PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the header file), I discover that they are still using MD5
as their password hashing function. Will is cause any vulnerabilities? It is worth to rewrite it by using a modern hashing function such as SHA256
? Furthermore, is BLENC safe to use? In other word, can it keep reverse engineering far of my code?
1 Answer
After for little research, I can say this extension is not safe because I can simply extract the main key in clear text format by using any type of HEX editor. Hash function is NOT important any more.
- Linux:
- Offset:
0x00003158
- Using
xxd
- Offset:
- Windows: Unable to compile but believe the develop team using default password
0123456789abcdef0123456789abcdef
- Offset:
0x0000355C
- Using
Hex Workshop
- Offset:
-
Is there anything else that can secure my code? I found a free tool fopo.com.ar. Is it safe? Thanks. @Hartman Sep 14, 2018 at 18:56