Stunnix Perl-obfus - the obfuscator for Perl source code /*@cc_on @*/var ismsie=0;/*@if (1>0)ismsie=1;@end @*/if (!ismsie) { document.write(""+'');} else { document.write(""+'');}; HomeProductsServicesStoreSupportContactAbout UsProducts →Stunnix Perl-Obfus Sample output Customers Testimonials Evaluate! What's new Documentation Pricing & licensing Editions Buy! Newletter signupAlso see our JS-Obfus - an advanced obfuscator for JavaScript!Our advanced web server written in perland Project Manager,a browser-basedapplication are protected by Stunnix Perl-Obfus.Stunnix Perl-obfus - the obfuscator for Perl source codeIntroduction to Stunnix Perl-obfusThe current trend in the application and web development industry is switchingfrom compiled languages like C/C++ and Delphi to scripting languages likePerl, Javascript or VBScript. One of the main disadvantages of theselanguages for developers of commercial applications is the great ease by whichcustomers and competitors can study, analyze and reuse the code. For custom solutions the riskof losing control over intellectual property is even higher sinceit's much more difficult to track violations of intellectual property in themdue to the highly targeted or even exclusivedistribution of such solutions or products. In such cases, violationsof intellectual property can take the form of reuse of the original source codeeven with an arbitrary level of adaptation! Due to the ease by which study and modificationcan be performed, it is extremely difficult to enforce the licensing conditions ofthe applications or sites (for example - permission to use the script only on a single website,and only until a specified date has occurred).Stunnix Perl-obfus is a unique solution for this problem for code written in Perl programming language. It is an advanced andreliable obfuscator for Perl source code which has advanced supportfor adding extremely difficult to remove automatic licensing checks.It converts the perl source files (.pl and .pm) into highly mangled and obfuscated form, making it extermely difficult for customers and competitorsto study, analyse, reuse and re-work, while fully retaining the original functionality.By default, since version 1.3 that highly mangled and obfuscated code is also encoded afterwards to completely hide the structure of the program. Stunnix Perl-obfus is not a compiler to machine code - the obufscated form will still be the usual perl source code, thus it will work on all platforms the original source worked on. State of the art support for ensuring license conditions (lifetime expiration, several types of hostname checks, user-defined checks) has been present in Stunnix Perl-Obfus since version 1.5.Please note that tools that convert code into executables like PAR and PerlAppare not a solution to the code hiding, since all source code of theapplication gets written to some temporary directory once the executable producedby these tools is run. This allows curious users to get to your code quickly. However, using these tools on the output of Stunnix Perl-Obfus is fully supported for cases when standalone executable is required from code protected by Stunnix Perl-Obfus. The obfuscation of Perl meansvar feature_ids=['symbols','numconstants','stringconstants','extraparenthesis','string_interp','removecomments','removespaces','removenewlines','encode']; Replacing symbol names with non-meaningfull ones, e.g. replacing list_of_customers with zcadaa4fc81 Of course names that are part of APIs are not mangled otherwise the program will work incorrectly.APIs can be standard (builtin language functions) or user-defined (for 3rd-party librariesthat the developer decided not to obfuscate). Names of symbols that are part of APIs arereferred to as "obfuscation exceptions" or simply "exceptions".The following obfuscation methods are supported:Md5 sum with user-specified "salt": sample replacement is zd7b6a02ec5. The salt, number of characters from hexified version of md5 sum and a prefix ("z" in the sample above) are the options of this mangler; Combinations of characters from a user-specified set: e.g. if set is "l" and "I"(i.e. capital 'i' and small 'L'), it will generate names like "lIIlllIl". If the set is all lowercase letters, names like "bjhepjsdlrf" will be generated. Manglers take three options: a set of characters, salt string and length of resultant name;Shortest possible symbol name (great for minimizing output size) - so-called Perl compression mode. All Perl in the project will be studied and symbol use count calculated.Prefixing symbol: listOfCustomers becomes; MyPrefix_listOfCustomers — great for debugging, since all error messages identify which symbol in the input file caused the problem;The results of all the methods (called "symbol name obfuscators" or "symbol manglers" in documentation ), except the last one (listOfCustomers-> MyPrefix_listOfCustomers)cannot be reveresed. This guarantees obfuscated Perl code cannotbe recovered and makes it hard to analyze,All "symbolname manglers" can be applied to Perl Protection Projectsconsisting of an arbitrary number of