tag used.
64 |
65 | function JsCheckField() {
66 | var1="x"
67 | var2="y"
68 | }
69 |
70 | In the example above, concatenation will lead to a malfunctioning
71 | Javascript function.
72 |
73 | function JsCheckField() {var1="x"var2="y"}
74 |
75 | To avoid this you can:
76 | * Turn concatenation off
77 | * echo Javascript like: echo "function JsCheckField() {\n";
78 | * End javascript codelines with ";" (although I haven't tested it)
79 |
80 |
81 | -----------------------------------------------------------------
82 | Files to be scanned
83 |
84 | Do NOT use wildcards or dots here. Just plain alphanumeric
85 | characters
86 |
87 |
88 | -----------------------------------------------------------------
89 | Options
90 |
91 | Parsing, replacing and writing your files can take quite a long
92 | time. In order to not get a timeout error crank it up pretty high,
93 | depending on the speed of your processor and the total size of the
94 | files to be processed. As an indication: for processing 250Kb of
95 | PHP code a timeout of 500 seconds should do fine on a 300 Mhz
96 | processor.
97 |
98 | EXCLUDING USER DEFINED FILE
99 | You probably want to exlude certain files, like useful classfile.
100 | For this option edit $StdExcFileArray var.
101 |
102 | Do not remove the Dummy Entry since it may result in bad breath and
103 | other nasty things.
104 |
105 |
106 | -----------------------------------------------------------------
107 | Standard Variables Exclude Array
108 |
109 | PHP provides a large number of predefined variables to any script
110 | which it runs. Many of these variables, however, cannot be fully
111 | documented as they are dependent upon which server is running, the
112 | version and setup of the server, and other factors. Some of these
113 | variables will not be available when PHP is run on the command-line.
114 | It is adviced not to delete entries from the list below as it may
115 | result in a not working program. To keep things tidy it is adviced
116 | to only add new entries which are clearly predefined PHP variables.
117 |
118 | For adding your own excluded variables it is recommended to edit
119 | $UdExcVarArray
120 |
121 | By the way, PHP has predefined constants too, like __LINE__ ,
122 | __FILE__ and E_WARNING. POBS will automatically skip all these
123 | predefined constants and will only replace constants that are
124 | declared by you with the "define" command.
125 |
126 | EXCLUDING USER DEFINED VARIABLES
127 | You probably want to exlude certain variables. This is particularly
128 | helpful when you make use of these variables in your Query_String.
129 | I.e.: http://www.domain.com/phpprogram.php?uid=234&action=select.
130 | In this particular example you need to add at least "uid" and
131 | "action" to the array below in order to keep your program running
132 | properly.
133 | Do NOT use the dollar sign to indicate the name of a variable here.
134 | The names of the variables, constants and functions are case
135 | sensitive (which should go without saying since PHP is
136 | case-sensitive too.)
137 |
138 | Do not remove the Dummy Entry since it may result in bad breath and
139 | other nasty things.
140 |
141 | **** WILDCARDS
142 |
143 | Only in $UdExcVarArray you can use wildcards. You can NOT use a "?"
144 | but only a "*" which must be placed at the end or start of a
145 | variablename.
146 |
147 | If you define your constants properly you probably do not need to
148 | add constantnames to $UdExcConstArray. My advise would be to name
149 | them all like cERROR, cHTML or cDOMAIN. Start with a lowercase "c"
150 | to indicate a constant and make all following characters uppercase.
151 | This will set them apart from most textelements you use and HTML
152 | tagnames or HTML propertynames.
153 |
154 | -----------------------------------------------------------------
155 |
156 | $UdExcFuncArray
157 |
158 | If you use javascript functions in your PHP code POBS might replace
159 | the name of the javascript function. It's better to prevent this
160 | and add the name to $UdExcFuncArray
161 |
162 | Example:
163 |
164 | function JsCheckField()
165 | alert("I should add 'JsCheckField' to $UdExcFuncArray");
166 | }
167 |
168 |
169 | In future versions of POBS this adding of javascript names will
170 | probably not be needed anymore. But for now it is.
