datahack.se

The other day, I was searching for a PHP “encrypter”. In short anything that doesn’t yell something about “compiled byte code” is highly reversible to the original source code (with more or less effort) but even so… It won’t be anything more than annoying rather than secure. As of today the most secure engine is probably Zend Guard (they if anyone should know how to do it the best way).

Zend Guard costs about € 600.00, which may seems like a whole lot when compared to “cheaper” solutions like… hmm let’s say SourceCop or PHP LockIt (these are just two of many many more) The only problem is that…

SourceCop is not secure… no, not all

They only rip people of by telling them they are, stupid statements like “How strong is the encryption ? Is it 128/256/384 bit? The encryption is none of these. It is our own encryption algorithm.” and “By encrypting your code, you are placing a hurdle and making it almost impossible for a human mind to understand.” so today we will go beyond the possible and learn how this program works…

Obfuscation

SourceCop will replace the content of all your PHP files to what seems to be a secure version. There will also be a folder named scopbin. The scopebin/911006.php is their “decoder”.

“Protection” against decoding these files consist of plain-text checking if print, echo, sprint and sprintf -calls exists in the current script (haha you guys missed functions like file_put_contents and a whole lot of others thou :P) or we could simple disable this checking all together…

The decode engine’s all functions and variable named are annoyingly obfuscated, but it’s no problem for the human mind to understand (mainly because 99% of the code does nothing, just a number of function that is never called).

Get your source code back!

For this article I created a source file called hello.php (<?php echo “hello world”; ?>). Run SourcCop; then if you open hello.php, at the very end you will see

$REXISTHEDOG4FBI='E113107EF94AF041 F391849E9104A2E68E6 E48F557338ABB E3BBFA0EFB981F570';
$REXISTHECAT4FBI='94CD76CD371C5A7BC70C186E779C293B9B49BACA5A781A6';
eval(y0666f0acdeed38d4cd9084ade1739498('2A2D B A A4EB5D86B',$REXISTHEDOG4FBI));
?>

If you replace

eval(

with

file_put_contents("php://stdout",

you will have your source code back just as it was before you run SourceCop, because their security model is based on that you should not modify the code at all, you should just look at it and say, “oh this isn’t what I expected it seems encrypted, so it must be secure” :P

But let’s look inside their y0666f0acdeed38d4cd9084ade1739498($data, $key) function which is supposed to protect the code (and return it in plain-text) :P

<?php

// this is a cleaned up version

$data = '2A2D B A A4EB5D86B';
$key = 'E113107EF94AF041 F391849E9104A2E68E6 E48F557338ABB E3BBFA0EFB981F570';

function decode($data, $key)
{
 $ret='';
 $t=0;
 $y=hexdec('&H'.substr($key,0,2));

 foreach(str_split(substr($key,2), 2) as $k)
 {
 $k = hexdec($k);
 $x=$k ^ ord($data[$t++%strlen($data)]);

 if($x<=$y)
 $x=255+$x-$y;
 else
 $x=$x-$y;

 $ret=$ret.chr($x);
 $y=$k;
 }
 return $ret;
}

echo decode($data, $key);
?>

Question: why did you put so much effort into it? your target customers for SourceCop would probably buy it even if it did a rot13 rotation or base64 decoding.

PHP LockIt is just as bad…

They are just as bad, maybe a little bit more annoying. But once figured out it’s just as simple; put this on top of every PHP LockIt protected file and the source code is yours again…

<?php
$script = file_get_contents(__FILE__);
if (!preg_match("/OO00O0000=(\d*);/", $script, $scriptlen))
 die("failed :( do by hand...");
$scriptlen = $scriptlen[1];
if (!preg_match("/OOO0000O0\('(.*?)'/", $script, $script2))
 die("failed :( do by hand...");
$script2 = base64_decode($script2[1]);
if (!preg_match("/\),'(.*?)','(.*?)'\)\);eval/", $script2, $script3))
 die("failed :( do by hand...");
echo base64_decode(strtr(substr($script, $scriptlen * -1), $script3[1], $script3[2]));
die();
?>

I don’t understand how anyone can take some of these companies seriously, but some do or else they wouldn’t exist!

Spread the word :)