Can You "Compile" PHP Code and Upload a Binary-Ish File, Which Will Just Be Run by the Byte Code Interpreter

Can you compile PHP code and upload a binary-ish file, which will just be run by the byte code interpreter?

After this question was asked, Facebook launched HipHop for PHP which is probably the best-tested PHP compiler to date (seeing as it ran one of the world’s 10 biggest websites). However, Facebook discontinued it in favour of HHVM, which is a virtual machine, not a compiler.

Beyond that, googling PHP compiler turns up a number of 3rd party solutions.

PeachPie

• PeachPie GitHub
• compiles PHP to .NET and .NET Core
• can be compiled into self-contained binary file
• runs on Mac, Linux, Windows, Windows Core, ARM, ...

Phalanger

• GitHub (download), Wikipedia
• compiles to .NET (CIL) looks discontinued from July 2017 and doesn't seem to support PHP 7.

phc

• compiles to native binaries
• not very active now (February 2014) – last version in 2011, last change in summer 2013

Roadsend PHP Compiler

• GitHub, GitHub of a rewrite
• free, open source implementation of PHP with compiler
• compiles to native binaries (Windows, Linux)
• discontinued since 2010 till contributors found – website down, stays on GitHub where last change is from early 2012

bcompiler

• PECL extension of PHP
• experimental
• compiles to PHP bytecode, but can wrap it in Windows binary that loads PHP interpreter (see bcompiler_write_exe_footer() manual)
• looks discontinued now (February 2014) – last change in 2011

Project Zero

• Wikipedia, IBM
• incubator of changes for WebSphere sMash
• supported by IBM
• compiles to Java bytecode
• looks discontinued now (February 2014) – website down, looks like big hype in 2008 and 2009

Bambalam

• compiles to stand-alone Windows binaries
• the binaries contain bytecode and a launcher
• looks discontinued now (February 2014) – last change in 2006

BinaryPHP

• compiles to C++
• looks discontinued now (February 2014) – last change in 2003

Compile hhvm code into byte code & remove the source files

Repo authoritative kinda does this, but it's not intended for what you want. It compiles all your PHP code into a single repo, for performance reasons -- it gets to assume that what goes into the repo is all the code that will ever exist (you aren't allowed to load things outside the repo), and so it can do a lot of clever optimizations based on that. But since you can't extend the repo once it's been built, it's not good for distributing any sort of library where you may need to add code later. It actually wasn't built to be distributed at all; the format is very version specific and it's likely that even a minor point release of HHVM won't be able to read an older (or newer) release's repo.

It also isn't a great form of obfuscation. It contains optimized "HHBC" instructions ("HipHop bytecode"), which aren't terribly difficult to reverse back into PHP code, particularly if someone were incentivized to build a tool for it. The difficulty of doing this would be on par with writing a C# or Java decompiler -- a good tool with good heuristics can get you something that is very close to the original source code. (Decompiling C, by comparison, is much harder.)

So no, I wouldn't use repo authoritative for this. I think it would cause you more trouble than it's worth for the reasons above, and may not even solve your problem. HHVM doesn't have any good mechanism for this -- PHP was designed to be read an interpreted off of source files on disk. HHVM happens to have a couple intermediate languages, including HHBC, for optimization purposes, but they aren't designed for obfuscation.

You may want to look for a PHP source obfuscator, which would do source transformations on your code before the PHP interpreter (either PHP5 or HHVM) ever see it. That's well beyond my expertise.

You may also want to carefully consider whether it's worth the effort of trying to defeat dishonest people, which is ultimately going to be a losing battle. (It's always possible to defeat license protection like this.) Spending a little time to keep honest people honest is what I would personally do, and you should carefully consider the tradeoffs before spending a lot of time and energy doing this as opposed to otherwise working on your product.

Related Topics