Question

This topic has been asked a lot here.
I tried to read some of them, but unluckily i couldn’t find the answers.
I would to create my own version of PHP obfuscator like byterun does.
For example:

<?php
echo "Hello World";
?>

into:

<?php $_F=__FILE__;$_X='Pz48P3BocA0KNWNoMiAiSDVsbDIgVzJybGQiOw0KPz4='; 
eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLC
cxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GS
UxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

I’m not looking for a tools how to create the encoded PHP code. I’m looking for how the process to create or encrypt the PHP code. At least a start point to do my research.
Any guidance is greatly appreciated.

Thanks
Ivan

Answer 1

A very barebones version would be

<?php

$po = '<' . '?php';
$pc = '?' . '>';

$input = 'file.php';
$code = file_get_contents($input);

$encoded = base64_encode($code);

$encoded_script = <<<EOL
$po

eval(base64_decode($encoded));

$pc
EOL;

file_put_contents('encoded.php', $encoded_script);

The only thing the commercial obfuscators do is add extra levels of obfuscation – rename variables into non-meaningful garbage. Maybe vary the encoding methods, split the source script into multiple chunks and have each one encoded differently, etc…

But in the end, it all boils down to useless garbage that protects about as well as wet toilet paper.