encoding your own code?

[azuranz]

hey I'm wondering if anyone's ever encoded their own code.

I'm just a smalltime dev so it really isn't worth it for me to spend the money on an encoder when I'm not doing enough volume to earn it back.

So I just want to encode my code with the below:

simple license key generation based on a website address

then (i assume i place this in my code) a check to see if current address script is a match to the license key, if not a match(being run elsewhere) exit.

hints tips links to get started? I'm intermediate at PHP but I've never tried encoding so yeah

base64_decode?

[dmsuperman]

Best way is to include various checks within the code to ensure that other checks are there and other checks have other checks upon other checks, then obfuscate it using something like base64. What I mean above is make it so they have to go around and around in circles to find where the source of the unlocking module is at to unlock it.

[fLUx1337]

Yeh, with the mass of files you include with most projects, it will be easy to hide checks.

Personally I have never created anything I would sell, or even release, so I have never had to do this, but as long as you make it really hard for the user to crack, you will be fine...

Just look at vBulletin, they must use commercial encoders - and every new release, its cracked. So you can only make it hard for people...

[_matrix_]

Hi,

http://phplockit.com/

Cheap enough, also offers domain or ip lockdown

hth

[logic_earth]

Do not use something like PHP Lockit.
Here is how easy it is to decrypt it:

function decrypt_phplockit ($s) {
    $from = 'TnPE5s1kL6j4QdcebGK7VBgXW+a2Sr0IfRqNiFxvzDw893UYOuJypmHlCM/tZAho=';
    $to   = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';

    $s = strtr($s, $from, $to);
    $s = base64_decode($s);

    return $s;
} 

Took me less then a minute to get that.

[_matrix_]

Hey,

everything is crackable I guess?

But if you are just hiding it and locking to domain for the client u sold script to they more than likely wouldnt bother trying to crack it anyway

[logic_earth]

To me cracking it or the lack of protection it offers is not the problem.

Its the overhead the huge performance hit something like this adds to the server.
Every page request PHP interprets the file it then runs into the decrypting system which goes though decrypts then forces PHP to reinterpret. not one, not twice, but three times.

Huge performance hit.

[logic_earth]

Using something like Zend encoder the PHP is pre compiled into bitecode and thus not requiring to be interpreted again.

[_matrix_]

Hey,

Zend is all good if you are encoding lots of code to generate the income for the cost of zend, but how bout the average coder that does few jobs for people and dont want their code to be poached and given away?

[logic_earth]

The "average coder" shouldn't really worry about it.
In my mind they are over analyzing a problem that really isn't a problem.

Commercial PHP applications like vBulletin or IPB are paid scripts but there source code is not encrypted.

Yes they are stolen but those who steal it get no support or updates to the latest security patches.

[azuranz]

sure but as I & another guy said earlier, there are some projects where the nature of code you've developed is relatively important and the people you are giving it to or who may have access to it, COULD then use it for their own gains which would be damaging.

as also said, I can't monetarilly justify the purchase of something like Zend etc as I'm not doing that volume / value to cover it! Small Odds jobs but with code that is important to me!

Is it best just to try googling for encode php tutorial & base 64.

BTW: the code file I'm trying to encode at the moment should have no problem with performance. It's only 5kb


PS: that said, how do you handle the possibility of someone decoding a base64 once they have the right key and just reading it?

[logic_earth]

What makes it so important I'm very curious, is it something new never done before?

But you know if you don't trust your clients either get new clients.
Because if you don't trust them it doesn't look very well to the clients.
You may in fact lose business like that. Word of mouth is key.

And honestly if you don't think it is wroth investing in Zend encoder then the code you are trying to protect cannot be that important.
Invest is a key word here.

[CVPer]

i have never done this before. but is that possible to compile your core programs into a module and sell it?

[logic_earth]

With PHP? no not really in terms like that.
PHP wasn't designed and isn't designed for a replacement to destop programming. As such it lacks a lot of feature that those languages have.

But thats okay you don't need them on the web.

[Ernie1]

Do not use something like PHP Lockit.
Here is how easy it is to decrypt it:

function decrypt_phplockit ($s) {
    $from = 'TnPE5s1kL6j4QdcebGK7VBgXW+a2Sr0IfRqNiFxvzDw893UYOuJypmHlCM/tZAho=';
    $to   = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';

    $s = strtr($s, $from, $to);
    $s = base64_decode($s);

    return $s;
} 

Took me less then a minute to get that.

Can you show me how to use this function?
I'm getting the following errors:
Missing argument 1 for decrypt_phplockit()
Undefined variable: s

[Jake Arkinstall]

you need to put what you want to decode in the function:

<?
$pagecontents = file_get_contents("encryptedfile.php");
echo $decrypt_phplockit($pagecontents);
?>

I had this dilemma with a load of classes I created. It actually gained me more money by using it by myself to deliver sites quicker to clients, then getting more refferals. If I had tried to sell the source, it could mean that my direct compeditors could use MY code to beat me to the clients.