I built a Windows security suite in Python and shipped it as a single .exe with zero runtime dependencies for the end user. Here's what's actually under the hood, and a few of the harder problems I had to solve.
Repo: https://github.com/Akhouri-Anmol-Kumar/ATLOCK
The stack
customtkinter for the UI (dark theme, gold accents, Courier New throughout — if I'm going to stare at it for hours, it should look intentional)
cryptography (Fernet + PBKDF2HMAC) for the vault
pywin32 / ntsecuritycon for NTFS ACL manipulation
opencv-python for intruder photo/video capture
ctypes + a low-level WH_KEYBOARD_LL hook for the lockdown mode
pyinstaller for packaging into one .exe
All of it gracefully degrades — if cv2 or pywin32 aren't available, the relevant feature disables itself instead of crashing the app on import.
Problem 1: locking a file so even an admin can't touch it
Chmod-style "read-only" flags are cosmetic. I needed the deepest access control Windows exposes, which meant working directly with NTFS ACLs via win32security:
python
if IS_WINDOWS:
try:
import win32security
import win32api
import win32con
import ntsecuritycon as con
WIN32_AVAILABLE = True
except ImportError:
WIN32_AVAILABLE = False
File Guard applies an explicit deny ACE to the file's security descriptor rather than just toggling attributes. That's the difference between "hidden from casual browsing" and "the filesystem itself refuses the open() call" — guarded files can't be opened, moved, copied, or deleted, including by an admin account, until they're released. Up to 10 files can be guarded at once, and three wrong unlock attempts trigger Intruder Ops.
Problem 2: a vault that's actually encrypted
Full disclosure: an earlier build of this app used something close to XOR "encoding" for the password vault and called it encryption. It wasn't. v4.0 replaces that with real Fernet (AES-128-CBC + HMAC), keyed via PBKDF2-HMAC-SHA256 at 200,000 iterations with a random salt:
python
PBKDF2_ITERATIONS = 200_000
...
from cryptography.fernet import Fernet, InvalidToken
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
Vault lockout logic: 3 wrong attempts = warning, 4th = a 10-hour hard lock on the entire app, rendered via a topmost, overrideredirect Toplevel that grabs focus and can't be dismissed until the timer expires. There's no soft-close on that overlay — protocol("WM_DELETE_WINDOW", lambda: None).
Problem 3: masking intruder input before it ever touches disk
Every wrong password attempt gets logged as a security event — but never the plaintext. There's a dedicated masking function that runs before anything is written to notifications or logs, so an intruder's guessed password shows up as something like a*** (5 chars), never in full. Given the vault holds things like UPI PINs and bank details, logging attempts in plaintext would turn a security log into a liability.
Problem 4: an unkillable lockdown mode
System Lockdown installs a low-level WH_KEYBOARD_LL hook via ctypes to block Alt+Tab, the Windows key, Escape, and Alt+F4 system-wide, and runs a background watchdog thread that kills Task Manager or Process Explorer the instant they spawn. A grab_set() + focus_force() loop stops any other window from stealing focus during the lock period. One emergency override exists, because "unkillable" for everyone including the owner is a support nightmare, not a feature.
What changed in v4 vs earlier builds
Vault: XOR → real AES (Fernet) + PBKDF2
built the Intruder Ops pipeline: photo on 1st wrong attempt → escalate to 10s video + alarm on 3rd/4th
Redesigned Settings panel for toggling camera/sound and jumping straight to the intruder media gallery
Try it / break it
It's free, MIT-adjacent (see repo for exact license), single .exe, Windows 10+, no Python required to run it. If you want to read or hack on the source, it's all there.
GitHub: https://github.com/Akhouri-Anmol-Kumar/ATLOCK
I'd genuinely like code review from people who've done more Win32/ACL work than me — if you spot something that should be hardened further, open an issue or PR.
ATLOCK
"We Build What Others Forgot To Fix"
Also try India's own social media platform
👉https://desh-via.vercel.app/
Top comments (0)