1

Let's say I have a database-driven web application written in PHP.

After obfuscating the code with PHP protect it will be copied to a web hosting server.

And here is the question.

What is the workflow of a programmer when there is a bug in an application and he needs to edit the PHP code to repair it? It's clear, that he can't debug (and edit) directly the obfuscated code.

6

Maintain two identical hardware/software platforms: a production platform and a test platform. When an error occurs, reproduce it on the test platform. Then, upload the unobfuscated code to the test platform and reproduce the bug again. Perform the usual troubleshooting, fix the bug, obfuscate the new code, and upload it to the production server.

  • @RoberHarvay. Where is the good place to store the error messages on the production platform? (e.g. catched Exceptions and appropriate strings describing errors). Will they be obfuscated, or is it possible to achieve, that the error messages will be readable (omit obfuscation for them)? – xralf Sep 11 '14 at 18:40
  • Why would error messages ever be obfuscated? They're strings, not code. If they're obfuscated, you would have to decode them to display them anyway. Remember, you have a test platform that you can reproduce the bug on with the unobfuscated code. – Robert Harvey Sep 11 '14 at 18:41
  • So, after the obfusction the lines where the error happened in obfuscated code will match the the lines in unobfuscated code? – xralf Sep 11 '14 at 18:46
  • 2
    No. Why would they? It doesn't matter. With this setup, you'll be identifying, troubleshooting and fixing the error in unobfuscated code. You don't need to know anything about the obfuscated code. – Robert Harvey Sep 11 '14 at 18:48
  • This approach may not be possible for errors that are data-dependent, and either (1) privacy concerns forbid having a copy of the entire user database in the test environment or (2) privacy concerns prevent logs from identifying what data was being processed, to the degree necessary to select the same data in the test environment. – Ben Voigt Sep 11 '14 at 21:18
3

Good obfuscators will store the mapping between original names and obfuscated names, and provide a tool for reversing this obfuscation in stack trace dumps which appear in your logs. The mapping won't ever go on the server, so no one but the owner of the code can perform the deobfuscation. This is similar to the debug symbols which compiled languages use to map instruction addresses back to source code.

Documentation of the "PHP protect" tool you linked doesn't look like it obfuscates function names at all, only variables, so this shouldn't be a major issue for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.