Free PHP script encoder

[bgardner333]

@sdesigns

Hmm… well I made my own file_get_contents function, and now it says token_get_all…

If this is all needed for the encryption… fine, I could live with encoding on a remote server… but what about when the end-user runs it? Do you have the system requirements listed for running an encrypted file?

Sorry about that!
As far as I know, it currently requires PHP 4.3.x
I wasn’t aware that file_get_contents wasn’t available in 4.1.x

And here is a list of (current) limitations on freelock :
No breaking in and out of PHP (I know, it’s a pain in the ***, but I am working on a parser for that purpose, that will split the code into a few variables, etc)
Only works on scripts that start with <?php and end with ?>
can’t think of the others right now…

But here is what I am working on :
FreeLock PHP extension (dynamically loadable or can be compiled right into PHP)
Support for scripts that break in and out of PHP
Encoding of segments (to allow people to customize PARTS of the script)

This is kind of slow going, as I am pretty busy these days. But I won’t give up until I have made a VERY usable (and documented!!!) script encoder.

Thanks all for your interest!
Please, send me as much feedback as you can. I want you to like FreeLock!

[subnet_rx]

@colinr

i don’t like the idea… kinda against the whole OSS philosophy isn’t it?

use other people’s freely given time and effort (and money) [apache, php, mysql, etc, etc] to write a script and then set up a system where you control who can use it or not…

I wonder where we would all be if apache/php/mysql used that same thinking…

secondly, if someone buys a php script package from you, why not let them tailor it to their needs?

Not that I think you are a bad person er something. just think its kinda hypocritical to make an open-source [its on sourceforge right] program that is built to make other programs (or scripts, etc) closed-source…

I’ve got to agree with this. Build a program to encrypt Microsoft scripts, much more fitting. Personally, I like to open source world and contributing to it.

[Carl]

well, after two sleepness nights I finally made some progress on the embedded PHP functionality. It works nicely. Uses regular expressions that eliminate the need for that str_replace of the PHP tags.

[triexa]

…I just wish it didn’t require PHP 4.3.0

[amitgupta]

why don’t you just install PHP4.3?? Besides, PHP5 is nearly out,
so you look holding onto antique software.

[triexa]

I could upgrade if I really wanted to … heh

But i would lose a LOT of customers if I increased my product’s requirements to v4.3.x… currently its at 4.1.0!

[amitgupta]

Maybe, but most hosts have atleast v4.3.3 installed, so I doubt
that your clients will face any problems there. If a host has anything
lower than v4.3.3, I for one wouldn’t host with them, there are plenty
of them offering v4.3.3, so why would I go with one which give me
outdated software?

[JClawson]

you know guys this really doesn’t protect your source code at all. Its super simple to print it out again. Just takes a 1 liner.

The only way to really protect your source is to use a byte code encoder like zend encoder. And if you are really serious about protecting your code… its not expensive… a small business package which comes with zend IDE, performance suite, and encoder costs like 200 bucks. I bought it and it was definitly worth the money.

[bgardner333]

@Carl

well, after two sleepness nights I finally made some progress on the embedded PHP functionality. It works nicely. Uses regular expressions that eliminate the need for that str_replace of the PHP tags.

Very cool. I was using the PHP builtin tokenizer to identify tags (makes it pretty easy)

Would you care to share your enhancements to freelock?

[bgardner333]

@JClawson

you know guys this really doesn’t protect your source code at all. Its super simple to print it out again. Just takes a 1 liner.

The only way to really protect your source is to use a byte code encoder like zend encoder. And if you are really serious about protecting your code… its not expensive… a small business package which comes with zend IDE, performance suite, and encoder costs like 200 bucks. I bought it and it was definitly worth the money.

Ah, but the zend encoder can be cracked as well (and as far as the whole
encoding thing, I realize that there is no way to be really secure using a PHP include, as the PHP include is just gzipped/base64’d 20+ times.

That is why I am writing a PHP extension module (dynamically loadable, of course) to address these issues. People can then customize their encryption methods.

