NYCPHP Meetup

[Jayesh Sheth]

Hi Rolan and others,

thanks for the tip. I always have wanted to try MMCache. I went to their 
site, but did not see any info on CLI usage.

Here is write-up on the state of PHP encoders and obfuscators - of what 
worked and did not work for me. This might be useful to others, and 
might save others the hours of experimentation that I had to go through.

Now for the Zend product, I downloaded the trial version of Zend Encoder 
and also Zend Optimizer(ZO). (ZO should really be called Zend Decoder.) 
While setting it up (the decoder a.k.a "Optimizer", I think), I chose 
'other' as the 'web server' to option. It then asked me where my php.ini 
file was, and I pointed it in the right direction. It then parsed the 
php.ini file and made the following entries in it:

zend_extension_ts="C:\Program Files\Zend\lib\ZendExtensionManager.dll"
zend_extension_manager.optimizer_ts="C:\Program 
Files\Zend\lib\Optimizer-2.5.7"
zend_optimizer.optimization_level=15

The Zend Encoder GUI is pretty basic, but seems to work. The sample 
WinBinder application that I encoded worked flawlessly.

I checked out the IonCube encoder, but it did not seem to work. Firstly, 
it seems to only support a webserver API, not PHP CLI, although I may be 
wrong on this. I tried IonCube with PHP 5.0.2 (as part of XAMMP), but it 
did not like it. I think the fine print in their site seemed to suggest 
that their decoder dll only works with PHP 5.0.3 and above. Weird. (I 
kept thinking: it should be this difficult to find whether these 
products support CLI or just mod_php for Apache, which php.ini entries 
need to be made, what their decoders are called, which decoder dlls are 
used, where to copy them etc.)

I also tried two PHP obfuscators, one free, and one shareware / commercial.

POBS is the free one:
http://pobs.mywalhalla.net/

It looks like a nice enough product, but like the commercial one, it 
produced a non-functional WinBinder application. In both cases, the 
WinBinder application launched, but the controls were useless (clicking 
a button did nothing.)

The commercial product is GridinSoft PHP Processor (Price: $50) (they 
seem to be based in Ukraine):
http://www.gridinsoft.com/

Their product is an obfuscator, and comes with a handy-dandy file 
preview and 'project' management tool, but it produced the same 
perplexing 'buttons-don't-work-this-application-is-non-functional' 
effect for the WinBinder script.

I also looked into Alan Knowles BCompiler, but it does not seem to have 
a tool to automatically decode encoded scripts on the fly:
Main Info
Manual: http://pear.php.net/manual/en/pecl.bcompiler.php
Download DLL: http://snaps.php.net/win32/PECL_STABLE/

I also tried Roadsend's Compiler + IDE tool (available for $89 for the 
basic edition):
http://www.roadsend.com

Unlke other encoders, they have completely rewritten the PHP parser and 
interpreter. Their parses parses PHP code, and compiles it into a form 
that their interpreter can read and execute. Whatever it 'interprets' is 
obviously not plaintext, and is probably some intermediate bytecode (I 
think).

It is pretty amazing that a small company such as Roadsend has rewritten 
the entire PHP processor tool. Their latest version also includes a 
PHP-GTK interpreter. But here's thing: they do not support all PHP 
extensions, because, as far as I know, they cannot load all extensions' 
dlls like the PHP interpreter does. I am not sure how they recreate PHP 
GTK apps, and if they actually use the Windows GTK libraries for this. 
(They must, I think.) So non-standard extensions such as WinBinder won't 
work with Roadsend.

RoadEnd's product can compile PHP GTK programs into standalone exes that 
can be run from CD, etc.

But here's the thing: I think that for my uses, WinBinder would be 
better, even in its alpha state. Its developer seems to be really active 
and I can see it moving out of alpha status pretty fast.

Well, I hope this write-up has been useful to others who are evaluation 
PHP encoder options.

As the last word (or sentence, it seems), I think I have two options: 
buy the Zend Encoder Small Business edition (Zend Encoder, Studio and 
Accelerator for $500 instead of $3717, 
http://www.zend.com/store/products/zend-smallbiz.php ) or just make the 
project open source, which I think might be a good option too. If people 
want to steal the source, let them, but put a license on it so they know 
the dos and don'ts.

Best regards,

- Jay Sheth