171 |
172 |
--------------------------------------------------------------------------------
/doc/QuickStart/documentation-fr.txt:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/Eccenux/POBS/1ab9c2f104756cee31210e7634bf29cf4713e4a7/doc/QuickStart/documentation-fr.txt
--------------------------------------------------------------------------------
/doc/advantages.htm:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | Advantages
5 |
6 |
7 |
8 |
9 |
10 |
13 | Advantages
14 | In general Encoders like Zend Encoder and Microcode and cachers like APC have the advantage of making it more difficult for others to use your code and get away with your intellectual property. Another objective is to prevent others from peeking into your code and find security holes. 15 | 16 | POBS has the same objectives but establishes it by other means. It's not an ideal solution but it has the following advantages and disadvantages over other methods. 17 |
18 | No need for libraries or decoders POBS works without libraries, modules or decoders. That makes POBS ideal for deploying your application at an ISP or customer. Especially with ISPs it's difficult to persuade them to install the decoder you need (I.e. Zend Encoder). With POBS you can deploy with peace of mind. 19 |
20 | Hard to reverse-engineer POBS removes information from your sourcecode. In a way this is safer than using Zend Encoder or MicroCode since they can be reverse-engineered by adjusting the PHP engine. Not with POBS. With POBS you can almost eagerly hand over the sourcecode to a third party without losing sleep. Zend Encoder and Microcode can not guarantee the safety of your sourcecode ( POBS is not guaranteed either but I hope you understand the difference). 21 |
22 | Cross-platform, cross PHP version Since PHP Obfuscator is written in PHP 4.x and PHP is cross-platform, PHP Obfuscator is cross-platform too. What is more, you can Obfuscate your sourcecode on a Win32 machine and run it without any modification on a Linux machine. 23 |
24 | Compatible with other tools The good thing about PHP Obfuscator is that it doesn't prevent you from using APC Cache or ZEND Cacher in addition. If you really want things secure you might add Zend Encoder. 25 |
26 | Open Source PHP Obfuscator is Open Source GPL style. Since you might want to use PHP Obfuscator to protect your sourcecode you have knowledge of PHP and can adjust PHP Obfuscator to your own liking. Of course, you are encouraged to share your enhancements with the rest of the world. 27 | |
28 |
31 |
32 |
13 | Codingtips
14 | Before being POBSed, you probably need to adjust your sourcecode here and there. Especially in case you have chosen to also replace variables. In a scripting language like PHP, variables may create most of the problems. Below are some problems and solutions.
15 |
16 | Don't name constants after HTML tags POBS finds it hard to really find the constantnames. Contrary to variables, constants in PHP do not start with a indicator like a dollar-sign ($). If you have defined constants with names like "HTML" or "HEAD", POBS will replace both these constants and these HTML tags with a new name, thinking they are constants. In order to avoid this, simply start every (or at least every dubious constantname) with a "c". I personally find it good practise to use uppercase for each constantname except for the first letter. So something like cUSERNAME and cHEAD. This will generally prevent problems. 17 |
18 | Check for parse_str "parse_str" is usefull PHP function which scans a string (i.e. a query_string) and generates variables. So a string with "Var1=3&Var2=X&Var3=123" processed by parse_str would result in the declaration of 3 variables and the according values would be assigned to them. 19 | 20 | This is particularly useful when passing many parameters to a certain function. 21 | 22 | I.e. function ProcessStuff($ParamsStr) { 23 | parse_str($ParamsStr); 24 | If ($Var1==4) echo "Yes"; 25 | If ($Var2=="X") DoThis() ; 26 | If ($Var3==999) echo "Very much"; 27 | } 28 | 29 | ProcessStuff("Var1=3&Var2=Y&Var3=456); 30 | 31 | The example above would go wrong if been processed by POBS. POBS deals with the problems posed by functions like parse_str. POBS not only replaces $Var1 with a new name but also all occurences of &Var1. In the example above, Var2 and Var3 would do fine but Var1 would go wrong. POBS will replace $Var1 but will not replace Var1 in the parameterstring since it is not preceded by an ampersand (&). To avoid this problem simply add a preceding ampersand to the first variable in the parameterstring. 32 | 33 | ProcessStuff("Var1=3&Var2=Y&Var3=456); is wrong 34 | 35 | ProcessStuff("&Var1=3&Var2=Y&Var3=456); is right 36 |