[JClawson]

@bgardner333

Ah, but the zend encoder can be cracked as well (and as far as the whole
encoding thing, I realize that there is no way to be really secure using a PHP include, as the PHP include is just gzipped/base64’d 20+ times.

That is why I am writing a PHP extension module (dynamically loadable, of course) to address these issues. People can then customize their encryption methods.

Actually zend encoder cannot be cracked…sorta Since it is converted into bytecode, php doesn’t need to interpret and compile it. PHP directly runs that code. You will never be able to reverse engineer the code to the way it was first written…ever… its simply not possible. It is possible to product some code that would work the same but it would be highly cryptic and unreadable. You wouldn’t be able to feed it directly into php… you would have to be able to interpret php’s high level constructs.

Your method can easily be reverse engineered to produce the original source code without any advanced programming knowlege. It can be done directly with a 1 line php statement. It may deter noob php programmers but isn’t suitable for the professional world because:

1. Easily reverse engineered. No way to truly protect it using your method.
2. Increases runtime significantly. Probably over 100% in most cases. Zend optimizer actually speeds execution up over 7 times

It is a cool experiment in php but you should warn users that it can be bypassed and professional solutions should utilize zend encoder.

The php module could help but not if you use the same method as you are doing now. You would have to convert it to some type of proprietary binary format. Problem is, your project is open source… so that makes it easier to reverse engineer.

The only way to make it hard to reverse engineer is to bypass the php interpreter and feed it bytcode directly.

Cool experiment… just put a notice on the site that it can be reverse engineered and shouldn’t be used in a professional environment

[Daijoubu]

Actually, the Zend optimizer slow down more than speeds up
The time it takes to “optimize” your code out weight the benefits (gain)

The Zend Accelerator/PS is another story though…

[JClawson]

@Daijoubu

Actually, the Zend optimizer slow down more than speeds up
The time it takes to “optimize” your code out weight the benefits (gain)

The Zend Accelerator/PS is another story though…

heh… thats not true at all. Zend encoder encodes php into bytecode before you publish to the web. Optimizer runs the bytecode that is already encoded. You will usually see a small increase in speed (30-40%) using only zend encoder/optimizer. Zend Performance Suite (which i also have) gives me an average of 10 - 20X increase in speed.

The biggest time is the actual compiling/interpretation of the php into byte code. (Roughly half of the execution time) Zend optimizer doesn’t need to compile the encoded byte code. This is how you get the speed increase.

Performance suite will cache frequently used php code so there is no interpretation step either… it can also cache output and a whole lot of other stuff… thats where you get the HUGE increase in speed.

---

granted it might be slower if your php files are not encoded and can’t be optimized by zend optimizer… then you would get the overhead but none of the benefits… but if you encode your php files then it will always be faster… or at least never slower

[Daijoubu]

I was talking about non-encoded script

[JClawson]

@Daijoubu

I was talking about non-encoded script

k

[freekrai]

@JClawson

Cool experiment… just put a notice on the site that it can be reverse engineered and shouldn’t be used in a professional environment

Take a look at CodeLock, it’s commercial, easily reversed and doesn’t have that message anywhere telling it’s customers that it can be easily reversed.
They do hovever point out that reverse engineering the code is illegal and include ainfo to that effect.

[Carl]

Hmm,

I am interested in just how easy the reversing is. Anyone want to give it a try with some simple code that I have encrypted??

[freekrai]

@Carl

Hmm,

I am interested in just how easy the reversing is. Anyone want to give it a try with some simple code that I have encrypted??

Put it up here.

