Solved thread

This post is marked as solved. If you think the information contained on this thread must be part of the official documentation, please contribute submitting a pull request to its repository.

Phalcon and Zephir solution to compiling and obfuscating PHP code

Seeing how bcompiler is stuck back on PHP 5.3 support I'm wondering if there are currently any plans to create tools for compiling PHP code into bytecode like bcompiler does?

It seems that Zephir will not be protecting PHP code directly and is more suitable for libraries and generally useful frameworks. I think that it would be very useful to have something similar to bcompiler working and integrating into the new Zend Optimiser+ opcode cache in a way that would preserve the (commented out) Phalcon annotations.

This opens up new ways for Phalcon based PHP code to be deployed and protected. One half of the solution can protect some lower level parts of a proprietary technology and the other half (that I'm proposing) could protect the PHP portion that is using Phalcon.

The performance gain would be a slightly quicker first hit. If a PHP project were compiled in this way then it could create a manifest of the files that are present and then stored in memory so that unnecessary fstats could be avoided when looking for dynamic hooks (that would have been already completely defined for the project at that point).

Also I have still not found any tool available that can replace bcompiler that can be run purely from the command line.

It depends on what you obfuscate.

Zephir could definitely handle the task if you proceed with caution. For instance you could have objects that handle your code, obfuscate those using Zephir and then your PHP code will just make some calls to those objects which will in turn end up being black boxes, not showing their functionality as PHP code does.

Since these are very early days in Zephir's development we don't necessarily know exactly how things will end up, long way to go :)



42.5k

In that case it would be very useful if there was a way to read in compiled files .zr files or whatever you call them require() them with an autoloader as the project moves along. Then Zephir could provide obfuscation and increased speed at the cost of being able to use higher level language constructs.

So PHP module creation is the primary goal but whats about adding a bcompiler style compiler and runtime system that can handle those files at runtime in the same way that bcompiler can automatically detect when a bcompiler compiled file is being loaded.

I'm rather weak to ignorant on compiler theory and the internals of PHP and Phalcon but perhaps there could be a few options for which level of high level features to allow to allow. Like a strict quick mode and another mode that allows some slower high level code paths to be hit. This slower mode would be intended to allow for the little object black boxes to internally use more high level stuff. This proposal here might well be over the top crazy so I admit that. Still though something to think about.

Somehow someway filling the bcompiler gap will have a huge amount of utility.



42.5k
Accepted
answer

The current solution is to use something like Ion Cube and Zephir to protect code.