0

Possible Duplicate:
Best solution to protect PHP code without encryption

Can anyone tell me if it is okay/acceptable to obfuscate ALL function names in PHP?

For example, this seems to work using an online tool:

Original:

if(file_exists($file)){chmod($file,0644);echo"good";}

Obfuscated:

$x0c="\143hm\x6f\144"; $x0d="\x66\x69\x6ce\x5f\x65\170\151\x73\164\x73"; 
if($x0d($x0b)){$x0c($x0b,0644);echo"go\x6fd";}?>

My questions:

  1. Notice it no longer has file_exists or chmod functions, but will this work on any PHP installation setup/version?
  2. Using this method, can any PHP function be done such as these: file(), eval(), base64_decode(), file_get_contents(); str_rot13(), strpos(), touch(), filemtime() ?
  3. Does this work on windows, linux, etc.. servers?
Community
  • 1
  • 1
  • 2
    Writing some nefarious code, are we? Remember that Santa's keeping a list of who's been naughty and who's been nice... ;-) – Jonah Bishop Dec 21 '12 at 03:17

1 Answers1

0
  1. Notice it no longer has file_exists or chmod functions, but will this work on any PHP installation setup/version?
  2. Using this method, can any php function be done such as these: file(), eval(), base64_decode(), file_get_contents(); str_rot13(), strpos(), touch(), filemtime() ?
  3. Does this work on windows, linux, etc.. servers?

Yes, yes and yes.

Can anyone tell me if it is okay/acceptable to obfuscate ALL function names in PHP?

No, no, and hell no.

So, while this code works, there are a few big problems:

  1. The more you obfuscate, the slower the code gets. Simple fact of life.
  2. It's trivial for advanced users to simply undo all of your work. If you're trying to obfuscate the source as an anti-piracy measure, you can straight up not bother.
  3. If you're trying to obfuscate the source in an attempt to do evil things, beware that this stuff sticks out like a sore thumb as being "wrong" looking and thus is easy to simply remove.
  4. Finally, even though you're hiding the names of the functions, you won't be able to bypass PHP's built-in disable_functions configuration setting.
Charles
  • 50,943
  • 13
  • 104
  • 142
  • Man alive, why does everyone assume so much? Aside from being WRONG, it is rude and insulting! Thank you to Charles for the help. Can you tell me WHY this works? What is that character encoding called, or how does it work???? – user1914191 Dec 22 '12 at 20:07
  • Are you talking about the backslash encoding? [The PHP manual page on the string type explains how it works](http://php.net/language.types.string). The ones starting with `\x` are hex encoding of a byte, while the ones starting with just the `\ ` and then containing only numbers are octal encoding of a byte. – Charles Dec 22 '12 at 20:23
  • Charles - thank you! that's what I was wondering! – user1914191 Dec 26 '12 at 22:27