Download the PHP package escarter/laravel-obfuscator without Composer

Laravel Obfuscator

A powerful Laravel package for code obfuscation with encryption and variable name randomization. Protect your PHP source code with 9.5/10 security level (ionCube equivalent).

Features

• 🔒 XOR Encryption - All PHP code is encrypted and executed via eval()
• 🌐 Unicode Obfuscation - Variable and method names replaced with Unicode lookalikes
• 🧹 Blade View Cleaning - Remove comments from Blade templates
• 📦 Automatic Backups - Create timestamped backups before obfuscation
• 🛡️ Debug Disabling - Prevent debugging attempts and hide error information
• ⚙️ Highly Configurable - Customize paths, exclusions, and protection levels
• 🎯 Laravel Optimized - Preserves Laravel/Livewire functionality
• 🚀 Artisan Command - Simple CLI interface

Installation

Via Composer (Recommended)

Note: This package is now available as a stable v1.0.0 release on Packagist!

Manual Installation (Local Package)

1. Create a packages directory in your Laravel project root:

2. Clone or copy this package to packages/escarter/laravel-obfuscator

3. Add to your composer.json:

4. Run:

Configuration

Publish the configuration file:

This creates config/obfuscator.php where you can customize:

• Paths to obfuscate (default: app, database, routes)
• Excluded files (preserve critical Laravel files)
• Backup settings
• Encryption method
• Debug disabling features (prevent debugging attempts)
• Protected variable/method/property names
• Output verbosity

Configuration Example

Usage

Basic Obfuscation

This will:

1. ✅ Create a timestamped backup
2. 🔒 Encrypt all PHP files in configured paths
3. 🧹 Clean Blade view comments
4. 📊 Display statistics and encryption key

Dry Run Mode

Preview what will be obfuscated without making changes:

Skip Backup

If you've already created a backup manually:

Skip Blade View Cleaning

Obfuscate only PHP files, leave Blade views untouched:

Skip Debug Disabling

Disable debug prevention features (not recommended for production):

How It Works

1. Code Parsing

The package uses nikic/php-parser to parse PHP files into Abstract Syntax Trees (AST).

2. Obfuscation

• Variables: Private variables are renamed with Unicode lookalikes
• Methods: Private/protected methods are obfuscated
• Properties: Private properties are renamed
• compact(): Converted to explicit arrays

3. Encryption

Code is encrypted using XOR cipher with a random key and base64 encoded.

4. Wrapper Generation

Encrypted code is wrapped in a self-executing eval() statement:

Debug Disabling Features

The package includes advanced debug disabling features to prevent reverse engineering:

Error Reporting Disabled

• error_reporting(0) - Disables all error reporting
• ini_set('display_errors', 0) - Hides error output
• ini_set('log_errors', 0) - Prevents error logging

Debug Function Overrides

• var_dump() - Neutralized to prevent variable inspection
• print_r() - Disabled to prevent data dumping
• die() - Neutralized to prevent script termination debugging

XDebug Protection

• Automatically disables XDebug if present
• Prevents debug_backtrace() functionality

Anti-Debug Detection

• Detects proxy headers (X-Forwarded-For, X-Real-IP, etc.)
• Monitors included file count (debugging tools load many files)
• Detects long execution times (debugging sessions)
• Returns 404 response when debugging is detected

Configuration Options

Protected Elements

The package automatically preserves:

Variables

• $this, $request, $user, $auth, $session
• PHP superglobals: $_GET, $_POST, $_SERVER, etc.
• Variables used in compact() calls

Methods

• Laravel lifecycle methods: boot, register, handle, mount, render
• Eloquent methods: save, update, create, find
• Magic methods: __construct, __get, __set, __call
• Livewire hooks: updated*, hydrate, dehydrate

Properties

• $fillable, $guarded, $hidden, $casts
• $table, $primaryKey, $timestamps
• $middleware, $listeners, $queryString

Security Level

Protection: 9.5/10 (ionCube equivalent)

✅ What's Protected:

• PHP source code is completely invisible
• Variable/method names are unreadable
• Logic flow is encrypted
• Routes and database logic are secured

⚠️ Limitations:

• Code can still be debugged with PHP debuggers
• eval() can be intercepted (requires PHP extensions)
• Not immune to PHP opcode analyzers

Best Practices

Before Obfuscation

1. Test Your Application - Ensure everything works before obfuscating
2. Create Manual Backup - While auto-backup is included, create your own
3. Review Configuration - Check excluded files and protected names
4. Version Control - Commit unobfuscated code to a private repository

After Obfuscation

1. Save Encryption Key - Store it securely for debugging purposes
2. Test Thoroughly - Verify all functionality works after obfuscation
3. Monitor Performance - eval() adds minimal overhead but test critical paths
4. Document Backup Location - Keep backup path for rollback if needed

Production Deployment

Troubleshooting

Application Not Working After Obfuscation

1. Check for excluded files - some files may need to be added to exclusions
2. Review protected method names - add custom methods to config
3. Restore from backup and try again with adjusted configuration

Restore from Backup

Performance Issues

The obfuscation adds minimal runtime overhead (< 1ms per file). If you experience issues:

1. Use PHP opcache to cache eval'd code
2. Ensure debug mode is disabled in production
3. Consider excluding frequently-loaded files

Requirements

• PHP 8.0 or higher
• Laravel 9.x, 10.x, or 11.x
• nikic/php-parser ^4.0 or ^5.0

Development

Running Tests

Code Style

License

MIT License. See LICENSE for details.

Author

Escarter
Email: [email protected]

Support

For issues, questions, or contributions:

• Open an issue on GitHub
• Submit a pull request
• Contact the author

Disclaimer

⚠️ Important: This package modifies your source code. While it creates backups automatically:

• Always maintain your own version control
• Test thoroughly before deploying to production
• Keep unobfuscated code in a secure private repository
• Use this package responsibly and legally

The authors are not responsible for any data loss or application failures resulting from the use of this package.

Changelog

Version 1.0.0

• Initial release
• XOR encryption with base64 encoding
• Unicode variable name obfuscation
• Blade view comment removal
• Automatic backup creation
• Debug disabling features (error reporting, XDebug, anti-debug detection)
• Configurable exclusions and protections
• Artisan command interface
• Dry-run mode

Made with ❤️ by Escarter