How safe is PHP bcompiler encoded code?

Question

I'm interested if anyone knows exactly how effective/safe/protected PHP's bcompiler is against reverse engineering. The introduction page makes a bold claim:

In terms of code protection, it is safe to say that it would be impossible to recreate the exact source code that it was built from, and without the accompanying source code comments. It would effectively be useless to use the bcompiler bytecodes to recreate and modify a class.

Perhaps the key word is "exact" -- how true is their claim if you remove it?

PS - Please, no lectures about compilation/obfuscation versus licensing. :)

The identifiers and comments should definitely be gone or changed. — Ry-
– Ry- ♦, Commented Apr 17, 2012 at 23:20

DanRedux · Accepted Answer · 2012-04-17 23:26:05Z

9

It is just as safe as compiling C++ to ASM. It CAN be reverse engineered or understood by careful reading and logic, and can be edited to, for example, add 10 coins instead of 5 very easily. However, it takes a long time to understand even a short piece of the byte code, and the original source code could only be re-written by hand. The variables names and such would be unrecoverable in most cases.

In other words, PHP is the pizza recipe, the bytecode is the hot fresh pizza. You COULD find out the original recipe but it would take very long, be very difficult, and you would not know that the chef nicknamed pepperoni "Roni".

answered Apr 17, 2012 at 23:26

DanRedux

9,4096 gold badges25 silver badges41 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

user149341 Over a year ago

Note, however, that while the bytecode is compiled, it is not encrypted. Any strings or other constants are visible in the compiled file, and can be edited with little difficulty.

DanRedux Over a year ago

That was what I meant when I said a "5" could easily be turned into a "10".

user1264579 Over a year ago

Does that mean that any compiler that changes PHP into bytecode is going to be just as "safe" (what you describe is appropriate/satisfactory for me) as any other?

user149341 Over a year ago

Not very well. Most of the effects of a source code obfuscator (e.g, changed variable names, unnecessary hex escaping, removed whitespace/comments) are lost when compiling anyway; more complex runtime obfuscators generally have a significant performance impact.

DanRedux Over a year ago

Very hard. Only those very experienced in ASM or equivalent bytecode experience could decipher them, especially complex algorithms. They are harder to read/write by a huge factor than PHP. In fact, even the constants are much harder to change as it's not so obvious what that constant does, but an entire algorithm would be close to impossible to decipher.

|

kenorb · Accepted Answer · 2015-03-03 14:12:59Z

1

Bcompiler is now decompiled, see the link (registration is required)!

However check the archived version.

The files are called: ModeBIphp53Updated2.rar, ModeBIphp52ts.rar and MMcache+EA.rar.

edited Mar 3, 2015 at 14:12

kenorb

169k95 gold badges712 silver badges796 bronze badges

answered Nov 24, 2013 at 13:35

user956584

5,5875 gold badges44 silver badges51 bronze badges

2 Comments

SMR Over a year ago

this should be a comment not an answer

user956584 Over a year ago

Now its webarchived :)

Collectives™ on Stack Overflow

How safe is PHP bcompiler encoded code?

2 Answers 2

8 Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

8 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related