Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:74418
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.46 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <537CBD67.4000008@lerdorf.com>
References: <CAOg_pRQxKsJPgFaZ6_y7Rf1i4Bfkbx+FhCxuBtE9PWu58uOfOQ@mail.gmail.com>
	<6048BA05-CC13-46DD-8439-9CB4EE29078B@ajf.me>
	<9EBA95A7-B9F7-41F0-AE2B-283260753E5A@googlemail.com>
	<B58A4DF4-52FE-41D9-896C-5396DDC7CB8B@ajf.me>
	<CAOg_pRSmVdw1Y9g-RrW8dBNSpBZVHavJQzSGUCjZu5wXhuUMCQ@mail.gmail.com>
	<537CBD67.4000008@lerdorf.com>
Date: Wed, 21 May 2014 22:12:51 +0200
Message-ID: <CAOg_pRTvbaVmDdLhmEOi5g1BJ_KgQnJffrXcY_0b4XosLgBTWA@mail.gmail.com>
To: Rasmus Lerdorf <rasmus@lerdorf.com>
Cc: Andrea Faulds <ajf@ajf.me>, Kevin Ingwersen <ingwie2000@googlemail.com>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=20cf30549fe70062b104f9ee9f72
Subject: Re: [PHP-DEV] encode php scripts with opcache compatibility
From: nicolai.scheer@gmail.com (Nicolai Scheer)

--20cf30549fe70062b104f9ee9f72
Content-Type: text/plain; charset=UTF-8

Hi

On 21 May 2014 16:51, Rasmus Lerdorf <rasmus@lerdorf.com> wrote:

> On 5/21/14, 7:27 AM, Nicolai Scheer wrote:
> > Hi,
> >
> > yes, we are shipping code to customers and they should not read the
> source.
> > The level of protection gained from obfuscated code is not enough, but
> just
> > delivering the opcodes would be ok.
> >
> > I know that the opcode array might be dumped, this is just to raise the
> > bar. If I just obfuscate the code there's still the possibilty left to
> edit
> > the code directly.
> >
>
> It is completely trivial to turn opcodes back into PHP code. Sure, it
> won't look exactly like the original, but it will run exactly the same
> and can easily be modified. There are tools out there that let even a
> complete neophyte do it.
>
> If you truly want to protect your code, ship a signed compiled C/C++
> extension and put key components of your application in it. That is much
> harder to reverse (anything can be reversed, of course) and it has the
> added advantage of likely making your application faster.
>
> -Rasmus
>
>
But that would imply developing our key components in C, wouldn't it?
Unfortunately that is not feasible for our project.

Do you have an example of a tool that can reverse opcodes to php code?
Maybe I did not search for the right thing, I did not stumble upon any.

I always thought the opcodes where kind of cryptic, at least a bit... I'm
not longing for "true" protection. It's enough if the scripts can not be
read and modified in an easy way.
All I'm asking for is a way do so in way, that scripts are still cacheable
(even if this makes dumping the opcodes easier...).

I found Derick's Vulcan Logic Disassembler, I think this can help my
understanding of what opcodes of a script look like.

Greetings

Nico

--20cf30549fe70062b104f9ee9f72--