Re:No Python interpreter? this simple RAT installs its own copy
by MereInterest on Friday April 09, 2021 @10:37AM
(#26751112)
I've done this before with pyinstaller, and it's pretty straightforward. This wasn't even for a customer-facing application, instead an internal utility that I had initially made to save myself time. The first time I tried to distribute it without bundling the interpreter and libraries, it took a full hour to get it mostly set up for 4 people. Sure, every problem from multiple conflicting python environments, to pip commands for using a firewall's proxy, to people not having used cmd before were all solvable problems. But at the end of the day, it was more straightforward to bundle it as a .exe, give people a file path, and tell them to double-click it.
[ Parent
| on HN ]
Re:No Python interpreter? this simple RAT installs its own copy
by wzdd on Friday April 09, 2021 @10:49AM
(#26751246)
I've had both Sophos and Windows Defender pick up innocuous Pyinstaller-based packages as malware, presumably because packaging malware with Pyinstaller is such a common technique. It's quite frustrating if you intend to release the software.
Example issue: https://github.com/pyinstaller/pyinstaller/issues/3802
Re:No Python interpreter? this simple RAT installs its own copy
by pansa2 on Friday April 09, 2021 @11:13AM
(#26751540)
The other issue with using PyInstaller to build a program into a single binary is that every time the program runs, it needs to extract its own contents to a temporary directory. This causes slow start-up and, if the program exits abnormally, orphaned files left on disk.
I think other packaging tools have a workaround for this particular problem but, in my experience, have other issues. I’d love to use Python for building CLI tools, but building a binary is so fragile that I only use the language for prototyping, and rewrite in C++ (maybe Go in future?) for production.
Re:No Python interpreter? this simple RAT installs its own copy
by rripken on Friday April 09, 2021 @12:53PM
(#26752891)
What you are describing sounds like the onefile mode. Pyinstaller also has a onedir mode which is much faster to start. I packaged some python ml models into a pyinstaller built exe and a larger java application calls them. Onedir makes for a big install but they only take a second or two to run.
Re:No Python interpreter? this simple RAT installs its own copy
by MereInterest on Friday April 09, 2021 @11:05AM
(#26751441)
I've had similar false positives from McAfee when first installing pyinstaller, but not on the using of executables generated by pyinstaller. I hadn't known that pyinstaller was used by malware, and had assumed it was because the bundled interpreter could potentially make any system call, thus making it flag on lots of heuristics.
Re:No Python interpreter? this simple RAT installs its own copy
by ryanlol on Friday April 09, 2021 @11:17AM
(#26751583)
> assumed it was because the bundled interpreter could potentially make any system call, thus making it flag on lots of heuristics
You seriously overestimate AV “heuristics”.
Re:No Python interpreter? this simple RAT installs its own copy
by KptMarchewa on Friday April 09, 2021 @02:07PM
(#26753873)
Signing created binary with valid certificate usually prevents most of antivir problems, as they act way more lenient in regards to those binaries.