Windows环境下PHP Desktop Chrome57+PHP7.1敏感代码防篡改方案咨询

Hey there! Let's tackle this source code protection issue for your PHP Desktop Chrome 57 + PHP 7.1 setup on Windows. Since you only need to secure specific sensitive PHP files and don't want to spend money on commercial tools, here are some practical, low-cost (or free) approaches that might work better than the free solutions you've already tested:

PHP 7.1 has built-in OpenSSL support (just make sure it's enabled in your PHP Desktop php.ini), so you can encrypt your sensitive files and write a simple loader to decrypt and execute them on the fly. This gives you full control over which files to protect.

Step 1: Encrypt your sensitive PHP file #

Create a one-time encryption script (run this locally, not in your deployed app):

<?php
$sourceFile = 'path/to/your/sensitive-file.php';
$encryptedFile = 'path/to/encrypted-sensitive-file.php.enc';
$key = getenv('MY_APP_SECRET_KEY'); // Use a strong 32-byte key for AES-256

// Read source content
$content = file_get_contents($sourceFile);
// Encrypt with random IV (needs to be stored for decryption)
$iv = random_bytes(openssl_cipher_iv_length('aes-256-cbc'));
$encrypted = openssl_encrypt($content, 'aes-256-cbc', $key, 0, $iv);
// Save IV + encrypted content
file_put_contents($encryptedFile, base64_encode($iv) . ':' . $encrypted);
?>

• Set MY_APP_SECRET_KEY as a Windows environment variable (so it's not hardcoded in your app)
• Delete this encryption script after you're done using it

Step 2: Create a loader to decrypt and execute #

In your main app code, use this loader instead of include()/require() when you need to access the sensitive file:

<?php
function loadEncryptedFile($encryptedPath) {
    $key = getenv('MY_APP_SECRET_KEY');
    $data = file_get_contents($encryptedPath);
    list($ivBase64, $encryptedContent) = explode(':', $data, 2);
    $iv = base64_decode($ivBase64);
    $decrypted = openssl_decrypt($encryptedContent, 'aes-256-cbc', $key, 0, $iv);
    // Execute the decrypted code
    eval('?>' . $decrypted);
}

// Use it like this:
loadEncryptedFile('path/to/encrypted-sensitive-file.php.enc');
?>

• Pro tip: Store encrypted files in a subdirectory that's not exposed via PHP Desktop's web server (check your settings.json to confirm this directory isn't served publicly)

If pure encryption feels overkill, combine obfuscation (making code unreadable) with light encryption to add an extra layer. This works great for files where logic theft is a bigger concern than just tampering.

• Use a local PHP obfuscator (avoid online tools for sensitive code) – you can use the PHP-Parser library to automate variable renaming, remove comments/whitespace, and shuffle code flow.
• After obfuscating, apply the OpenSSL encryption method above to the obfuscated code. Even if someone manages to decrypt it, the obfuscated code will be extremely hard to reverse-engineer.

PHP Desktop lets you package files in a way that's not easily accessible to end-users. Combine this with encryption for extra security:

• Move your encrypted sensitive files into the resources directory of your PHP Desktop package (this directory is part of the app bundle and not directly visible to users unless they unpack the executable)
• Modify your loader script to read files from this internal path (use __DIR__ to reference relative paths safely)

Key Notes to Avoid Common Pitfalls #

• Backup your original files: Always keep unencrypted copies of your sensitive code in a secure, offline location.
• Test compatibility: Double-check that OpenSSL is enabled in your PHP Desktop's php.ini (look for extension=openssl).
• Secure your key: Never hardcode the encryption key in your source code. Use Windows environment variables, or store it in the Windows Registry (use exec('reg query ...') to retrieve it, but be cautious with this method).
• Add tamper detection: Compute a SHA-256 hash of the encrypted file during encryption, store it securely, and verify it before decryption. This way you'll immediately know if the file was tampered with.

内容的提问来源于stack exchange，提问作者Wax