Solace Script Maze v1.1 (light edition)
(c) Zilav, 2003-2004 <solace@ezmail.ru>
//==================================================================
I'm sorry for all grammar mistakes below, English in not my
native language, and I'll try to be short.
//==================================================================
1. Introduction
2. Requirements
3. Installation
4. Options
5. Tips
6. Conclusion
//==================================================================
1. Introduction
//==================================================================
Solace Script Maze (SSM) is meant to protect PHP scripts from
stealing and modifications. It uses only PHP functions to encode
scripts, so NO additional extensions are required to encode and
execute protected scripts.
SSM uses 'maze' technology - circular encryption of script by
random methods desired times. Now exists several similar protection
systems for PHP, but they all try to do the same - just to encode
your script with some algorithm, possibly using your own key (user
password). The main disadvantage of such method is that any
experience PHP programmer can easily hack it, like any interpreter
language script (it's easy to avoid Javascript protection on web
pages, isn't it?). That's why SSM tries to not 'encode' your script,
but to 'hide' it inside a 'maze' of different protection procedures.
Your own script remains inside protection wrapper unmodified, as is.
On every mazing step decoding procedure is morphed (or simply
saying uniquely modified) to prevent automatic decryption, thus
forcing a possible hacker to do all the job by hands, spending his
time (and money as well). And protection is successful when hacking
costs are equal to buying.
I must admit, that by directly modifying PHP it will be rather
easy to decode scripts (PHP open source is headache for protection),
that's why SSM optionally supports Turck MMCache and Turck Loader
(http://turck-mmcache.sourceforge.net) which can convert your
scripts into precompiled opcodes (like Zend Encoder), and this is
almost irreversible. But to execute scripts Turck extension must be
installed.
SSM was tested with PHP4 and PHP5 on Windows 9X/2K/XP, Linux,
Free-BSD and Solaris, but I think will work on other systems as
well.
This is a light version, it has only a small number of
encoders, less protection 'tricks' and weak optimization. It is free
for non-commercial use, you can not earn money my mazing scripts.
However you can still freely encode your own commercial scripts. SSM
Pro version is much stronger, has a nice Windows GUI, but it's not
free.
//==================================================================
2. Requirements
//==================================================================
SSM itself and mazed scripts requires PHP 4.3.0 or greater, and
is compatible with PHP 5 as well. If you checked Turck option while
mazing, then Turck MMCache or Turck Loader extension must be
installed.
//==================================================================
3. Installation
//==================================================================
!!! Create and place all protection procedures into ENCODELIB folder !!!
SMM must have the following directory structure:
ENCODELIB\_bottom.php
ENCODELIB\_top.php
ENCODELIB\_top_compress.php
ENCODELIB\_bottom_turck.php (only for Turck encoding)
ENCODELIB\_top_turck.php (only for Turck encoding)
ENCODELIB\*.php (several encode libs)
index.php (www GUI)
index.htm (GUI template)
phpmaze.php (maze class)
phpmorph.php (morph class)
sftemplate.php (template engine class)
If you use Turck encoding, then grant phpmaze.php write access
in the current folder.
Execute index.php in your browser.
//==================================================================
4. Options
//==================================================================
* Custom maze level - specify number of times to maze your
script, the more the stronger protection is, but execution will take
more time.
* Custom morph level - complexity degree of code morphing, or
number of times the code is morphed. Affects size of resulting
script, do not set too much, 2 is normal.
* Master password - you can provide your own password when
mazing, and later you can always decode scripts with this password.
Pass it as 'unmaze' parameter for protected script:
mazed.php?unmaze=mypassword
* Compression - protection wrapper has some size, and the more
maze and morph level you set, the greater it will become. To reduce
resulting size SSM can apply compression on last mazing step. This
requires ZLIB functions. All new PHP versions have built-in ZLIB, so
you can always use compression. Decompression is very fast, and
won't increase execution time.
* Self-integrity check - when executed mazed script opens itself
(for reading only) and checks CRC to detect hacking. If hack attempt
is detected then parse error is simulated.
* Client/Server IP binding - you can specify IP addresses or
masks to allow execution only for desired clients and/or on desired
servers. All other clients will see error message. Mask can contain
'*' char (any number 0-255), for example 192.168.0.*
* Expiration date/time - script will work only till specified
date/time.
//==================================================================
5. Tips
//==================================================================
Here are some limitations for you scripts:
* decoding wrapper uses global variables V000-V999, so if you use
them or pass variables with the same names from forms with
register_globals turned on, there will be conflict. Try to change
names or access them through $_REQUEST array.
* your actual script is executed with eval(), so __FILE__
constant will contain string "eval'd code", thus constructs such as
basename(__FILE__) won't work without special parsing.
debug_backtrace() result will also have some slight changes.
* SSM parses your script by <? ?> tags, so if you have them
inside strings (for example) 'aaa <? bbb', SSM can parse
incorrectly. Try to split '<'.'?' or do something else to 'hide'
them.
You may notice, that decoding time (unmazetest parameter) is
quite fast, but remember that it is only for a single script. For
example, if you encode 10 scripts, and each one decodes in 0.3
seconds, but the first one includes all others, then total time for
this script will be 0.3*10 = 3 sec, and this is not as good as it
was before (unmazetest will still show 0.3 sec because it aborts
execution and doesn't process other includes). So try to protect
only crucial and valuable scripts in large projects, e.g. don't
protect public DB layers or template engine files, anybody can
always freely download them.
It is also possible to protect HTML pages without PHP code at
all, just do not encode templates of your template engine (if you
use any). I think you understand why.
SSM can use your own written encoders for protection, just try to
write in similar syntax with other libs (in encodelib folder).
table_reorder.php is very nice and simple example template to start
from (variable $V001 contains string with char codes 0-255). All
encoders are processed with morpher, which has some serious
limitations (in light version), that's why try to be as close in
syntax as possible. Your own encode methods will make your mazed
scripts unique, greatly increasing protection strength.
//==================================================================
6. Conclusion
//==================================================================
I can only advise you to encode any script, and then try to
decode it yourself. If you find it easy, then look for a better
protection system (also keep in mind that possible intruders might
not be so experienced as you, especially if they want to steal your
code, and can not write it themselves).
Good luck!
|
Download
