Finding entry points Branch analysis from position: 0 2 jumps found. (Code = 43) Position 1 = 5, Position 2 = 35 Branch analysis from position: 5 6 jumps found. (Code = 188) Position 1 = 17, Position 2 = 20, Position 3 = 23, Position 4 = 26, Position 5 = 29, Position 6 = 8 Branch analysis from position: 17 1 jumps found. (Code = 42) Position 1 = 33 Branch analysis from position: 33 1 jumps found. (Code = 42) Position 1 = 104 Branch analysis from position: 104 1 jumps found. (Code = 62) Position 1 = -2 Branch analysis from position: 20 1 jumps found. (Code = 42) Position 1 = 33 Branch analysis from position: 33 Branch analysis from position: 23 1 jumps found. (Code = 42) Position 1 = 33 Branch analysis from position: 33 Branch analysis from position: 26 1 jumps found. (Code = 42) Position 1 = 33 Branch analysis from position: 33 Branch analysis from position: 29 1 jumps found. (Code = 79) Position 1 = -2 Branch analysis from position: 8 2 jumps found. (Code = 44) Position 1 = 10, Position 2 = 17 Branch analysis from position: 10 2 jumps found. (Code = 44) Position 1 = 12, Position 2 = 20 Branch analysis from position: 12 2 jumps found. (Code = 44) Position 1 = 14, Position 2 = 23 Branch analysis from position: 14 2 jumps found. (Code = 44) Position 1 = 16, Position 2 = 26 Branch analysis from position: 16 1 jumps found. (Code = 42) Position 1 = 29 Branch analysis from position: 29 Branch analysis from position: 26 Branch analysis from position: 23 Branch analysis from position: 20 Branch analysis from position: 17 Branch analysis from position: 35 2 jumps found. (Code = 43) Position 1 = 39, Position 2 = 100 Branch analysis from position: 39 2 jumps found. (Code = 43) Position 1 = 81, Position 2 = 87 Branch analysis from position: 81 1 jumps found. (Code = 42) Position 1 = 89 Branch analysis from position: 89 1 jumps found. (Code = 79) Position 1 = -2 Branch analysis from position: 87 1 jumps found. (Code = 79) Position 1 = -2 Branch analysis from position: 100 1 jumps found. (Code = 79) Position 1 = -2 filename: /in/323kq function name: (null) number of ops: 105 compiled vars: !0 = $uam_secret, !1 = $uamip, !2 = $uamport, !3 = $username, !4 = $password, !5 = $challenge, !6 = $encoded_password, !7 = $redirect_url line #* E I O op fetch ext return operands ------------------------------------------------------------------------------------- 2 0 E > ASSIGN !0, 'J3ZYzRpqBC' 100 1 FETCH_R global ~9 '_SERVER' 2 FETCH_DIM_R ~10 ~9, 'REQUEST_METHOD' 3 IS_IDENTICAL ~10, 'GET' 4 > JMPZ ~11, ->35 101 5 > FETCH_R global ~12 '_GET' 6 FETCH_DIM_R ~13 ~12, 'res' 7 > SWITCH_STRING ~13, [ 'logoff':->17, 'success':->20, 'failed':->23, 'notyet':->26, ], ->29 102 8 > CASE ~13, 'logoff' 9 > JMPNZ ~14, ->17 105 10 > CASE ~13, 'success' 11 > JMPNZ ~14, ->20 108 12 > CASE ~13, 'failed' 13 > JMPNZ ~14, ->23 111 14 > CASE ~13, 'notyet' 15 > JMPNZ ~14, ->26 16 > > JMP ->29 103 17 > INIT_FCALL 'print_logoff' 18 DO_FCALL 0 104 19 > JMP ->33 106 20 > INIT_FCALL 'print_success' 21 DO_FCALL 0 107 22 > JMP ->33 109 23 > INIT_FCALL 'print_failed' 24 DO_FCALL 0 110 25 > JMP ->33 112 26 > INIT_FCALL 'print_logon_form' 27 DO_FCALL 0 113 28 > JMP ->33 115 29 > INIT_FCALL 'http_response_code' 30 SEND_VAL 400 31 DO_ICALL 116 32 > EXIT 33 > FREE ~13 34 > JMP ->104 118 35 > FETCH_R global ~20 '_SERVER' 36 FETCH_DIM_R ~21 ~20, 'REQUEST_METHOD' 37 IS_IDENTICAL ~21, 'POST' 38 > JMPZ ~22, ->100 119 39 > FETCH_R global ~23 '_POST' 40 FETCH_DIM_R ~24 ~23, 'uamip' 41 ASSIGN !1, ~24 120 42 FETCH_R global ~26 '_POST' 43 FETCH_DIM_R ~27 ~26, 'uamport' 44 ASSIGN !2, ~27 121 45 FETCH_R global ~29 '_POST' 46 FETCH_DIM_R ~30 ~29, 'username' 47 ASSIGN !3, ~30 122 48 FETCH_R global ~32 '_POST' 49 FETCH_DIM_R ~33 ~32, 'password' 50 ASSIGN !4, ~33 123 51 FETCH_R global ~35 '_POST' 52 FETCH_DIM_R ~36 ~35, 'challenge' 53 ASSIGN !5, ~36 124 54 INIT_FCALL 'encode_password' 55 SEND_VAR !4 56 SEND_VAR !5 57 SEND_VAR !0 58 DO_FCALL 0 $38 59 ASSIGN !6, $38 126 60 ROPE_INIT 5 ~41 'http%3A%2F%2F' 61 ROPE_ADD 1 ~41 ~41, !1 62 ROPE_ADD 2 ~41 ~41, '%3A' 63 ROPE_ADD 3 ~41 ~41, !2 64 ROPE_END 4 ~40 ~41, '%2Flogon' 127 65 CONCAT ~44 ~40, '%3Fusername%3D' 66 INIT_FCALL 'urlencode' 67 SEND_VAR !3 68 DO_ICALL $45 69 CONCAT ~46 ~44, $45 128 70 CONCAT ~47 ~46, '%26password%3D' 71 INIT_FCALL 'urlencode' 72 SEND_VAR !6 73 DO_ICALL $48 74 CONCAT ~49 ~47, $48 126 75 ASSIGN !7, ~49 133 76 INIT_FCALL 'session_start' 77 DO_ICALL 134 78 FETCH_IS ~52 '_POST' 79 ISSET_ISEMPTY_DIM_OBJ 0 ~52, 'userurl' 80 > JMPZ ~53, ->87 135 81 > FETCH_R global ~56 '_POST' 82 FETCH_DIM_R ~57 ~56, 'userurl' 83 FETCH_W global $54 '_SESSION' 84 ASSIGN_DIM $54, 'userurl' 85 OP_DATA ~57 86 > JMP ->89 137 87 > FETCH_UNSET $58 '_SESSION' 88 UNSET_DIM $58, 'userurl' 139 89 > INIT_FCALL 'session_write_close' 90 DO_ICALL 141 91 INIT_FCALL 'header' 92 NOP 93 FAST_CONCAT ~60 'Location%3A+', !7 94 SEND_VAL ~60 95 SEND_VAL <true> 96 SEND_VAL 302 97 DO_ICALL 142 98 > EXIT 99* JMP ->104 144 100 > INIT_FCALL 'http_response_code' 101 SEND_VAL 400 102 DO_ICALL 145 103 > EXIT 146 104 > > RETURN 1 Function encode_password: Finding entry points Branch analysis from position: 0 2 jumps found. (Code = 47) Position 1 = 7, Position 2 = 10 Branch analysis from position: 7 2 jumps found. (Code = 43) Position 1 = 11, Position 2 = 12 Branch analysis from position: 11 1 jumps found. (Code = 62) Position 1 = -2 Branch analysis from position: 12 2 jumps found. (Code = 43) Position 1 = 18, Position 2 = 19 Branch analysis from position: 18 1 jumps found. (Code = 62) Position 1 = -2 Branch analysis from position: 19 2 jumps found. (Code = 43) Position 1 = 22, Position 2 = 30 Branch analysis from position: 22 1 jumps found. (Code = 42) Position 1 = 33 Branch analysis from position: 33 1 jumps found. (Code = 42) Position 1 = 43 Branch analysis from position: 43 2 jumps found. (Code = 44) Position 1 = 46, Position 2 = 37 Branch analysis from position: 