Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:74425
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain tobin.nl designates 208.97.132.208 as permitted sender)
Message-ID: <537DA268.1000801@tobin.nl>
Date: Thu, 22 May 2014 09:08:24 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: internals@lists.php.net
References: <CAOg_pRQxKsJPgFaZ6_y7Rf1i4Bfkbx+FhCxuBtE9PWu58uOfOQ@mail.gmail.com>
In-Reply-To: <CAOg_pRQxKsJPgFaZ6_y7Rf1i4Bfkbx+FhCxuBtE9PWu58uOfOQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] encode php scripts with opcache compatibility
From: bas@tobin.nl (Bas van Beek)


op 21-05-14 12:20, Nicolai Scheer schreef:
> Hi all,
>
> I'm currently facing the situation, that I need to protect my php sources
> and retain opcache compatibility.
>
> I know there are quite a few commercial tools for "encoding" and protecting
> php sources, but none of them seems to work in conjunction with php's
> opcache extension.
>
> Most products see this as part of their protection scheme.
As said in the conversation spawned by your question it is possible to 
reverse engineer the opcodes to php script and as you noted you're ok 
with at least a first line of defense against customers altering 
scripts. I might have a workable solution to your problem.

I faced a similar problem where I didn't want the PHP source code for a 
client application (win32 service/*nix daemon with embedded webserver, 
PHP API layer and AngularJS front-end) to be easily viewed and/or 
modified. So I built an embedded filesystem that is encrypted. For this 
embedded filesystem I wrote a PHP stream extension so I can access the 
files in that filesystem as if they reside on a regular disk. In the C++ 
code of the main app I open the embedded filesystem with the decryption 
key and I make a filesystem handle available to the PHP stream 
extension. The embedded webserver can access the embedded filesystem 
directly with its API and within PHP the stream extension takes care of 
that. This solution is compatible with PHP 5.5 and opcache and has the 
added bonus of only needing to ship a single file for all PHP, JS, Image 
and other web resource files). Hope this solution points you in the 
right direction.

Bas van Beek