37 | Check for double slashes Removing comments from your source code obviously helps in preventing others using it. You can optionally instruct POBS to remove comments. 38 | 39 | In order for POBS to find comments it searches for double slashes in you code preceded by a space or tab character (like " //"). It does not (yet?) check whether these slashes are somewhere in between quotes (in case they would not be comments). Before using POBS to remove comments you are advised to scan your code for double slashes. 40 |
41 | Dealing with $$Var1 Consider the following code snippet: 42 | 43 | $Var1="Var2"; 44 | $$Var1="Amsterdam"; 45 | echo $Var2; // "Amsterdam" 46 | 47 | $Var2 will have the value "Amsterdam" 48 | 49 | POBS makes the following code of it: 50 | 51 | $V31bff649="Var2"; 52 | $$31bff649="Amsterdam"; 53 | echo $V8c4e34d5; // empty 54 | 55 | As you see POBS has replaced all occurences of $Var2 but not Var2. Therefore this little program will not work as intended. To get it working you need to add Var2 to the $UdExcVarArray in pobs-ini.inc. 56 | 57 |
58 | Dealing with $GLOBALS and $HTTP_POST_VARS $GLOBALS is a predefined array in which all the global variables are present. In many programs variables are added to this array. 59 | 60 | POBS replaces both $Var as $GLOBALS["var"] or $GLOBALS[var] occurences in your code so this will generally not cause problems. But you might have a strange unusual situation with i.e. $GLOBALS[strtolower($VarX)] where POBS will not work properly. You would have to add $VarX to the exclude user-defined variables array in pobs-ini.inc. 61 | 62 | POBS does NOT deal with $HTTP_POST_VARS, $HTTP_GET_VARS and $HTTP_COOKIE_VARS. You might add them yourself if you want by copying the ereg_replace code for $GLOBALS and replace GLOBALS with i.e. HTTP_POST_VARS. 63 | 64 |
65 | Cookies Cookies might cause problems since they are used in a normal fashion but defined and set in an unusual way. 66 | 67 | setcookie ("TestCookie", "Test Value"); 68 | echo $TestCookie; 69 | 70 | After POBS has done it's work the cookie "TestCookie" will still have be set but displaying the contents of the cookie will result in an empty string. 71 | 72 | In the future POBS might just deal properly with this problem by also replacing setcookie("CookieName", "CookieValue") with setcookie("Veda45e23", "CookieValue"). But now it doesn't and here is what I suggest you to do. 73 | 74 | Exclude all cookievariables by adding them to $UdExcVarArray in pobs-ini.inc. This is easiest done (and most secure) if you name every cookie according to a naming convention. Personally I start all cookienames with "whc_" so that I only have to add "whc_*" to the array. It's also good coding if you ask me. Scan your sourcefiles for the PHP function "setcookie" and give the first parameter a new name. 75 |
76 | Forms and fields If a user submits a form that is given to a PHP script, PHP automatically creates variables with names corresponding with the names of the input fields of the form. 77 | 78 | POBS deals with this by also replacing every field in every form 79 | 80 | So, consider the following HTML code: 81 | 82 | <FORM METHOD=POST ACTION=do-it.php> 83 | <INPUT TYPE=TEXT NAME=address> 84 | <FORM> 85 | 86 | The PHP script do-it.php has references to $address. POBS will replace it. And POBS also replaces NAME=address with that same value. 87 | 88 | A problem arises when a program outputs forms automatically. POBS can no longer find code like : 89 | 90 | echo "<INPUT TYPE=TEXT NAME=address>"; 91 | 92 | but will instead find something like: 93 | 94 | echo "<INPUT TYPE=TEXT NAME=".CreateFieldName("address").">"; 95 | 96 | and will not replace the latter fieldname. 97 | 98 | The remedy would be (that's what I did) to let all created fieldnames by CreateFieldName() start with the same letters. Something like "field_". This would result in something like "field_address" and "field_phone" etc).You would than just have to add the entry "field_*" (don't forget the wildcard!) to the $UdExcVarArray in pobs-ini.inc and the problems are over. 99 |
100 | Javascript functions Formerly I stated that when you were using inline Javascript you need to make adjustments. I was wrong. The only possible problem with inline Javascript I know of, is that you can't let POBS concatenate lines if you haven't ended each Javascript codeline with a semicolon ";". I guess this doesn't need extra explanation. 101 | 102 | POBS does not (and can not easily) discriminate between JavaScript functions and PHP functions. It you declared a Javascript function named "X", POBS will replace this Javascript function and all references to it. As far as I know this will not create problems so there is no need to worry. 103 | 104 | If you don't want your Javascript functions to be replaced, i.e. in case you want to debug it more easily, you can add them to $UdExcFuncArray in pobs-ini.inc or you can replace the inline Javascript with Javascript echoed by PHP. An example is shown below: 105 | 106 | echo "function JsCheckField() {n"; 107 | echo "<Javascript code lines>n"; 108 | echo "}n"; 109 | 110 | This way POBS doesn' t consider "JsCheckField()" to be a function that needs replacement. 111 |
