Hardlocking application?

royn

Hi,

I am interested in finding out whether it is possible, and if someone had implemented a hardlock on a php application.

My idea is to sell the application to a client, but have it require a dongle (such as HASP or something) to be installed on the webserver, to be able to run, thus increasing security.

I couldnt find out if HASP supported PHP though....

What do others use in commercial applications? I assume compilers and such? how secure is this? is it possible to decompile and change code if it has been protected with say, Zend?

What compilers are available, and can you suggest why you like your favorite one? (just so I get a feel for the pros/cons of different ones)...

Thanks!
RN

planetsim

Firstly PHP is an intepreted language, which means its done on-the-fly.

PHP isnt compiled at all. However Zend Encoder is the only application that you can use to stop users from peaking at your code (however they still can but i think they see weird things like you'd see when you open a .exe file up.

AstroTeg

PHP is typically found in web environments. Which means the server will be in a hosting environment. Do you expect the purchasers of your app to receive the dongle and then mail it to their ISP in hopes they're willing to install it? Granted, we don't know the motivation behind your app so maybe this isn't an issue...

royn

Hi Guys,

Thanks for your comments, and I'm sorry for not making myself clearer.

I am a PHP programmer, and have been for many years (ever since the early days of php3)... anyways, I understand fully that php is interpreted, and all, and I was meaning Zend Enc when I talked about compiling the code...

We host clients on an ASP model, but many larger companies want to buy the software and host it in their own NOCs, be it because it serves their intranets, or in the case of banks who do not use ASP solutions, et al...

Most of these clients are large and have their own data centers. Our application itself runs on more than one server at the clients data center.. so it would not be a problem to have a dongle.

At this point, few of our clients need this purchase option, but the ones who do are big accounts, and it would be nice to have a way of securing the code...

AstroTeg

I don't think PHP has a way to directly talk to the hardware so you'd have to come up with a CGI app that PHP would interface to. But those are my immediate thoughts.

I'd think you could do something with licensing and possibly phoning home to validate the license (unless its strictly intranet). I would bet with more creativity, something could be figured out.

royn

My next question would be, how secure is the Zend Encoder?

Is there a way to limit the number of machines that a particular software can be run on, or the database server and database name to be limited (so as to prevent the client from installing several copies)?

Cheers,
Roy

AstroTeg

I'm pretty sure there's plenty of examples out there for locking down software (not necessarily tied to Zend/encoding). Although being a PHP forum, I'm not sure you'll find all the solutions here (google will probably be your friend).

Weedpacket

Originally posted by royn
My next question would be, how secure is the Zend Encoder?

One thing you could do would be to go to its site and find out what it does to secure code; you'll also find there that it can have license control as well.

planetsim

The pitty is its so expensive some of my Apps ive wanted to make i didnt want OpenSource, but the end of the day it was a matter of cost vs that. It was more beneficial for myself and the client to just have it opensource.