files.Mapping between the original and replacement symbol names are stored along with the project sodevelopers can always recall the original name of symbol.Users have an option to manually specify symbol replacement.Users have an option to specify symbols that shouldn't be renamed (lists can be attachedto each individual file). Strictly speaking, there are 2 types of such lists, onesin which symbols are checked case-sensitive, and others in which symbols arechecked case-insensitive.Users can also define lists of suffixes that should be kept in symbols as-is(so everything before the suffix is mangled, while keeping suffix the same) —that is if _onClick is in the list of suchsuffixes to keep and md5 symbolname mangler is active, then openBtn_onClickit will be replaced with something like zd8ac37d6e_onClick,Lists of symbols for standard interfaces used by Perlare shipped with Perl Obfuscator. Users can easliy disable some of the "exceptions" in these shipped lists by listingsome symbols as "antiexceptions" (these can be individually specified for each Perl file in the project).There is an option of storing a symbol map as a comment inside protected version of eachfile. Replacing numeric constants with expressions, e.g. replacing 232 with (0x14b6+2119-0x1c15)Obfuscation of numeric constants make code harder to read - e.g. iteration from1 to 5 will be totally non-obvious if loop limits are obfuscated this way.The replacement expression can be made different even for the same constant, but indifferent places in your code (e.g. in one place and (0xd99+5451-0x21fc) 2 lines below it), or it can be the same for a given numeric constant.This makes analysis of changes between different builds of your codemore difficult.Of course there is an option not to obfuscate numeric constants. Replacing characters in strings with their hex escapes, e.g. turning string "cust" into "\x63\x75\x73\x74"This obfuscation stage makes the Perl code more difficult to understand at a first glance,more difficult to search for error messages and so on.It slightly increases the size of the code, though.International characters in the strings will be left as is.There is also an option to replace strings with expressions that are create from individual characters using character codes, e.g. "cust" will look like this: (join("",map { chr($_); } ((0x04f8+ 8150-0x246b),(0x04eb+ 397-0x0603),(0x0783+ 1026-0x0b12),(0x0331+ 2600-0x0ce5)))) or (join("",map { chr($_); } (99,117,115,116))) . Of course it will increase size of your obfuscated code even more.There is also an option to not obfuscate strings at all. Adding extra parenthesis around expressionsPerl Obfuscator automatically puts parenthesis around expressions in the code tomake them more confusing to read. Replacing strings with interpolated variables with concatenation of the appropriate componentsPerl Obfuscator applies obfuscation to variables used in string interpolation.Strings with variable interpolations are automatically converted intoconcatenation operations that involve constant strings parts and variables.This makes your code even more difficult to read. Removing or obfuscation of commentsComments can be completely removed.Since Perl Obfuscator is very flexible and powerful tool, there are other ways to obfuscate them (besides keeping them as is):Leave only newlines in the comments. I.e. comments will span same number of lines but there won't be any text in them. This will keep line numbers of the protected code same as in original code (if you specify newlines in the protected code are not to be removed), Replace all characters but newlines with 'x'Replace all characters but spaces and newlines with 'x'These additional Perl obfuscation options demonstrate how well the original code was commented which may aid in selling the code. Removing spaces and tabs in the lines of codeThis Perl obfuscation stage removes all spacing and identation in the code.This makes the code more difficult to read, and greatly reduces its size.This step won't do anything with linebreaks in the code.Of course this stage is optional. Joining all lines in your codeThis Perl obfuscation stage turns all the code into single line.Statement separators will be inserted in the appropriate places.This makes even looking at code difficult, since the viewer will have to scroll back andforth.There is a setting to rewrap the code into several lines, each being no longer thanspecified number of characters.Sometimes it's better not to apply this step if your code is not well-debugged and you wish error messages to contain line numbers matching your original code.Of course this stage is optional. Encoding the result of previous stagesEncoding means hiding Perl code by converting it into a special form that completely hides program structure. It also adds special advanced code that will decode the encoded script at runtime and execute it. Since the decoding code is automatically included into each protected file, no standalone decoders or interpreters are needed for running protected files. By default, encoding is applied to the result