Free PHP Encoding Extension and Tool (bcompiler and bencoder)

[cPanelTristan]

Since Zend and IonCube have a licensing fee for encoding PHP scripts (decoding with Zend Optimizer and IonCube Loader are free), I am going to cover a free extension (bcompiler) and tool (bencoder) for encoding your custom PHP scripts.

1. Check that the machine has bzip2 headers and libraries installed at 1.0 or higher:

rpm -qa | grep -i bzip2

This should output something like the following:

# rpm -qa | grep -i bzip2
bzip2-1.0.5-7.el6_0.x86_64
bzip2-libs-1.0.5-7.el6_0.x86_64

If these are not installed, then run:

yum install bzip2
yum install bzip2-libs

2. Compile PHP with bz2 in WHM > EasyApache (Apache Support) in Step 6. Exhaustive Options List (or using "/usr/local/cpanel/scripts/easyapache" and selecting the PHP module there)

3. bcompiler install

Install bcompiler in WHM > Software > Module Installers > PHP Pecl Manage link, then enter bcompiler in the "Install a PHP Pecl" box.

If this does not work, try using pecl via root SSH:

pecl install bcompiler

If that also does not work, you can try installing via source:

cd /root
wget http://pecl.php.net/get/bcompiler-1.0.2.tgz
tar xzf bcompiler-1.0.2.tgz
cd bcompiler-1.0.2
phpize
./configure
make && make install

Run the following command to ensure bcompiler is in the global php.ini file:

grep -q 'bcompiler.so' /usr/local/lib/php.ini || echo 'extension = "bcompiler.so"' >> /usr/local/lib/php.ini

This command will check the global php.ini file for bcompiler.so line existing. If it doesn't exist, it will add the extension at the end of the file. If bcompiler.so does exist in the php.ini file, then the line will not be added to the end.

4. Keeping bcompiler.so available on EasyApache recompile

Create the following script to ensure bcompiler.so is not lost on Apache recompiles

for i in `grep ^extension_dir /usr/local/lib/php.ini | awk {'print $3'} | cut -d\" -f2` ;do cp $i/bcompiler.so /root ;done
for i in `grep ^extension_dir /usr/local/lib/php.ini | awk {'print $3'} | cut -d\" -f2` ;do echo -e '#!/bin/bash\ncp /root/bcompiler.so' "$i\ngrep -q 'bcompiler.so' /usr/local/lib/php.ini || echo 'extension=bcompiler.so' >> /usr/local/lib/php.ini\n/etc/init.d/httpd restart" > /usr/local/cpanel/scripts/posteasyapache ;done
chmod +x /usr/local/cpanel/scripts/posteasyapache

The above will do the following:
1st command checks the global php.ini for the extension_dir line, removing the extension_dir = "" portion and only keeps the path name. Then it copies the bcompiler.so in that directory to /root as a backup
2nd command again checks the global php.ini for the extension_dir line, removing the extension_dir = "" portion. Then the command creates lines in /usr/local/cpanel/scripts/posteasyapache for a bash script that will copy the /root/bcompiler.so file to the php extension_dir. The next part of the command checks /usr/local/lib/php.ini for bcompiler.so and, if the line is not found, it adds extension=bcompiler.so to it. Finally, the bash script restarts Apache at the end. All of these would run after EasyApache has finished.
3rd command will chmod execute permissions on the /usr/local/cpanel/scripts/posteasyapache script.

4. bencoder install

mkdir /root/bencoder
cd /root/bencoder
wget http://bencoder.urdada.net/bencoder
chmod 755 bencoder
cp bencoder /usr/local/bin

5. Check that bencoder is properly detected

bencoder

If this works, you'll see a list of flags you can use for bencoder

6. Encoding a test script

cd /home/username/public_html/
mkdir IN
echo -e '<?php\nPrint "Hello, World!";\n?>' > IN/php.php
chown -R username:username IN
bencoder -s IN -o OUT -f -r -c -bz2

Please replace username with the account's cPanel username.

The last command issued will take the source directory (-s flag) at /home/username/public_html/IN and copy the files to the output directory at /home/username/public_html/OUT (-o flag) by overwriting the output directory's files (-f flag), encoding recursively (-r flag), copying any files that won't be encoded (-c flag) such as .htaccess and non-PHP files, and use bz2 to compress the files (-bz2 flag). Of note, the IN and OUT folders can be whatever you choose.

At that point, you should be able to load http://domain.com/OUT/php.php and see the same content at http://domain.com/IN/php.php file (a basic Hello World! return). You can cat the file in the OUT directory to see that it is encoded:

cat /home/username/public_html/OUT/php.php

Enjoy your free PHP encoding! The only caveat is that whoever will be decoding these would need to have bcompiler on the machine to decode the script.

 

[SoftDux]

how easy, or difficult is it to "crack" scripts compiled with bcompiler?

 

[cPanelKenneth]

how easy, or difficult is it to "crack" scripts compiled with bcompiler?

This statement in the PHP documentation (PHP: Introduction - Manual) raises some concern:

This extension is EXPERIMENTAL. The behaviour of this extension including the names of its functions and any other documentation surrounding this extension may change without notice in a future release of PHP. This extension should be used at your own risk.

That same page claims it is impossible to reverse the process. However I am unsure, from the wording, whether they mean impossible or impractical.

Minor note: bcompile appears to be incompatible with PHP 5.4 (https://bugs.php.net/bug.php?id=62040) at this time.