112 | Inline HTML and <pre> Programmers can use inline HTML in their PHP files. When POBS is instructed to concatenate codelines it normally is not a problem and doesn't compromise the HTML since carriage returns are not presented by return characters in HTML but by <br>. But, when <pre> is used before a piece of HTML code the browser interprets each return character as a <br>. Another problem with inline HTML is laid out in the paragraph below. 113 | 114 | <pre> 115 | This text will be displayed exactly as is seen here. 116 | Every return in this text is interpreted as a carriage return by your browser. 117 | </pre> 118 | 119 | And this is what POBS can make of it: 120 | <pre> 121 | This text will be displayed exactly as is seen here.Every return in this text is interpreted as a carriage return by your browser. 122 | </pre> 123 | |
124 |
127 |
128 |
13 | Contact
14 | If you have questions, suggestions, alterations or comments about POBS please let me know.
15 | 16 | You can send an email to pobs@domein1.com 17 | 18 |
19 | License Copyright (C) 2001 Pinkeltje 20 | 21 | This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published bythe Free Software Foundation; either version 2 of the License, or (at your option) any later version. 22 | 23 | This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. 24 | 25 | POBS is distributed together with a GNU General Public License of the Free Software Foundation 26 | |
27 |
30 |
31 |
13 | Disadvantages
14 | Your probably have to adjust some codelines to get it working The downside of POBS is that it won't guarantee that your code will work properly without adjustments. This has to do with the way scripting languages like PHP deal with variables. As you probably know you can dynamically define (maybe "use" is a better word) variables in PHP. This poses a problem for POBS or any other Obfuscator. But you can deal with it by scanning your code for things like $$VarName and parse_str and edit your code or add variables to the array of excluded variables ($UdExcVarArray). 15 | 16 | I must say though that many of the coding adjustments that I suggest are actually good (and normal) coding practices. Like starting every constant with a lower "c" and putting the rest in uppercase. Or naming all variables of a certain kind according to a naming convention. 17 | 18 | See Codingtips and Debugtips on how to prevent problems and get your code working (I got my 300 Kb code working without my own advice so there is no need to get discouraged). 19 |
20 | No password protection POBS will not protect against the proliferation of passwords used in your sourcecode. I.e. if your PHP program connects to a MySQL database you probably use the PHP function "mysql_connect". One of the parameters is a password. POBS doesn't obfuscate the function (since it is not user -defined) nor the password. You might make a deliberate complex function that generates a password but a hacker could just call that function and see what it returns. 21 | 22 | For me, protecting against database passwords or stuff is not really important because POBS is essentially targeted at applications that need to be deployed. I.e. on a customers computer. In that situation a customer might have full access to the computer and deals with his own data in the database anyway. 23 | 24 | Zend Encoder and Microcode Encoder do protect passwords since they encrypt those too (they probably encrypt the whole PHP file like "WinZip + password" would do). 25 |
26 | Beware of inline Javascript in your PHP code Formerly I stated that when you were using inline Javascript you need to make adjustments. I was wrong. The only possible problem with inline Javascript I know of, is that you can't let POBS concatenate lines if you haven't ended each Javascript codeline with a semicolon ";". I guess this doesn't need extra explanation. 27 | 28 | POBS does not (and can not easily) discriminate between JavaScript functions and PHP functions. It you declared a Javascript function named "X", POBS will replace this Javascript function and all references to it. As far as I know this will not create problems so there is no need to worry. 29 | 30 | If you don't want your Javascript functions to be replaced, i.e. in case you want to debug it more easily, you can add them to $UdExcFuncArray in pobs-ini.inc or you can replace the inline Javascript with Javascript echoed by PHP. An example is shown below: 31 | 32 | echo "function JsCheckField() {n"; 33 | echo "<Javascript code lines>n"; 34 | echo "}n"; 35 | 36 | This way POBS doesn' t consider "JsCheckField()" to be a function that needs replacement. 37 | |
38 |
41 |
42 |
13 | Download
14 | The files are a mere 17Kb in size. If you would ask MicroSoft, this requires distribution via CD Rom. And an install-program of course.
