PHP Source Code Security Framework

PHP-AST/ORACLE is a C++ framework which allows user to perform lots of different operations on a source code. The tool has been developed mainly for:

How it works

The source code repository is divided in 2 parts:

  • php-ast is the converter from PHP to XML ( yaxx)
  • php-oracle is the actual engine

php-oracle get a XML file as input which is the output of php-ast. In the SVN there are some python scripts I used in order to combine the 2 tools (they may be outdated i.e. doesn't work with the current php-oracle).

How I think you could use php-oracle

I do not attend to make a clean build with an executable etc. I just provide source code. I decided to give only the source code because I don't want to spend too much time on creating a clean software, it's only research oriented stuff. Furthermore, there is not much documentation in the source code (advantages of being alone to develop such a tool) and then, only really interested people will download this! I can then help them if they have some question about how it works etc.

Getting the source code

You can check it out with svn: 

   svn checkout http://svn2.assembla.com/svn/php-ast

Building

You need to have libxml2(-dev) and that's all.

To build the php-ast, you need to: 

   make ast

and to build the php-oracle: 

   make oracle

(I know I am very original)

Bugs

There are plenty of bugs! I'm sure of that... I just release it (under my name) because I think people may be interested in the Obfuscation pattern engine or, Source to Source converter or the metrics (there is a first implementation of a source code security metric I am developing right now).

Contact

Romain Gaucher -  http://rgaucher.info