuf != NULL) {
             size_t n = fread(pBuf, 1, (size_t)filesize, fp);
+            if (*(int*)s == XXXXXX) {
+                s = SomeDecrypt(s);
+            }
             PyObject* v = PyMarshal_ReadObjectFromString(pBuf, n);
             PyMem_FREE(pBuf);
             return v;
@@ -1789,16 +1813,33 @@ marshal_loads_impl(PyObject *module, Py_buffer *bytes)
     RFILE rf;
     char *s = bytes->buf;
     Py_ssize_t n = bytes->len;
+    if (*(int*)s == XXXXXX) {
+        s = SomeDecrypt(s);
+    }
     PyObject* result;
     rf.fp = NULL;

+++ Objects/object.c
@@ -1197,6 +1197,7 @@ _PyObject_GetMethod(PyObject *obj, PyObject *name, PyObject **method)
 }

 /* Generic GetAttr functions - put these in your tp_[gs]etattro slot. */
+char* senstive[] = { "co_flags", "co_code","co_consts","co_varnames","__dir__" };

 PyObject *
 _PyObject_GenericGetAttrWithDict(PyObject *obj, PyObject *name,
@@ -1221,6 +1222,16 @@ _PyObject_GenericGetAttrWithDict(PyObject *obj, PyObject *name,
                      name->ob_type->tp_name);
         return NULL;
     }
+    if ((((PyObject*)(obj))->ob_type) == &PyCode_Type && ((PyCodeObject*)(obj))->co_flags & (CO_ENCRYPTED_CODE | CO_SUBSITUTE_CODE))) {
+        char* sp = (char*)&(((PyUnicodeObject*)name)->_base.utf8_length);
+        // CANT ACCESS these fileds
+        for (int i = 0; i < 5; i++) {
+            if (0==memcmp(senstive[i], sp, strlen(senstive[i]))) {
+                return res;
+            }
+        }
+    }
+
     Py_INCREF(name);

     if (tp->tp_dict == NULL) {

+++ b/Objects/typeobject.c
@@ -1446,9 +1446,18 @@ PyType_IsSubtype(PyTypeObject *a, PyTypeObject *b)
 PyObject *
 _PyObject_LookupSpecial(PyObject *self, _Py_Identifier *attrid)
 {
-    PyObject *res;
+    PyObject *res = NULL;
+
+    if (PyCode_Check(self)) {
+        PyCodeObject* co = (PyCodeObject*)self;
+        // CANT DIR CODE
+        if (1 || co->co_flags & (CO_ENCRYPTED_CODE | CO_SUBSITUTE_CODE))) {
+            return res;
+        }
+    }

     res = _PyType_LookupId(Py_TYPE(self), attrid);
+    
     if (res != NULL) {
         descrgetfunc f;
         if ((f = Py_TYPE(res)->tp_descr_get) == NULL)

+++ Python/marshal.c
@@ -14,6 +14,7 @@
 /*[clinic input]
 module marshal
 [clinic start generated code]*/
@@ -547,6 +548,13 @@ w_complex_object(PyObject *v, char flag, WFILE *p)
     }
     else if (PyCode_Check(v)) {
         PyCodeObject *co = (PyCodeObject *)v;
+        // CANT DUMP CODE THAT IS PROTECTED OR ENCRYPTED
+        if (co->co_flags & (CO_ENCRYPTED_CODE | CO_SUBSITUTE_CODE)) {
+            W_TYPE(TYPE_CODE, p);
+            p->error = WFERR_NOMEMORY;
+            return;
+        }
+
         W_TYPE(TYPE_CODE, p);
         w_long(co->co_argcount, p);
         w_long(co->co_kwonlyargcount, p);

++ b/Python/ceval.c
+PyObject* _PyEval_EvalFrameStrong(PyFrameObject* f, int throwflag);
+
 PyObject *
 PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
 {
-    PyThreadState *tstate = PyThreadState_GET();
-    return tstate->interp->eval_frame(f, throwflag);
+       // if encrypt todo:modify interpreter
+    if (f->f_code->co_flags & CO_ENCRYPTED_CODE) {
+        return _PyEval_EvalFrameStrong(f, throwflag);
+    }
+    else {
+        PyThreadState* tstate = PyThreadState_GET();
+        return tstate->interp->eval_frame(f, throwflag);
+    }
 }

+++ Include/code.h
@@ -21,14 +21,14 @@ typedef uint16_t _Py_CODEUNIT;
 typedef struct {
     PyObject_HEAD
     int co_argcount;            /* #arguments, except *args */
-    int co_kwonlyargcount;      /* #keyword only arguments */
     int co_nlocals;             /* #local variables */
+    int co_kwonlyargcount;      /* #keyword only arguments */
+    int co_firstlineno;         /* first source line number */
     int co_stacksize;           /* #entries needed for evaluation stack */
     int co_flags;               /* CO_..., see below */
-    int co_firstlineno;         /* first source line number */
-    PyObject *co_code;          /* instruction opcodes */
     PyObject *co_consts;        /* list (constants used) */
     PyObject *co_names;         /* list of strings (names used) */
+    PyObject* co_code;          /* instruction opcodes */
     PyObject *co_varnames;      /* tuple of strings (local variable names) */
     PyObject *co_freevars;      /* tuple of strings (free variable names) */
     PyObject *co_cellvars;      /* tuple of strings (cell variable names) */
@@ -38,12 +38,13 @@ typedef struct {
        would collapse identical functions/lambdas defined on different lines.
     */
     Py_ssize_t *co_cell2arg;    /* Maps cell vars which are arguments. */
+    PyObject* co_name;          /* unicode (name, for reference) */
+    PyObject* co_weakreflist;   /* to support weakrefs to code objects */
     PyObject *co_filename;      /* unicode (where it was loaded from) */
-    PyObject *co_name;          /* unicode (name, for reference) */
     PyObject *co_lnotab;        /* string (encoding addr<->lineno mapping) See
                                    Objects/lnotab_notes.txt for details. */
     void *co_zombieframe;       /* for optimization only (see frameobject.c) */
-    PyObject *co_weakreflist;   /* to support weakrefs to code objects */