Encoding your Code

[interactive]

Hello,
Quick question for any software developers. For a script based (IE: perl, php, asp, etc) peice of software that you charge for do you find it worth encoding? Does it really stop anyone? I know there's ways to decode it (obviously ;)). Just wondering what your take was?

[GnomeyNewt]

I am def not a software developer, but I've seen a lot of code... I just wanted to mention how this one guy did it.

He would bunch all his code on about 10 lines, it was so insane. Guess he didnt wan't anybody stealing his coding. LOL.

[Robert]

I think if you make the script easy enough to customize, but keep the hard coding ecoded, than there isn't a problem.

[interactive]

I guess I wont worry about it, if someone wants it bad enough they'll get it.

[suppleSupport]

Originally posted by Robert:

I think if you make the script easy enough to customize, but keep the hard coding ecoded, than there isn't a problem.

agreed :)

but it won't be possible for your clients to code in new features :banghead:

[interactive]

Well it's mainly I don't want them pirating it. IE: They pay for one license then they just copy everything over edit some of the code (where it makes sure its legit) and boom.

[Locke]

Make the code rely on a 'license' type system that makes it call back upon installation. vB started doing that, I think it does everytime you load it though, but that's a lot of bandwidth. Basically just make the code call home and make sure their domain is listed in the DB, if it is, it will install, if it isn't, it will have a message you define saying 'this is a pirated copy, if you believe this is in error, please contact us'. We do it with practically all of our client's software that we have a no resell agreement with, if they don't accept it, we don't need the money that bad to allow someone to steal our work.

[interactive]

Well when your talking about a large number of licenses or what not it could become a issue. Right now it installs off of a RPM, then when they start setting things up they enter the license number. The server connects to our site, checks the license makes sure its running on the correct ip. There's a lock file that will lock the whole program out and notify the admin, but if the admin knew just a little code he could go through and easily remove it. One thing though, is upon updates it also checks the license.

[Locke]

Exactly, which is why we make the license function a vital part, without it, nothing works, installation, or anything. If you try to remove it, everything goes void. We usually encode with MD5, however, Base64 would be acceptable, depends on your overall intentions with it. Since we all know MD5 is not decodable.

[interactive]

Well I want people to be able to add additional modules and all, but I don't want people pirating it. It's catch 22

Edit: Typo

[Locke]

Set up a system that bypasses that, and show documentation of how to custom your own modules. There are many ways you can do this with it encoded, alls you would be doing is encoding a single security script, the rest can remain unencoded if you would so choose it.

[LetsFly]

when it comes to billing programs, like WHNBilling, we encode virtually 100% of all the files, thats thousands of lines of code my programmers have worked on, and theres alot of dishonest people out there, almost weekly we get "call home" off our license server from installs in Singapore, Japan, all the usual fraudulent places, the software is useless to them because (1) we have a callhome license (2) all the code is encoded

[GnomeyNewt]

Where is a good website to start learning how to encode codes? :)

[interactive]

I don't know if there's a website to start learning how to "encode code." There are utilites that do it, I believe it depends on the programming language at hand.

http://www.rssoftlab.com/phpenc.php4

That's one that should work for PHP, haven't tested it but it looks good. There's a few others some free, some extremly expensive. If you're looking for a encoder that works with php goto http://www.google.com/search?sourceid=navclient&ie=UTF-8&oe=UTF-8&q=php+encoder

Good luck!

[RRolfe]

I am currently building a site in PHP which i will be selling on the open market. I didn't want people to steal my code so i bought a copy of the ioncube encoder and it seems to work very well.

you might want to check it out... i think its http://www.ioncube.com

[interactive]

How does the decoding work on that. This is what I'm confused about does php do it or what?

[Robert]

it encodes it and than you have to install its decrypting program on your site, and it will decode it when the page is accessed. Very usefull tool.

[RRolfe]

yes, the decoder is just a module you plug into the php config.

[interactive]

So for example I could have my encoded code and then my clients would have regular "non-encoded" code would it work there? Thanks

[kunal]

Hey,
You guys should take a look at the zend encoder.. it will compile your code for you.. yes, it can be a pain and can cost a lot.. but its worth it...

i dont really agree with the call back feature.. what happens if your licensing server goes down? the client is stranded... i would say compile/encode your essential functions and include a license file... create a user side licensing system...

kunal

[interactive]

Kunal, already got that laid out. The license will only be shutdown if the server responds saying it's a dead license. If it doesn't respond at all it doesn't do anything. Could still get screwed though.

As for the zend encoder, how much does it cost ('ve looked at it before but could never find a price).

[suppleSupport]

Originally posted by interactive:
As for the zend encoder, how much does it cost ('ve looked at it before but could never find a price).

http://zend.com/store/products/zend-encoder-pricing.php

Zend Encoder Plus
Perpetual (lifetime) License $2880
Single Year License $1160

Zend Encoder
Perpetual (lifetime) License $2400
Single Year License $960

HTH

[GnomeyNewt]

Whoa, didnt realize it was that much ... good info to know..

[suppleSupport]

Yeah it's a little steep for freelance programmers :( but I suppose it's well worth it for companies that have a lot more on the line.

[kunal]

Hey guys,
If you give the zend guys a call.. they will give you a better pricing.. :) tell them you are a small time programmer.. and need to save your ass... and they will give you a pretty good pricing.. trust me ;)
kunal

[interactive]

Any idea on how much is? I'm looking to spend under $750 total

[kunal]

Robert, you could get it for around 600$. Give them a call.

kunal

[rockergrrl]

Whatever you do, don't get Source Guardian to encrypt -- it can be decrypted. The script kiddies have managed to decode Source Guardian encryption. That's how they managed to decode WHMAutoPilot and warezed it out (as the support board over at WHMAP).

From what I understand (Heard from a little birdie), that they're working on decoding IonCube as well. Dunno what their progress is on that.

So those are two encryption programs to stay away from.

[kunal]

Originally posted by rockergrrl:

Whatever you do, don't get Source Guardian to encrypt -- it can be decrypted. The script kiddies have managed to decode Source Guardian encryption. That's how they managed to decode WHMAutoPilot and warezed it out (as the support board over at WHMAP).

From what I understand (Heard from a little birdie), that they're working on decoding IonCube as well. Dunno what their progress is on that.

So those are two encryption programs to stay away from.

Decoding the scirpts encoded by any encoder is not difficult to decode. It not easy either but it can definately be done if you know what your doing.

Do you know who did it?

kunal

[rockergrrl]

Don't know exactly who did it... but I know it was a major "releaser" of scripts out there. One of the main ones. I don't keep tabs in that scene really.

I know there's one of the 'releasers' that's pretty good a decoding.. it might've been him... dunno

[kunal]

allrighty then.. time to get on IRC then...

kunal

[Kevin]

Seems ioncube is not using pre-compile or what is it bla-bla-bla because someone decoded their scripts:

http://removed.com