I'm not entirely sure how IonCube works, but if it works as I think, and isn't crackable, it would make a pirated add on impossible to null because there would be at least 1 vital function in there that would be encoded, and without it, the add on wouldn't work.
So if IonCube is as strong as I think, it would be the perfect solution.
I think I understand where the confusion is. What
@Mendalla and I are saying is; you could simply re-create the encoded function.
Let's say I have this file:
PHP:
<?php
namespace DBTech\eCommerce\Repository;
use XF\Mvc\Entity\Repository;
class ClassifiedsRepository extends Repository
{
public function getFilteredUserGroupTitlePairs(array $userGroups): array
{
return array_filter(
$userGroups,
fn ($v, $k) => in_array($k, \XF::options()->dbtechEcommerceClassifiedsUserGroups),
ARRAY_FILTER_USE_BOTH
);
}
public function getFilteredInputGroups(array $inputGroups): array
{
return array_filter(
$inputGroups,
fn ($v) => in_array($v, \XF::options()->dbtechEcommerceClassifiedsUserGroups)
);
}
}
Now, let's say we want to encode one of the functions, and to make it even more confusing we also rename it so that it's no longer possible to discern what the function does simply from its name. We might end up with, instead of
getFilteredInputGroups, something like this:
PHP:
public function x0800fc577294c34e0b28ad2839435945(array $x098f6bcd4621d373cade4e832627b4f6): array
{
// Replace this with however IonCube actually works
return IonCubeDecode('ad0234829205b9033196ba818f7a872b');
}
Looks foolproof, right? There's nothing in the function name or anything else that actually gives any hint what this function does.
Then we look at usage:
PHP:
$bulkInput['extra_group_ids'] = $classifiedsRepo->getFilteredInputGroups(
$this->filter('extra_group_ids', 'array-uint')
);
Even if we replace it so it says:
PHP:
$bulkInput['extra_group_ids'] = $classifiedsRepo->x0800fc577294c34e0b28ad2839435945(
$this->filter('extra_group_ids', 'array-uint')
);
It's still pretty obvious that it's doing
some kind of processing of the filtered input.
Working with this information, at some point during the process, the cracker would look at the settings and find this:
Putting two and two together, you can reasonably deduce that the encrypted function is filtering the user-provided data, and simply re-create the function in plaintext. Even if the code isn't 100% identical to what I originally wrote, it would still do the same job.
The addon has therefore been cracked.
So, the only way around this is to encode
more of the addon, right? If we keep applying this methodology to other random functions across the addon, all we're really doing is slowing the cracker down by having to repeat this process multiple times. If we encode a large enough chunk of the addon that an entire feature is locked behind encoding, then it's functionally identical to encoding 100% of the addon.
Even if you're willing to accept 100% encoding, that simply creates a new problem: There is now no way to know that the addon author isn't doing something shady. I could encode
anything in the IonCube encoded portions. I could send your session record and session cookie back to my server and change the session's IP to match my IP address, then simply insert that cookie in my browser and boom, I am logged in as you. Or I could change your password and simply login as if I'm you. I could
DROP DATABASE. There is literally no limit to what sort of shenanigans I could do.
That is, I would presume, at least part of the reason why encoded addons are forbidden.
Speaking personally, I want to give my customers the ability to modify the code. I want other developers to be able to figure out ways of extending my addons with their own functionality - or simply integrating with my addon, in the case of Credits - without me having to write and maintain detailed documentation.
Piracy is a service problem in a lot of ways, and I believe the addon update notifications in 2.4 is an important first step. If XenForo in the future will work towards increasing the visibility of addons by allowing admins to f.ex. search for addons in the AdminCP akin to WordPress, you reduce a lot of friction that might drive people towards all-in-one sites like the piracy sites.
