[TrevorSaldana]

my company is preparing to sell a product (can't disclose any info at this point due to it still being NDA).

However, in our recent meeting, we came up with the discussion of licensing the product and protecting the code so it can't be nulled distributed for free, we got talking about ionCube and sourceguardian which we decided to research further.

So I am posting for information from anyone who might have used these tools and their experience with them.

My main concern is performance, as long as the code can't be disclosed by doing a simple echo on the obfuscated code, I'm confident our customers won't bother trying. So which encoder will work best without impacting performance to the point the product is useless.

[alastair]

Hi,

This isn't to provide a recommendation as I work for ionCube but you may have a misapprehension about the way true encoders work.

What the ionCube Encoder will do is to compile the source code to byte code form.That byte code is then mangled to prevent direct decompilation from byte code to source code.

Thus it is not possible to do a "simple echo" to get the source code or even to intercept the source code using either a modified PHP or a debugger such as gdb.

With the ionCube Encoder you can choose some features that increase protection of the byte code. Here are the two main ones:

1.. Dynamic keys where the key needed to decrypt the byte code of a particular function is computed at runtime.

2. External keys where the key needed to decode the byte code is in a separate file.

Dynamic keys provide the strongest form of protection available and, when using those, strong encryption is used.

There is generally a trade off between protection and performance. Dynamic keys provide the best protection but, since the key has to be computed and then decryption applied to the byte code, does have an impact on performance.
_________________
Alastair

ionCube