15 |
16 | Version 0.91 - November 7th 2001
23 | pobs091.tar.gz Unlike the previous version of POBS (0.9), version 0.91 does not come with documentation in the form of this website.
24 | 25 |
26 | Version 0.9 - october 20th 2001 pobs09.zip Winzip 27 | |
33 |
36 |
37 |
13 | Example
14 | In the example below you see the result of the 15 Kb POBS program that's been processed by POBS itself. Both variables, functions and constants have been replaced. Also, comments and indents have been removed and lines have been concatenated.
15 | 16 | For sucessfully POBSing POBS you only need to add the variable "PA" to $UdExcVarArray. PA is used in the query_string of POBS. 17 | 18 | The words you can still recognize are: 19 |
28 |
|
86 |
89 |
90 |
13 | Getting started
14 | Installing POBS is as easy as I could think of. Just unzip the file pobs.zip and put it a directory that's accessible by your webserver. POBS is a collection of files in just 1 directory. The documentation is spread over 2 directories.
15 | 16 | Before executing POBS you are advised to read the manual that is provided through this website. Also check the settings in pobs-ini.inc and adjust them to suit your needs. When you run POBS for the first time, you should at least adjust the $SourceDir and the $TargetDir variables. 17 | 18 | If you have a large amount of PHP source to be POBSed, check your php.ini and see whether it runs in "Safe mode". If it does, POBS can not adjust the timeout setting as indicated in pobs-ini.inc and the processing might be terminated before POBS has finished the replacement of all your PHP codefiles. You might need to restart your webserver after adjusting the php.ini file. 19 | 20 | After having checked everything and having adjusted the settings in pobs-ini.inc you point your browser to pobs.php and press <Enter>. You will see something like the screen below. 21 | 22 |
23 | Start modestly If you run POBS for the first time you are adviced to turn $ReplaceVariables off by setting it "FALSE"; That way you have a bigger chance your program still works after being POBSed and if not you can more easily debug it. 24 | 25 | $ReplaceFunctions=TRUE; 26 | $ReplaceConstants=TRUE; 27 | $ReplaceVariables=FALSE; 28 | 29 | I strongly advise you to turn the variables below off. You should turn them on only after you made sure your application works fine with functions, constants and variables already replaced. 30 | 31 | $RemoveIndents=FALSE; 32 | $RemoveComments=FALSE; 33 | $ConcatenateLines=FALSE; 34 |
35 | 
36 |
37 | Click on "Start scanning and replacing" and POBS will start working. 38 | 39 | While processing POBS will give you information about: 40 |
|
48 |
51 |
52 |
13 | Guestbook
14 | Let me know what you think of POBS and / or this site and add to this guestbook.
15 |
16 |
58 | |
59 |
62 |
63 |
13 | Links
14 | POBS is not proclaimed to be an ideal solution for securing your intellectual property. Below are some links to other options.
15 |
16 | Zend Zend provides many tools for PHP programmers. It also maintains the PHP sourcecode. It's tools are closed-source and have a pricetag. Most of them, that is. 17 | 18 |
19 | Microcode Microcode PHP encoder This German company has released a free and open competitor to Zend Encoder in august 2001. Check it out. I wonder whether is works together with APC. Maybe they can team up. 20 | 21 |
22 | APC APC Alternative PHP Cache. Useful stuff to speed up (large) PHP applications. 23 | 24 |
25 | BWCache Afterburner BWCache works with Win32. 26 | 27 |
28 | GNU POBS is licensed under GPL 29 | GNU - Free Software Foundation The GNU Project was launched in 1984 to develop a complete Unix-like operating system which is free software: the GNU system. (GNU is a recursive acronym for ``GNU's Not Unix''; it is pronounced "guh-NEW".) Variants of the GNU operating system, which use the kernel Linux, are now widely used; though these systems are often referred to as ``Linux'', they are more accurately called GNU/Linux systems. 30 | 31 | 32 | |
33 |
36 |
37 |
20 |  |
21 |
| 24 | 25 | Home | 26 |
| 29 | 30 | How it works | 31 |
| 34 | 35 | Example | 36 |
| 39 | 40 | Advantages | 41 |
| 44 | 45 | Disadvantages | 46 |
