can zend encoded files be decoded?

sfullman

Hi All,

I have posted to and helped on this forum for years. I respect the feedback of folks here. recently I searched to see if zend encoded files can be decoded - specifically files from ionCube which I own. This is one time when I don't want to ask the developer, ionCube, but instead want to ask the community. I am wanting to encode a source library of functions I have developed and wonder if it really will be possible to simply run them through a process and decode them.

I do see services, most with grammatical errors like a foreign site, inviting me to pay to have it decoded, but am not willing to do that just yet as paying for a failed decode doesn't mean decoding is impossible 🙂

Samuel

dagon

sfullman;10962128 wrote:
simply run them through a process and decode them.

according to both zend and ioncube, no. According to some very suspect looking site, yes.

With all security measures the question is "is it good enough" is the pay off for breaking the encoding worth the time\money to do so?

I think its unlikely that what you do is so valuable (no disrespect to your code, just that any one can hire some Indians (no disrespect to Indians you just work for less) to replicate it for not a lot) that some one would go to the trouble of breaking the encoding. you should of course have a contract in place so you have some options should they choose to.

sfullman

guess what I was hoping was a qualified answer like "if they have a supercomputer running 16 trillion iterations, then yes" or, "it's about 15 million iterations and they could get it" - compiled language (and how the processor is supposed to read it when you and I who designed the processor can't) is still a mystery to me. There is an interesting video link on youtube:

http:// www . youtube . com / watch? v= c6DDseG6jxE

which I can't here the volume on but that's really annoying if it's true

dagon

i haven't seen a decode that works, the video does not prove much. Have you found a decode that works?

dagon

this is worth a read:

http://forums.zend.com/viewtopic.php?f=57&t=2242

So while Zend Guard can make the job of someone wanting to steal your code/IP harder, ultimately your protection has to be provided by your end user license agreement (EULA) and whatever remedies it provides for you and your customers in the event of a legal dispute.

johanafm

dagon;10962177 wrote:
With all security measures the question is "is it good enough" is the pay off for breaking the encoding worth the time\money to do so?

And apart from encoding, it supposedly does some other things as well. I say supposedly since I have not looked at decoded code myself, but it is according to Zend, and I doubt they'd put something like that in print if it wasn't true...

So, assuming it's true, it strips comments and indentation. Moreover, it's supposed to also do "code obfuscation". I do not know exactly what that would mean, but one guess is shortening names for variables, functions etc, similar to what you commonly see when it comes to javascript on the web.

So, I'd agree with Dagon that you probably have good enough protection here, and should indeed go the rest of the way with a license agreement.

Weedpacket

johanafm wrote:
So, assuming it's true, it strips comments and indentation.

No, it works on the compiled bytecode, not the source.

sfullman

so there's no verifiable source where you can submit a zend or ioncube encoded file and for like 15 bucks the guy returns your file unencoded and you say "wow, that's exactly the code!" Is that correct?

Also it has always been a mystery to me how a computer can read and follow a program but a person couldn't masquerade as a CPU and get the program routine. Guess there's a concept about going to binary which I don't apprehend fully. I get MD5(), but not this. Part of me wants to get a CS degree just to understand this, but then part of me wants to start my own mexican restaurant called "the Happy Gringo" which would feature some of the low-fat alternatives which we make at home - and yes I'd get rich doing it.

I think I'll continue with programming..

Samuel

laserlight

sfullman wrote:
so there's no verifiable source where you can submit a zend or ioncube encoded file and for like 15 bucks the guy returns your file unencoded and you say "wow, that's exactly the code!" Is that correct?

Yes, but that does not mean that someone out there does not have a tool that, given obfuscated bytecode from these encoders, can produce PHP source code that does the same thing.

sfullman

Hey! this is slightly off topick but i think I understand.

Binary code is like a maze for marbles that can loop the marbles as well. CODING is instructions on how to build the maze. The maze itself carries no instructions, only paths for the marble. It carries little or no revelation as to the logic of how it works. Is that correct?

If not I can start that mexican restaurant. though you brits probably don't know what mexican food is.. 🙂

bradgrafelman

sfullman wrote:
Binary code is like a maze for marbles that can loop the marbles as well. CODING is instructions on how to build the maze. The maze itself carries no instructions, only paths for the marble. It carries little or no revelation as to the logic of how it works. Is that correct?

Not sure what you're getting at, but note that machine language ("binary code" - the 0's and 1's) is just that - simply another language. The only difference is, machine language is a language that your processor can actually understand. Thus, a program written in the PHP language is executed simply by translating it into machine language.

laserlight

bradgrafelman wrote:
Thus, a program written in the PHP language is executed simply by translating it into machine language.

That does not quite sound correct to me, as I do not think that the PHP interpreter compiles the PHP code into machine code and then causes the machine code to be executed. Rather, if we exclude the encoders that thus involve bytecode, the PHP interpreter parses the PHP code at run time and then executes it. Machine code is involved indirectly through the interpreter, which is itself executed.

bradgrafelman

laserlight wrote:
the PHP interpreter parses the PHP code at run time and then executes it. Machine code is involved indirectly through the interpreter, which is itself executed.

True - I was trying to generalize it a lot and perhaps went a bit too far.

Weedpacket

sfullman wrote:
Also it has always been a mystery to me how a computer can read and follow a program but a person couldn't masquerade as a CPU and get the program routine.

There's no reason you couldn't, except that you've probably got better things to do.

http://comicjk.com/comic.php/247