[Carl]

Okay, The lines are really long so as to not break the forum I will use " <-continued-> " as a break.

freelock.php

<?php @eval(gzinflate(base64_decode('nVNRb9owEH4mv+KkRiKoZe2kqS+Mh25KO7SqVATxsKqKH<-continued->
OcCVi0bOQ4MEP99FxzSQGk3zZKV+O77vnx353hnHy6PNtw
<-continued->
axHvNX2CguCxShMXnT1cJ7NPJCr4ZwRTcMZMqNOBWlf5I3M9IWZJyzLgVC4Q+tFftHlxe5hrsjFlYIrwovQRhQeTApEGWrk
<-continued->
A4H6nnZYUiplbAWY5xvmTzwBdqXtgObDyATBs69696vviaWyNR7dMUOT93IACRBWhwGrSfWHf93L5wmCdfPHdKSAvg
<-continued->
NUIeScnqYj5HEzSQPa+1BZQ5NuRuur/+UU7q5Xtymy2ZLLdBWxhVkXvetlF+XiTJymL+P9X7nExok1bJjS+25dcp3O3DdflW
<-continued->
xwnIZyTKCfBXTylynWL8WzKLB74qzuvIjt13Tgrl3Ii5DXz3dFJTqRMmwS9Iai1FUtqqAOT10EHFKyE0oZoC/d2tq7tRs6drob
<-continued->
IdNSGn119iJ1cLuR5UMzrinmYcN82FD4utfwlTqGatLVp1uT/G48c4CkeTcBRPbkbRhYs8DqNx83wXjt+kbwf34T4QPkx2+dI
<-continued->
XvNH/Phz+HIRNgSiMosHwoeK0kM804ILJ4PSEylvklcX9AQ=='))); ?>

header.php

<?php
$use_zlib="y";
 if(!file_exists("freelock.php")) {
 echo "freelock not found - exiting";
 exit; }
?>
<?php include_once("freelock.php");?>
<?php $s1 =":1oWqsXsq7lwORn^igQpOnJ9jQvI]]qZRryw^}
<-continued->
o|OVpry;xOZ|zYQQWYRu_x[MjqwkVh?nx<Oh|<MN|Gsn1gKPSw>~]}shyg9hNgjR^{WomlI?
<-continued->
MG=hU};hWnGPiw}XKzO=^`W<1U~kN5Q=^1Olq[MV:jVjoMmYksM`mN7lm9W_tW:ggCC";?&gt;
&lt;?php freelock_run($s1); ?&gt;

&lt;a href="header.php?test=thisshows"&gt;test&lt;/a&gt;

&lt;form action="header.php" method="POST"&gt;
&lt;input name="test" type="text"&gt;
&lt;input name="send" type="submit"&gt;
&lt;/form&gt;

&lt;p&gt;Test $ variables:&lt;/p&gt;
&lt;?php $s1 ="{1jO{ORpXyM^|rh|{gXu`67|gvmgxnmpQP|k_MMQ;€^RqvMS1_ySpoqluIWqsXsq7mg&lt;txzYQ
&lt;-continued-&gt;
QWYMuqoMQG]w}NUQUwZyMWo}pmso{g";?&gt;
&lt;?php freelock_run($s1); ?&gt;

I am putting up some text file in case the forum messes up the code

http://www.heroforhire.net/ex/freelock.txt

[freekrai]

5 minutes later, here’s header.php:

<?php /* don't really need this include anymore ;)
 $use_zlib="y";
 if(!file_exists("freelock.php")) {
  echo "freelock not found - exiting";
  exit; 
 }
*/ ?>
<?php
print "\\$HTTP_GET_VARS:".$HTTP_GET_VARS["test"]."<br>";
print "\\$_GET:".$_GET['test']."<br>";
print "\\$HTTP_POST_VARS:".$HTTP_POST_VARS["test"]."<br>";
print "\\$_POST:".$_POST['test']."<br>";
print $test."<br>";
print "\\$HTTP_SERVER_VARS:".$HTTP_SERVER_VARS["DOCUMENT_ROOT"] . "<br>";
print "\\$_SERVER:".$_SERVER['DOCUMENT_ROOT'] . "<br>";
?>
<a href="header.php?test=thisshows">test</a>
<form action="header.php" method="POST">
<input name="test" type="text">
<input name="send" type="submit">
</form>
<p>Test $ variables:</p>
<?php
$text1 = "Some text test";
$text2 = "Carl McDade";
print $text1."<br>";
print $text2."<br>";
print "$text1<br>";
print "$text2<br>";
?>