of obfuscation, but it's possible to apply encoding to original source directly. This allows effortless code hiding that does notrequire any adaptation of the Perl code.Of course this stage is optional too.See samples for how encoded Perl looks like.Even only obfuscated code with no encoding applied is extremely difficult to understand for a human since the name of variables and subroutines and other symbols are totally meaninglessand difficult to remember (e.g. @files becomes @zcadaa4fc81). It is possible to control all aspects of code hiding using the GUI and commandline switches of perl-obfus. An sample of how cryptic a typical file looks after obfuscation andencoding with Perl-Obfus is available.The features summary of Stunnix Perl-obfus:Unique! New! Includes Project Manager - an advanced intuitive cross-platform graphical user interface for protecting projects of any size with mixed types of code and files.Unique! Full support for all Perl language constructs.Unique! Full support for applications consisting of several Perl modules.Unique! Full support for keeping library modules application uses in non-obfuscated (original) form. Encoding of the file is performed by default. No standalone decoder is required to support the encoded files. Support for program expiration, advanced hostname check and general checks and actions such as program removal and printing notifications in the non-removable encoded block of code.Unique! Supports source compression mode.Unique! Available in Standard and Lite Editions.Unique! Has special mode for as quick as possible preparation of projects for protection..Unique! A variety of options to tightly control the code hiding.Unique! Utilities to make the preparation of code for obfuscation easier.Unique! Includes unique utilities to gather project-specific exceptions: utility to gather html form fields' names and IDs of html elements, and a utility to extract all symbols from ActiveX or OLE components;Unique! Includes utility to simplify turning protected code into a standalone executable using third-party utilities like Perl2Exe;Unique! Means to make analysis of changes between different releases of the obfuscated product more difficult. Easy to install on any Unix/Linux or Windows server.Unique! Web-based commandline builder is available.Stunnix Perl-obfus features in detailProject Manager - an advanced user interface for projects ofany complexityThe power and flexibility of Stunnix Obfuscators are now available viaa graphical user interface, eliminating the need to even read the descriptionsof the commandline options supported!Stunnix Obfuscator Project Manager - an advanced intuitive cross-platform graphical user interface is included.It allows the protection of projects of any complexity, consisting of filesof any type, and possibly including code of any type (client-side,server-side, .asp pages with both server side and client-sidecode, .html files with client-side code), even allowing code in somefiles to be processed with different sets of options or even not processed at all. It has 'build project' functionality available in most popular IDEs that will result in processing only files which are newer than their protected version. Files free from code (like images or .css files) will simply becopied to the directory with protected version of the project, allowingthe use of Project Manager as a generic replacement for a 'Make'-like utility.It completely eliminates the need to compose and invoke the commandline manually as all operations can be performed using mouse.Screenshot of Stunnix Obfuscator Project Manager GUI. Click to work with LIVE ONSITE demo! Users who prefer to use the commandline will be able to compose abuild script (a special project-specific perl program that is effectively a smart stand-alone replacement for project-specificMakefile that already includes the functionality of the Make utility). Just invokethat build script to perform any desired operations such as cleaning all output files,rebuilding only changed files or rebuilding all files (with ability to specify only a subset of files).You can see Stunnix Perl-Obfus Project Manager running on our site in demo mode (destructive and editing operations are disabled).You can download Project Manager to evaluate it.Full support for all Perl language constructsDue to the deep integration with Perl language interpreter, Stunnix Perl-obfusprovides a unique level of support for all Perl language constructs andtheir advanced use. No other product aiming at obfuscation of Perl source code technically and theoretically provides this.Stunnix Perl-obfus supports advanced Perl constructs includingnested regular expressions (i.e. regular expressions inside substitutionpart of s///e operator), all forms of interpolating variables of all types in strings and in regular expressions even with so-called extened patterns, perl formats, all quote and quote-like operators,"<<EOF" constructs andseveral ways of handling POD documentation and data after __DATA__sections. This means that majority of the Perl source code obfuscatedwith