46 1 jumps found. (Code = 42) Position 1 = 58 Branch analysis from position: 58 2 jumps found. (Code = 44) Position 1 = 60, Position 2 = 49 Branch analysis from position: 60 1 jumps found. (Code = 62) Position 1 = -2 Branch analysis from position: 49 2 jumps found. (Code = 44) Position 1 = 60, Position 2 = 49 Branch analysis from position: 60 Branch analysis from position: 49 Branch analysis from position: 37 2 jumps found. (Code = 44) Position 1 = 46, Position 2 = 37 Branch analysis from position: 46 Branch analysis from position: 37 Branch analysis from position: 30 1 jumps found. (Code = 42) Position 1 = 43 Branch analysis from position: 43 Branch analysis from position: 10 filename: /in/323kq function name: encode_password number of ops: 65 compiled vars: !0 = $plain, !1 = $challenge, !2 = $secret, !3 = $hexchall, !4 = $crypt_secret, !5 = $len_secret, !6 = $crypted, !7 = $i, !8 = $extra_bytes line #* E I O op fetch ext return operands ------------------------------------------------------------------------------------- 4 0 E > RECV !0 1 RECV !1 2 RECV !2 5 3 STRLEN ~9 !1 4 MOD ~10 ~9, 2 5 IS_NOT_EQUAL ~11 ~10, 0 6 > JMPNZ_EX ~11 ~11, ->10 6 7 > STRLEN ~12 !1 8 IS_EQUAL ~13 ~12, 0 9 BOOL ~11 ~13 10 > > JMPZ ~11, ->12 7 11 > > RETURN <false> 9 12 > INIT_FCALL 'hex2bin' 13 SEND_VAR !1 14 DO_ICALL $14 15 ASSIGN !3, $14 10 16 TYPE_CHECK 4 !3 17 > JMPZ ~16, ->19 11 18 > > RETURN <false> 13 19 > STRLEN ~17 !2 20 IS_SMALLER 0, ~17 21 > JMPZ ~18, ->30 14 22 > INIT_FCALL 'md5' 23 CONCAT ~19 !3, !2 24 SEND_VAL ~19 25 SEND_VAL <true> 26 DO_ICALL $20 27 ASSIGN !4, $20 15 28 ASSIGN !5, 16 29 > JMP ->33 17 30 > ASSIGN !4, !3 18 31 STRLEN ~24 !3 32 ASSIGN !5, ~24 22 33 > ASSIGN_OP 8 !0, '%00' 23 34 ASSIGN !6, '' 24 35 ASSIGN !7, 0 36 > JMP ->43 25 37 > FETCH_DIM_R ~29 !0, !7 38 MOD ~30 !7, !5 39 FETCH_DIM_R ~31 !4, ~30 40 BW_XOR ~32 ~29, ~31 41 ASSIGN_OP 8 !6, ~32 24 42 PRE_INC !7 43 > STRLEN ~35 !0 44 IS_SMALLER !7, ~35 45 > JMPNZ ~36, ->37 27 46 > ASSIGN !8, 0 28 47 ASSIGN !7, 0 48 > JMP ->58 29 49 > INIT_FCALL 'chr' 50 INIT_FCALL 'rand' 51 SEND_VAL 0 52 SEND_VAL 255 53 DO_ICALL $39 54 SEND_VAR $39 55 DO_ICALL $40 56 ASSIGN_OP 8 !6, $40 28 57 PRE_INC !7 58 > IS_SMALLER !7, !8 59 > JMPNZ ~43, ->49 31 60 > INIT_FCALL 'bin2hex' 61 SEND_VAR !6 62 DO_ICALL $44 63 > RETURN $44 32 64* > RETURN null End of function encode_password Function print_logon_form: Finding entry points Branch analysis from position: 0 1 jumps found. (Code = 62) Position 1 = -2 filename: /in/323kq function name: print_logon_form number of ops: 18 compiled vars: none line #* E I O op fetch ext return operands ------------------------------------------------------------------------------------- 36 0 E > ECHO '%3C%21doctype+html%3E%0A%3Chtml%3E%0A%3Chead%3E%3Ctitle%3EExample+Remote+Splash+Page%3C%2Ftitle%3E%3C%2Fhead%3E%0A%3Cbody%3E%0A%3Cform+method%3D%22post%22%3E%0A++%3Clabel%3EUser+Name%3A+%3Cinput+type%3D%22text%22+name%3D%22username%22%3E%3C%2Flabel%3E%3Cbr%2F%3E%0A++%3Clabel%3EPassword%3A+%3Cinput+type%3D%22text%22+name%3D%22password%22%3E%3C%2Flabel%3E%3Cbr%2F%3E%0A++%3Cinput+type%3D%22hidden%22+name%3D%22challenge%22+value%3D%22' 