As so many others, I've been a victim of having a PHP product of mine be nulled and put available on the internet to download freely. The purpose of this question is to try to make it more difficult for someone to null an entire PHP application by understanding how it's done and other perspectives on how to avoid it as much as possible.
What I'm trying to know is how does a PHP application with the following protection strategies gets nulled. What does an attacker thinks and do when it wants to null an application:
- obfuscated code
- license key activation (delivering the rest of the code once the license is validated and successful)
- persistent internal validation: validation of auto generated files, upon finishing the app installation, containing encrypted data of the approved domain and hidden in multiple subdirectories with different filenames and extensions
- periodic external validation: periodic cURL validations to my server (hidden in multiple parts of the obfuscated core of the application) with all the common function names used to communicate with external servers also obfuscated with different encodings
I know it's impossible to build an application to be delivered to the public to be attack-proof but is there any chance to build it to be so hard to null that the job for the attacker doesn't payoff?