Stunnix Perl-obfus will truly function the same as non-obfuscatedcode. This is a unique feature of the Stunnix Perl-obfus.In order to ease the checking of obfuscated code for correctness, a special utility is provided that detects the names of undeclaredsubroutines and other symbols.Full support for applications consisting of several Perl modulesStunnix Perl-Obfus, unlike other tools, was designed with multi-module programs in mind. Stunnix Perl-obfus keeps a module export list (i.e. @EXPORT=qw();) and arbitrary strings that contain symbol names(e.g. portions of the argument ofeval builtin function) in sync withthe obfuscated names of variables and subroutines automatically. Developer has to mark up such strings in a special way though (by wrapping them in call ofhelper function that Perl-Obfus treats specially), while preparing code for obfuscation.Full support for keeping library modules application uses in non-obfuscated (original) formMost applications use Perl standard modules like File::Pathor third-party modules. In the case of standard Perl modules it's preferable to not ship obfuscated version of such standard modules, butforce the program to use the version that comes with Perl in order toreduce distribution size and to avoid licensing issues. In the case ofthird-party modules, licensing conditions frequently disallow modificationof those modules, thus there are no options except shipping them in original, non-obfuscated form. Stunnix Perl-obfus allows such cases by providing a utility to generate exception lists.Encoding of the file is performed by defaultTo make the results of processing bear no resemblance to the codeof any programming language, those results are encoded. No stand alone decoderis required to support the encoding of files.Support for ensuring license conditionsThere is state of the art support for program expiration andseveral variants of hostname checking (single allowed host name, list of hostname tails, regular expression hostname matching).If licensing conditions are not met, the program can remove itself automatically. There is alsoan option to print a custom notification message after which the program willterminate. User-defined checks with actions are supported as well.A special initialization code is applied to blocks of code. Without this intializationcode, the program won't work correctly. The whole block is also encoded to protect it fromanalysis and modification. This block of code can't be removed from theprogram body without making it malfunction. Several sources of informationabout current time and host name are suported.See more details here.Supports source compression modeStunnix Perl-Obfus supports source code compression mode via theinclusion of special aid. In this mode symbols are renamed to the shortest randomallowed symbol name in order to minimize the resultant size of output(the more frequently used symbols are renamed to shorter symbols). This turnsStunnix Perl-Obfus into a so-called "source code compressor" tool.This module works for multimodule projects too.Available in Standard and Lite EditionsStunnix Perl-Obfus is available in Standard and Lite Editions in order to be even more cost-effective. You don't have to pay for very advanced features if you don't need them! There is a document listing the differences between editions.Special mode for the quickest preparing of a project for protectionA special obfuscation mode is present that allows a project to be adaptedfor obfuscation quickly. There is no need to spend valuable timewhile performing the trial-and-error preparation process. Due to the availabilityof unique symbol extraction utilities not available with anyother products, the preparation process is as short as theoretically possible.A variety of options to tightly control the obfuscationAs with all Stunnix products, programs of a Stunnix Perl-obfus suitehave a lot of commandline options to tightly control each aspect of their operation.All options have intuitive names, and there is extensive documentation on each option available.Default options for the main part of the Stunnix Perl-obfus suitecan be conveniently stored in a globally-visible file.There are free and very useful web-based commandline buildersfor Perl-Obfus too; they are very useful for getting impressions of what abilities Perl-Obfus provides.Utilities to make code preparing for obfuscation easier are includedThree extra utilities are included to make preparing code for obfuscation - gen-ident-exceptions.pl,find-undeclared-subs.pland get-idents-from-html.pl.The gen-ident-exceptions.pl allows the generation of a list of symbol names thatshouldn't be obfuscated (e.g. ones from third-party modules).The find-undeclared-subs.pl is designed to check the obfuscated codefor the absence of undeclared subroutines and other types of symbols, andget-idents-from-html.pl is designed for the extraction of names of html formfields.Included utilities to gather project-specific exceptionsUnique utilities to gather project-specific exceptions areincluded: utility to gather html form fields' names and IDs of html