IonCube vs SourceGuardian: How They Actually Protect (and Decode) PHP
IonCube bends PHP's opcodes. SourceGuardian shuffles your code into the wrong order. A look at what each one actually does to your source, and how to spot which is which.
IonCube and SourceGuardian do the same job: turn your PHP into something a customer can run but can't read. How they get there is completely different, and that difference is what decides how you tell them apart and how cleanly your code comes back if you ever need it.
If you're choosing between the two, our three-way buyer's guide covers price and adoption. This one is about the internals: what each encoder actually does to your bytecode.
The short version
IonCube works at the opcode level. It keeps PHP's normal bytecode but changes how individual instructions behave. SourceGuardian works at the structure level. It leaves the instructions alone and shuffles the order of your code blocks instead. Two different bets on what's hardest to undo.
Side by side
| Dimension | IonCube | SourceGuardian |
|---|---|---|
| Compilation target | Zend VM opcodes | Zend VM opcodes (bytecode) |
| Main obfuscation | Opcode-level tricks | Basic-block shuffling ("entangle") |
| Encryption | Version-specific, key in loader | Blowfish-family, key in loader |
| Runtime extension | ionCube Loader | ixed Loader |
| Per-function runtime keys | Yes (dynamic / callback keys) | Limited |
| PHP versions | 7.1 to 8.4 (active) | 5.x to 8.x |
| License locking | Domain, IP, MAC, date | Domain, IP, date |
| Decodable by DecodePHP | Yes (v10-15) | Yes (all major releases) |
What IonCube does to your code
IonCube doesn't invent its own language. It runs your PHP through a modified Zend compiler and produces the same opcodes the normal PHP engine uses under the hood. Then it starts bending how those opcodes are used, just enough that an ordinary disassembler can't make sense of the output.
A few of the patterns we ran into while building our decoder:
- Conditional jumps doing other jobs. A
JMPZinstruction is supposed to carry a condition. IonCube emits it with no condition and reuses it as an unconditional break, or sometimes just a placeholder. Normal PHP would write a plainJMPhere, so read literally, IonCube's version looks broken. - Operands in the wrong place. A function's name normally sits on the call-setup instruction. IonCube moves it onto a later one, so the call looks like it has no target until you know where to look.
- A different temp layout. Temporary variables use an offset-based slot scheme instead of the direct indices stock PHP uses, so even the register references need remapping.
From version 12 onward, IonCube can also use dynamic keys: a function stays encrypted until a callback runs at runtime and hands back the key. None of this is encryption in any real cryptographic sense. The goal is just to make the bytecode meaningless to anything that doesn't already know IonCube's private rules.
What SourceGuardian does to your code
SourceGuardian compiles to Zend bytecode too, but its main trick is structural. It has a mode it calls "entangle" that splits every function into basic blocks (the straight-line runs of code between jumps) and then reorders them. The original flow gets patched back together with extra jumps, sometimes called trampolines.
Every instruction your program needs is still there. What's gone is the order. A decompiler that just reads the blocks top to bottom rebuilds them wrong and gives you code that looks fine but isn't: do-while loops that were never in the source, ternaries hanging off the wrong branch, dead fragments. Getting the real block order back is most of the work in decoding SourceGuardian, and it's why you can't point an IonCube decoder at it and expect anything useful.
The payload itself is wrapped with a Blowfish-style cipher and run by SourceGuardian's ixed loader, its equivalent of the ionCube Loader.
Why the difference matters
The two approaches break in different places. IonCube goes after the instructions, so if you don't know which opcodes are lying about their purpose you can't lift them back to source. Map the rules, though, and the control flow is all there. SourceGuardian goes after the shape of the program, so the instructions stay honest but you have to rebuild the structure from nothing. That second one is why so many cheap SourceGuardian decoders hand you convincing nonsense.
Telling them apart
Before you decode anything, work out who made it. Open the file in any text editor and look at the first line or two:
| Encoder | What you'll see |
|---|---|
| IonCube | a <?php //00... header and an ionCube Loader check |
| SourceGuardian | a call to sg_load( followed by a long base64-looking blob |
| Zend Guard | references to Zend Optimizer or Zend Guard Loader |
If you'd rather not read hex, our free version detector pulls it straight from the header in your browser.
So which one is harder to crack?
Neither is "secure" in the way people usually mean it. Both ship the decryption key inside the loader extension, and that extension sits on every server that runs the code. Read the binary, recover the key. That part is the same for both.
The difference shows up after decryption. With IonCube you need an accurate map of its opcode conventions. With SourceGuardian you need to rebuild the program's structure. The block shuffling trips up weak tools far more often, so if you're checking the output of any decoder, look hardest at SourceGuardian results.
How we handle both
We run a separate decoder for each, because the hard part lives somewhere different in each case:
- IonCube (10 through 15). We map the repurposed opcodes, relocated operands and offset temp layout back to normal Zend semantics, then lift that to readable PHP. Dynamic keys get recovered automatically when the callback context is there.
- SourceGuardian. We rebuild the real block order first, which is what stops the phantom loops and misplaced branches that generic tools produce.
Either way you get a free preview of the first 20 decoded lines before paying, so you can check the output on your own file.
Bottom line
These aren't two flavors of the same thing. IonCube bends the meaning of individual opcodes. SourceGuardian scrambles the order of your code. Once you know which one you're looking at, you know what to expect from the output, and which decoder to reach for: the IonCube decoder or the SourceGuardian decoder.
Not sure which you've got? Run it through the detector, then drop it into the free preview.
Ready to decode your IonCube files?
Upload a file and preview the first 20 lines for free. No account required.
Try It Free