| 49 | 50 | FAQ | 51 |
| 54 | 55 | Codingtips | 56 |
| 59 | 60 | Debug Tips | 61 |63 | 64 | Settings | 65 | 66 |
| 68 | 69 | Getting started | 70 |
| 73 | 74 | Todo | 75 |
| 78 | 79 | Links | 80 |
| 83 | 84 | Contact | 85 |
13 | SettingsThe file pobs-ini.inc controls many aspects of POBS behavior. POBS will try to include it and looks for it in the current working directory.14 | Instead of a real "ini-file" it's just a plain PHP scriptfile. It is assumed you are familiar with PHP code syntax if you use PHP Obscure so configuring this file won't give you too much trouble. 15 | 16 |
17 | Replace selectively When you first use POBS you are advised to NOT replace variables immediately. Just replace functions and constants first and see whether your program still runs properly. If it does, you might want to replace variables as well. 18 | 19 | $ReplaceFunctions=TRUE; 20 | $ReplaceConstants=TRUE; 21 | $ReplaceVariables=FALSE; 22 |
23 | Exclude variables, constants or functions You probably want to exclude certain variables. This is particularly helpful when you make use of these variables in your Query_String I.e.: http://www.domain.com/phpprogram.php?uid=234&action=select. 24 | In this particular example you might need ( I do strongly recommend it) to add at least "uid" and "action" to $UdExcVarArray in order to keep your program running properly. It also prevents your URLs from appearing extraterrestrial) Do NOT use the dollar sign to indicate the name of a variable in this array. The names of the variables, constants and functions are case sensitive (which should go without saying since PHP is case-sensitive too.) 25 | 26 | My advice would be to use a naming convention for all QUERY_STRING parameters. Personally I use variablenames like "PA" and "POR" in the QUERY_STRING so that they can easily be dealt with and can easily be excluded from being replaced by POBS (by adding them to $UdExcVarArray). 27 | 28 | $UdExcVarArray=array("Dummy Entry","var1","var2","var3","params_*","whc_*"); 29 | $UdExcConstArray=array('Dummy Entry',"FRAMESET"); 30 | $UdExcFuncArray=array('Dummy Entry', "CheckValue"); 31 | 32 | Do not remove the Dummy Entry since it may result in bad breath and other nasty things. 33 |
34 | Predefined PHP Variables It is essential that POBS does not replace Predefined PHP Variables. These variables are included in the $StdExcVarArray. Since newer versions of PHP can have new predefined variables you might add these yourself. 35 | 36 | It is adviced not to delete entries from $StdExcVarArray as it may result in a none-working program. To keep things tidy it is advised to only add new entries which are clearly predefined PHP variables. 37 | 38 | For adding your own excluded variables it is recommended to edit $UdExcVarArray 39 |
40 | Source and target directories Before running POBS for the first time your need to change both directories to your liking. POBS will not create the directories for you in case they don't exist. 41 | The program will not run in case source and target directory are identical. Make sure the source directory is read enabled and the target directory is write enabled. Directories are case-SENSITIVE (Well, not on Win32, that is) 42 | 43 | $SourceDir="/application/php"; 44 | $TargetDir="/application/phpcrypt"; 45 |
46 | Remove comments and indents and returns To further obscure your sourcecode you can remove the comments and indents. This should only be done in the end, when you have replaced variables, functions and constants and are certain your obfuscated code works. 47 | 48 | $RemoveComments=FALSE; 49 | $RemoveIndents=FALSE; 50 | $ConcatenateLines=FALSE; 51 | 52 | The concatenation of lines can create problems when used with inline Javascript or inline HTML with the <pre> tag used. 53 | 54 | function JsCheckField() { 55 | var1="x" 56 | var2="y" 57 | } 58 | 59 | In the example above, concatenation will lead to a malfunctioning Javascript function. 60 | 61 | function JsCheckField() {var1="x"var2="y"} 62 | 63 | To avoid this you can:
64 | |
68 |
71 |
72 |
13 |
14 | Home15 |16 | This documentation is dated: November 8th 2001 17 | 18 |
19 |
20 |  News! Version 0.91 released!
