Truncation is detected
A cut file no longer matches its GCM tag. The loader fails with a decode error instead of executing a partial program.
SECURITY ARCHITECTURE
Anti-Tamper & Anti-Rollback
Altered binaries fail to decode. Downgraded builds are rejected by monotonic counters. OnionZero is designed so that the easiest response to an attack is a clean refusal — never corrupted execution.
Binary integrity by construction
Every protected file is sealed with AES-256-GCM — an authenticated encryption mode. The authentication tag is a cryptographic proof that the payload is exactly the bytes the vendor sealed.
Modification is detected
Flipping a single byte invalidates authentication. Patched or injected payloads are rejected before any code runs.
Substitution is detected
Swapping a file from another package — or an older release — fails the same check. Each artifact authenticates as itself, and only as itself.
Monotonic counters: no way back
Attackers do not only break current builds — they downgrade to old, weaker ones. OnionZero counters this with monotonic version state that only moves forward.
Versions are ordered, not just numbered
License and runtime state carry a monotonic revision. Once the system has seen a newer revision, older ones stop being acceptable.
Downgrades are refused
Restoring an old license file, snapshot or backup from before an update is detected as a rollback attempt and rejected.
Policy enforcement
Minimum-version and forced-update policies let the vendor declare old releases dead. A patched vulnerable build stays patched in the field.
Runtime defenses
The native extension adds baseline anti-debugging and tamper-detection layers around the compile step — the moment where plaintext briefly exists in memory.
- Anti-debugging checks around the in-memory decryption path
- Clock-rollback detection against expiry-bypass attempts
- Integrity-verified license files re-validated on every load
- Tamper events surfaced to the vendor as a reviewable queue
BEYOND PHP
The same guarantee beyond PHP
OnionZero PE/Binary and Android protection seal ready-made .exe/.dll binaries and Android APKs under the same security architecture:
- PE and Android builds ship with self-integrity verification: a patched or injected payload fails its check and is refused before any code runs.
- The Android guard library detects hooking toolkits such as Frida and debugger attachment — the mobile sibling of the runtime defenses above.
Ship builds attackers cannot rewrite
Ask us how anti-tamper and anti-rollback policies apply to your release model.