如何保护Golang源代码

Actually, I'm a PHP developer. I want to sell my PHP product.

So, I want to protect some major source code in PHP. But it's impossible in PHP.

I know Golang also. So, I want to to build secret algorithm in golang code and compile into binary.

Finally I want to protect my PHP major algorithm with PHP code && binary program.

My doubt is:

When I'm compiling golang source code into binary file. Is it possible to grab golang source code from binary file ?

No, if they really really want to, they can disassemble the binary and guess what the algorithm does from the assembly, this however, applies to all languages.

If it runs, it can be disassembled and it can be broken.

There are 3 things you can do to protect your code.

  1. You can, of course, obfuscate all the code prior to a build. I dont knwo of any specific golang tools to do this.

  2. Stripping symbols But i worry about a "gifted hacker" who will decompile and try to steal my work. It has happened a few times already. So, you want something whereby the "hacker" is defeated as it's too much work to try and re-assemble.

Stripping the symbols should be more than enough.

You can omit debug information passing the '-w' flag to the linker, and you can omit the symbol table by passing '-s'.

See go tool link in 1.5 here: https://golang.org/cmd/link/

  1. Device Fingerprinting This ensures your software cannot run unless its on the same machine when the license was generated for it.

The license is stored on your server, and the fingerprint meta data is sent and check.

You can see this in action here:

https://github.com/hashicorp/nomad/blob/master/client/client.go#L147

Note that in their code they are NOT generating a license against the fingerprint. This is something you would want to do as extra. You can also hash it and sign it and other fancy stuff, but thats too much detail for this post.

Of course a "hacker" can get around this IF they can decompile your code, but as i mentioned in Step 2, this can be defeated pretty well by stripping the symbols.

Obfuscation, as in step 2 helps, but most decent coders can find the place where the code is doing a check and just comment out the check and recompile.

But with no symbols its almost impossible to recompile.

Hope that helps ...