DOCSEARCHbyAlgolia
Submit Docs

YAK Pro - PHP Obfuscator

repository·master·Indexed 23 days ago

https://github.com/pk-fr/yakpro-po

A professional PHP obfuscator that uses PHP-Parser to make source code difficult for humans to read while remaining executable. YAK Pro 3.x supports PHP 7.4+ and obfuscates code for PHP 7.0 to 8.x. Key features include incremental obfuscation, statement shuffling, and a highly customizable configuration system via yakpro-po.cnf or CLI overrides.

Tokens
1.8K
Snippets
0
Records
8
Agent score
32%

What's inside YAK Pro

  1. Configure the YAK Pro configuration loading algorithm

    master

    YAK Pro searches for configuration files using a specific hierarchy. The first one found is used.

    Search Order

    1. The file specified by the --config-file argument.
    2. The file specified by the YAKPRO_PO_CONFIG_FILE environment variable.
    3. The filename specified by YAKPRO_PO_CONFIG_FILENAME environment variable, or yakpro-po.cnf as default.

    Directory Search Priority

    If no environment variable is set, the tool searches for the config file in this order:

    1. YAKPRO_PO_CONFIG_DIRECTORY (environment variable)
    2. Current working directory
    3. current_working_directory/config
    4. Home directory
    5. home_directory/config
    6. /usr/local/YAK/yakpro-po
    7. source_code_directory/default_conf_filename

    Best Practice: Do not modify the default yakpro-po.cnf in the repository as it will be overwritten during updates. Instead, create your own copy in your project's root directory.

  2. Optimize performance for obfuscated code

    master

    Obfuscated code speed is generally similar to the original, except when using the statements shuffling option.

    By default, $conf->shuffle_stmts is set to true. If you experience performance degradation, you can:

    1. Set $conf->shuffle_stmts to false.
    2. Fine-tune the shuffle parameters using associated options.

    Note on Chunk Size: There is a trade-off between security and speed. A smaller chunk size provides better obfuscation but results in lower software performance.

  3. Install YAK Pro - Php Obfuscator

    master

    To install YAK Pro on a Linux-based system (or Windows with bash), follow these steps to set up the tool and its required dependency, PHP-Parser.

    Prerequisites

    • git
    • php-cli (and any other PHP modules your software requires, e.g., php-mysql)

    Installation Steps

    1. Navigate to your preferred installation directory (e.g., /usr/local).
    2. Clone the YAK Pro repository.
    3. Clone the PHP-Parser repository into the PHP-Parser subdirectory (Note: YAK Pro 3.x requires PHP-Parser 5.x).
    4. Ensure the main script is executable.
    5. (Optional) Create a symbolic link to run the tool globally.

    Warning: YAK Pro 3.x is designed for PHP 7.4+ and obfuscates code for PHP 7.0 to 8.x. For older PHP versions, use the unsupported 2.x or 1.x branches.

  4. Use the yakpro-po CLI

    master

    The yakpro-po command line tool allows you to obfuscate single files, directories, or specific configuration files.

    Common Commands

    • Obfuscate a single file to stdout: yakpro-po <source_file>
    • Obfuscate a single file to a target file: yakpro-po <source_file> -o <target_file>
    • Recursively obfuscate a directory: yakpro-po <source_directory> -o <target_directory> (creates the target directory if it doesn't exist).
    • Use a specific configuration file: yakpro-po --config-file <path>
    • Clean up target directory: yakpro-po --clean (removes the target_directory/yakpro-po folder; requires target_directory to be defined in your config).

    Key Features

    • Incremental Obfuscation: When working with directories, YAK Pro uses timestamps to only re-obfuscate files that have changed since the last run, saving time.

  5. Prepare your PHP software for obfuscation

    master

    To ensure your code runs correctly after being processed by YAK Pro, follow these coding guidelines or adjust the configuration to ignore specific elements:

    Indirect Calls and Variables

    • Indirect Function Calls: Avoid patterns like $my_var = 'my_function'; $my_var();. If you must use them, add the function names to the $conf->t_ignore_functions array in the configuration.
    • Indirect Variable Names: Avoid using variable variables like $$my_var = something;. If necessary, add these variable names to the $conf->t_ignore_variables array.

    Database and Constants

    • PDO Usage: Avoid using PDO::FETCH_OBJ. Use PDO::FETCH_ASSOC instead. Alternatively, disable properties obfuscation in the config file.
    • Constants:
      • The define() function is only supported if it has exactly 2 arguments and the first argument is a literal string.
      • If you use any other form of define(), you MUST disable constants obfuscation in the config file.
      • Using the const MY_CONST = something; syntax is perfectly safe and does not require changes.

  6. Handle external libraries in obfuscated projects

    master

    If your project uses external libraries that are not being obfuscated alongside your source code, you must prevent YAK Pro from scrambling the names of the functions, classes, or properties used by those libraries. Otherwise, your code will break when it tries to call the original (unobfuscated) library names.

    How to protect external symbols

    1. Using Configuration (Recommended)

    In your yakpro-po.cnf, you can either disable obfuscation for specific types or provide a whitelist of names to ignore.

    • To disable obfuscation for all functions/classes/etc.:

      • Set $conf->obfuscate_function_name = false;
      • Set $conf->obfuscate_class_name = false;
      • (Repeat for property, method, interface, etc.)

    • To whitelist specific names (Ignore List):

      • $conf->t_ignore_functions = array('func1', 'func2');
      • $conf->t_ignore_classes = array('ExternalClass');
      • $conf->t_ignore_properties = array('external_prop');
      • $conf->t_ignore_methods = array('external_method');

    2. Important Note on PDO

    If you use PDO::FETCH_OBJ to retrieve data from a database, the properties assigned to the resulting object come from external sources (database columns). You must add these property names to $conf->t_ignore_properties to prevent them from being scrambled.

  7. Troubleshoot segmentation faults during obfuscation

    master

    If you encounter segmentation faults (segfaults) while obfuscating large projects, consider the following causes and workarounds:

    Opcache Crashes

    On certain environments (e.g., Ubuntu 21.10 with PHP 8.0.8), opcache may crash when shuffle-statements is enabled for large files. This is resolved in newer PHP versions (8.0.16, 8.1+).

    PHP Garbage Collector Stack Overflow

    When obfuscating a very large number of files (e.g., ~5000 files), the PHP garbage collector may trigger a segmentation fault due to a stack overflow.

    Workaround: Increase your system's stack limit using ulimit.

    1. Check your current limit:
      ulimit -s
    2. Increase the limit (e.g., to 102400) and retry the task:
      ulimit -s 102400

  8. Override configuration via CLI options

    master

    You can override settings defined in your yakpro-po.cnf file using command-line flags. This is useful for quick testing or specific deployment needs.

    Common Overrides

    • Output Formatting:
      • --strip-indentation (or -s): Single line output (default).
      • --no-strip-indentation: Multi-line output.
    • Feature Toggles:
      • --no-shuffle-statements / --shuffle-statements
      • --no-obfuscate-string-literal / --obfuscate-string-literal
      • --no-obfuscate-variable-name / --obfuscate-variable-name
      • (And similar flags for if, loop, constant, function, class, interface, trait, property, method, namespace, and label names).
    • Scrambling Control:
      • --scramble-mode <identifier|hexa|numeric>: Force a specific scrambling mode.
      • --scramble-length <length>: Set length (min 2; max 16 for identifier, max 32 for hexa or numeric).
    • Debugging:
      • --whatis <scrambled_name>: Retrieves the original symbol from the obfuscation context. Useful for debugging obfuscated code.
      • --debug: Displays the syntax tree (internal use).