26 | Hand over the code and still sleep well POBS stands for PHP Obfuscator/Obscurer. It is a free and open PHP program that makes PHP sourcecode almost impossible to read and edit for normal humans. It is a simple way to protect your PHP sourcecode from people who would like to adjust it or who would like to know its workings. Now you can deploy your application and feel pretty safe about it. 27 |
28 | How it works POBS works by replacing User-defined functionnames, variables and constants with a MD5 key of 8 characters. It really removes information that humans would like to have but computers don't care about. It's not ideal but quite a good option in my idea. 29 |
30 | Advantages
41 | Share your experiences and thoughts In order to make POBS more userfriendly, secure and feature rich, you are invited to share your experiences with us. You can use the guestbook or email. 42 |
43 | |
44 |
47 |
48 |
13 | Debug TipsThe downside of POBS is that it won't guarantee that your code will work properly. Another is that you might have to adjust your code to get it working. I must say though that many of the coding adjustments that I suggest are actually good (and normal) coding practices.14 | 15 | The good thing is that I can tell you where you have to adjust your code. 16 | 17 | In my case I had almost 300 Kb of PHP code before I started designing POBS. It took me a while to adjust my code to get it working properly after being processed by POBS. If your program doesn't work properly after been POBSed, here is some debugging advice. 18 | 19 |
20 | Debugging After using POBS you might want to check whether your program still works properly. If it doesn't you need to debug. 21 | 22 | In the PHP - includefile named "pobs-ini.inc" you can indicate if you like POBS to concatenate lines and to remove indents. If you set them to FALSE you will be able to more easily read the obfuscated code and see where things have gone wrong. 23 | 24 | $RemoveComments=TRUE; 25 | $RemoveIndents=FALSE; 26 | $ConcatenateLines=FALSE; 27 | 28 | In order to debug you want to know if the problem lies with the replacement of variables, functions or constants. Normally, variables give the most problems since a scripting language like PHP allows you to declare them very dynamically (think for instance of $$Var or the PHP function "parse_str"). So you want to continue more modestly and turn the replacement of variables, constants and functions on and off. That way it's easier to conclude where your code causes problems. 29 | 30 | $ReplaceFunctions=TRUE; 31 | $ReplaceConstants=FALSE; 32 | $ReplaceVariables=FALSE; 33 | |
34 |
37 |
38 |
13 | Todo
14 | POBS is a work in progress and it will progress faster with userinput from people like you. My goal is to offer a tool which would be easy to use for the average user and would be foolproof for the average kind of PHP code (would require few codeline adjustments).
15 | 16 | Here is my wishlist for versions after 0.91: 17 |
24 | |
25 |
28 |
29 |
13 | How it works
14 | Replace names POBS replaces user-defined (NOT predefined) functions, constants and variables with a MD5 key of 8 characters. (It doesn't use MD5 keys of 32 bytes, which is standard, since that would increase the size of your sourcecode). 8 bytes seems enough to give each functions or variable its unique name. MD5 is not reversible. 15 | 16 | The first letter of the new functionname is a "F", of a variable a "V" and of a constant a "C" 17 | 18 | The function with name MakeImageHtml is replaced by Fee2c1bdc 19 | The variable $ImgText is replaced by $V1d9d94a6 20 | The constant USERDIR is replaced by C389a367e 21 |
22 | Futher obscuring In addition, POBS can be instructed to concatenate lines and remove comments and indents. These are not irreversible since a person can write a program to add indents and returns. But it really makes a mess of your code and therefore furtherly discourages many wouldbe hackers from trying to reverse-engineer your code. 23 |
24 | Exclude stuff POBS allows you to indicate which user-defined variables, constants and functions need to be excluded from replacing. In the settings file "pobs-ini.inc" you can add these names to the arrays $UdExVarArray, $UdExcConstArray and $UdExcFuncArray. Do NOT use dollarsigns here. 25 | 26 | In $UdExVarArray you are allowed to use wildcards in the form of an asterix (*) at the end of each variablename. I.e. params_* will exclude params_type, params_address and params_name. So if you name your variables to a certain convention you can easily and securely exclude them by group. This way you don't have to be afraid you forgot to add it to the array in case you added a new variable to your code. 27 |
28 | Process POBS consists of 2 major processes. 29 | 30 | 1. POBS first scans all the files with the file-extensions allowed in the sourcedirectory. While scanning, it makes a list of userdefined variables, functions and constants it has located in your sourcecode 31 | 32 | 2. POBS now knows which ones it should replace and starts writing new files in the target directory. 33 | |
34 |
37 |
38 |