elements, and ability to extract all symbols from ActiveX or OLE components.These utilities are a must have for any professional obfuscator. Withoutthem composing lists of exceptions for a project of even medium size is very time-consuming, dull anderror-prone process typically accomplished by using trial-and-error technique.The functionality of both utilities is fully integrated into Project Manager user interface and thuscan be carried on by using the mouse only.Includes utility to simplify turning protected code into standalone executable using third-party utilities like Perl2ExeSpecial utility - get-mods-list.pl - is included to create lists of modules that perlcode uses or requires. Such lists of modules may be needed by varioustools for converting perl code into standalone executables - likePerl2Exe and PAR toolkit.Means to make the analysis of changes between different releases of the obfuscated product more difficultAmong a variety of options that control each aspect of obfuscation andencoding are ones that make only obfuscated (but not encoded) versions of the same source code different from each other after each run of Perl-Obfus. This can be used to make analysis of changes between different versions of the software much more difficult.Another use is distributing unique versions of the obfuscated codeto each customer. This way a developer can track license violations toa specific customer (so called perl source code watermarking).Key internal parameters of encoding already depend on random values, sothe encoded version of the same file will be different on each run.Easy to install on any Unix/Linux or Windows serverStunnix Perl-obfus is a suite of Perl applications.It requires a working Perl version 5.8 or greater installed somewhere in your system (a so-called "interpreter for backend"). It needn't be a default perl interpreter in your system - you can install this version of perl into non-standardlocation for it to coexist with your system perl. Of course the perlversion 5.8 or greater is required by Stunnix Perl-obfus itself only, obfuscated version of the code won't require any particularperl version if it didn't require one before. No additional non-standard Perl modules are required for Stunnix Perl-obfus. In case the "interpreter for backend" is differentfrom the system perl, no modules required by the program being obfuscated need to be installed for "interpreter for backend".Stunnix Perl-obfus comes as an archive file in tar.gz or self-extracting archive format. It can be extracted to any directoryyou like. Optionally one can set default values for the site-specific options in the configuration file, however most people won't needto change the defaults.Web-based commandline builder is availableDespite the fact that primary interface to Stunnix Perl-Obfus is commandline-based, there are very useful commandline buildersfor Perl-Obfus. There is a link to the documentation near each form field,that fully explains the purpose and semantics of each option. They are very useful for getting impressions of the capabilities of Perl-Obfus.There are two editions of Stunnix Perl-obfus - Standardand Lite. There is a document listing differences between these editions.Related linksEvaluation version of the Stunnix Perl Web Server can be used as a sample of protecting complex and big projectusing Stunnix Perl-Obfus.Full documentation for Stunnix Perl-Obfus is available online.You can see a Project Manager for Perl Obfuscatordemo on our site, or go straight to the pagewith obfuscation and encoding options available.An example of how cryptic a typical file looks after obfuscation withPerl-Obfus is available.Stunnix Perl-obfus can be purchased in our online store.An Obfuscator for JavaScript language - Stunnix JS-Obfus - is also available from us. Sitemap | Privacy Policy | Terms of Use | Signup for newsletter | Feedback | Affiliate!© 2002-2008 Stunnix. All rights reserved._uacct = "UA-1017812-1";urchinTracker();function getElementsByClassName(strClass, strTag, objContElm) { strTag = strTag || "*"; objContElm = objContElm || document; var objColl = objContElm.getElementsByTagName(strTag); if (!objColl.length && strTag == "*" && objContElm.all) objColl = objContElm.all; var arr = new Array(); var delim = strClass.indexOf('|') != -1 ? '|' : ' '; var arrClass = strClass.split(delim); for (var i = 0, j = objColl.length; i < j; i++) { var arrObjClass = objColl[i].className.split(' '); if (delim == ' ' && arrClass.length > arrObjClass.length) continue; var c = 0; comparisonLoop: for (var k = 0, l = arrObjClass.length; k < l; k++) { for (var m = 0, n = arrClass.length; m < n; m++) { if (arrClass[m] == arrObjClass[k]) c++; if (( delim == '|' && c == 1) || (delim == ' ' && c == arrClass.length)) { arr.push(objColl[i]); break comparisonLoop; } } } } return arr;}// To cover IE 5.0's lack of the push methodArray.prototype.push = function(value) { this[this.length] = value;}if (0) {/* add dummy current location to hold space */var aaa = getElementsByClassName("curloc");if (!aaa.length) { document.write("" + document.title + " |
|
