|
Anonymous Monk has asked for the wisdom of the Perl Monks concerning the following question:
Hi,
My client has a very specific requirement. He don't want to put source code on server. He only wants the file which contains some byte code or compiled code to keep in server due to some security problems.
Is it possible in perl? Just like in java(ie class files), is it possible in perl? Kindly, help me in this regard. I need it bit urgently.
If you find something about it, plz give a mail to sekharac@cwlglobal.com
Thanks
A C Sekhar |
Re: Can I get compiled code in Perl like in Java(class file)
by Dog and Pony (Priest) on Mar 07, 2002 at 09:48 UTC
|
I see that others already gave the answer, so I will give some food for thought:
If the reason for compiling is security reasons, you have serious problems - you should really tighten up that security before anything else.
You might, or you might not, want to mention facts like this to your client - either way, you are better off knowing this. The .class files for java is today only a minor hindrance if you don't have the source code. Decompilers like JAD works some insane magic to bring back the original source code, and all you really lose today are some of the variable names and the comments. Now, I am not very proficient in exactly which modules to use in perl, but at a guess, somewhere between B::Disassembler and B::Deparse probably would render that bytecoding useless as a means of concealment. Have not tried it though, but it is perlish to be possible to reverse engineer. :)
The next step is of course, as MZSanford suggested, to compile all the way. Thay way you have a binary file much like any other - too hard to decompile for it to be worth it.
Then again, maybe it is just your client that is concerned about this, due to reading some technical article he/she doesn't actually understand. (Pointy hair: "I think we should build a SQL database." Dilbert: "What color do you want it?" Pointy hair: "I think muave has more RAM."). In this case, you can just take the above suggestions, implement and everybody goes home happy. In either case, I think you are not worse off for knowing about these tools - and knowing that there are no replacement for real security, and of the would-be replacements, security through obfuscation is one of the most unreliable. Avoid at all costs. :)
You have moved into a dark place.
It is pitch black. You are likely to be eaten by a grue. | [reply] |
|
|
I faced something similar to this a while back. This is just some more food for thought (and maybe a little OT). My understanding of Perl 6 was that you could ask Perl to produce byte code that is compatable with Parrot. Does this mean that someone could write a Parrot to native instruction set compiler? This seems like a common problem, as I found Python programmers created a Py2Exe as well. Does anyone know about Parrot's direction for such things?
| [reply] |
Re: Can I get compiled code in Perl like in Java(class file)
by MZSanford (Curate) on Mar 07, 2002 at 09:24 UTC
|
gellyfish is correct that B::Bytecode will create Bytecode for a Perl program, very similar to .class files in Java. Based on the requirment as stated, and the problems i have personally had using B::Bytecode, i am more prone to suggest perlcc.
While perlcc is also listed as experimental, on Unix servers with gcc i have had very good luck with it. I suggest it for giving a try.Also, you may want to take a look at Super Search to see what people have said about using this kid of thing for security .I don't think they say good things, but most of the time this question come up not with sevrer side code, but client side code.
from the frivolous to the serious | [reply]
[d/l] |
Re: Can I get compiled code in Perl like in Java(class file)
by grummerX (Pilgrim) on Mar 07, 2002 at 11:11 UTC
|
If your client is running Windows, ActiveState's Perl Dev Kit allows you to compile into an executable or even an ActiveX object (cringe). This is a commercial solution, so you would have to shell out a few $$ for it. Another option is Perl2Exe, which has versions for Win32 and various flavors of Unix. The "lite" version appears to be freeware.
Bear in mind that I haven't tried either of these options myself, so I can't speak for their pros/cons. Just passing along the information ...
-- grummerX
| [reply] |
|
|
I have used both of these, and when it comes to win32, a great many people have trouble with the likes of perlcc, so it does have a use. I would like to mention, as before, that this is only faux security at best, but i imagine that, as stated elewhere in the thread, there is some oh-so-pointy-haired-polotics at work here. For the ActiveState exe solution, i would point to this node for some info on it's secutiry specifically.
from the frivolous to the serious
| [reply] |
|
|
I have not tried perlcc but I did try the ActiveState solution. First, it requires that you have Windows 2000. (A problem in our corporate environment.) So I tried to install it at home. No such luck. I found that Perl2Exe did work, yet it's kind of a small shop supporting it.
| [reply] |
Re: Can I get compiled code in Perl like in Java(class file)
by crazyinsomniac (Prior) on Mar 07, 2002 at 09:28 UTC
|
| [reply] |
Re: Can I get compiled code in Perl like in Java(class file)
by gellyfish (Monsignor) on Mar 07, 2002 at 09:12 UTC
|
Well there's B::Bytecode but it is, as it says in the documentation, experimental. Maybe it'll work for you though. /J\
| [reply] |
Re: Can I get compiled code in Perl like in Java(class file)
by perrin (Chancellor) on Mar 07, 2002 at 17:52 UTC
|
Since I happen to know you want to do this with mod_perl, I can tell you that there is no way to work with bytecode from mod_perl at this time. None of the suggestions above will work.
However, you can encrypt your source with a source filter. Look at something like Filter::CBC. | [reply] |
|
|
