Obfuscating PHP source code with Maven and YAK Pro PO

I'm very close to being able to release a PHP project that I've been working on and started looking at code obfuscation to make it a little bit more difficult for anyone looking to take my code and run with it. I looked at YAK Pro PHP Obfuscator for this purpose and liked how easy it was to configure and use. However, I wanted it to work with Maven since I already use that to minify my JavaScript.

With a bit of pushing and prodding I got YAK Pro PO working with Maven, here's how. Below is the basic layout for the project directory structure, the main directory is where all PHP source code is. That directory can have sub-directories too. The resources directory contains my yakpro-po.cnf file, which holds configuration for YAK Pro PO. The target directory is where the context and obfuscated files will appear.

Project Structure

project_dir/

\_ src/

| \_ main/

| | \_ ...

| | \_ <php files>

| | \_ ...

| \_ resources/

| \_ yakpro-po.cnf

\_ target/

| \_ yakpro-po/

| \_ context/

| \_ obfuscated/

\_ pom.xml

Before I got started, I had to clone YAK Pro PO from Git, and get the PHP-Parser that it relies on. That is done via the following commands:

Terminal Commands

git clone https://github.com/pk-fr/yakpro-po.git

cd yakpro-po

git clone --branch=1.x https://github.com/nikic/PHP-Parser.git

Then I had to add some properties to my pom.xml file as below. Adjust the path to the php executable and the path to where you cloned YAK Pro PO.

POM Properties

<php_exec>/path/to/php</php_exec>

<yakpro_bin>/path/to/yakpro-po/yakpro-po.php</yakpro_bin>

<yakpro_conf_dir>${basedir}/src/resources</yakpro_conf_dir>

</properties>

To run YAK Pro PO I used the exec-maven-plugin and configured it with the properties from above as well as assumed directories from the project directory structure outlined at the start of this article. This is what the plugin configuration looks like...

Plugin Configuration

<groupId>org.codehaus.mojo</groupId>

<artifactId>exec-maven-plugin</artifactId>

<id>exec-yakpro</id>

<phase>compile</phase>

<goals>

</goals>

<workingDirectory>${yakpro_conf_dir}</workingDirectory>

<argument>${yakpro_bin}</argument>

<argument>${basedir}/src/main</argument>

<argument>${basedir}/target</argument>

</arguments>

</configuration>

</execution>

</executions>

</plugin>

Then to run, I just need to do:

Terminal Commands

mvn clean compile

I have a few more plugins configured in my particular setup that takes these obfuscated files and packages them in a distribution ZIP as well as deploys the code to my web test server, but that's outside the scope of this article.

Don't forget to adjust the configuration file for your needs. The default didn't work for me and I had to tweak settings until I got output that was obfuscated but would still run as usual.

-i