43 1 FETCH_R global ~0 '_GET' 2 FETCH_DIM_R ~1 ~0, 'challenge' 3 ECHO ~1 4 ECHO '%22%3E%0A++%3Cinput+type%3D%22hidden%22+name%3D%22uamip%22+value%3D%22' 44 5 FETCH_R global ~2 '_GET' 6 FETCH_DIM_R ~3 ~2, 'uamip' 7 ECHO ~3 8 ECHO '%22%3E%0A++%3Cinput+type%3D%22hidden%22+name%3D%22uamport%22+value%3D%22' 45 9 FETCH_R global ~4 '_GET' 10 FETCH_DIM_R ~5 ~4, 'uamport' 11 ECHO ~5 12 ECHO '%22%3E%0A++%3Cinput+type%3D%22hidden%22+name%3D%22userurl%22+value%3D%22' 46 13 FETCH_R global ~6 '_GET' 14 FETCH_DIM_R ~7 ~6, 'userurl' 15 ECHO ~7 16 ECHO '%22%3E%0A++%3Cinput+type%3D%22submit%22%3E%0A%3C%2Fform%3E%0A%3C%2Fbody%3E%0A%3C%2Fhtml%3E%0A' 52 17 > RETURN null End of function print_logon_form Function print_success: Finding entry points Branch analysis from position: 0 2 jumps found. (Code = 43) Position 1 = 6, Position 2 = 11 Branch analysis from position: 6 2 jumps found. (Code = 43) Position 1 = 15, Position 2 = 17 Branch analysis from position: 15 1 jumps found. (Code = 42) Position 1 = 18 Branch analysis from position: 18 1 jumps found. (Code = 62) Position 1 = -2 Branch analysis from position: 17 1 jumps found. (Code = 62) Position 1 = -2 Branch analysis from position: 11 filename: /in/323kq function name: print_success number of ops: 20 compiled vars: none line #* E I O op fetch ext return operands ------------------------------------------------------------------------------------- 55 0 E > INIT_FCALL 'session_start' 1 DO_ICALL 57 2 ECHO '%3C%21doctype+html%3E%0A%3Chtml%3E%0A%3Chead%3E%0A%3Ctitle%3EExample+Remote+Splash+Page%3C%2Ftitle%3E%0A' 62 3 FETCH_IS ~1 '_SESSION' 4 ISSET_ISEMPTY_DIM_OBJ 0 ~1, 'userurl' 5 > JMPZ ~2, ->11 63 6 > FETCH_R global ~3 '_SESSION' 7 FETCH_DIM_R ~4 ~3, 'userurl' 8 CONCAT ~5 '%3Cmeta+http-equiv%3D%22refresh%22+content%3D%223%3BURL%3D%27', ~4 9 CONCAT ~6 ~5, '%27%22%3E' 10 ECHO ~6 66 11 > ECHO '%3C%2Fhead%3E%0A%3Cbody%3E%0A' 69 12 FETCH_IS ~7 '_SESSION' 13 ISSET_ISEMPTY_DIM_OBJ 0 ~7, 'userurl' 14 > JMPZ ~8, ->17 70 15 > ECHO '%3Ch1%3EWelcome%21+You+will+be+redirected+to+your+destination+momentarily%3C%2Fh1%3E' 16 > JMP ->18 72 17 > ECHO '%3Ch1%3EWelcome%21%3C%2Fh1%3E' 75 18 > ECHO '%3C%2Fbody%3E%0A%3C%2Fhtml%3E%0A' 78 19 > RETURN null End of function print_success Function print_failed: Finding entry points Branch analysis from position: 0 1 jumps found. (Code = 62) Position 1 = -2 filename: /in/323kq function name: print_failed number of ops: 2 compiled vars: none line #* E I O op fetch ext return operands ------------------------------------------------------------------------------------- 82 0 E > ECHO '%3C%21doctype+html%3E%0A%3Chtml%3E%0A%3Chead%3E%3Ctitle%3EExample+Remote+Splash+Page%3C%2Ftitle%3E%3C%2Fhead%3E%0A%3Cbody%3E%3Ch1%3EAuthentication+Failed%3C%2Fh1%3E%3C%2Fbody%3E%0A%3C%2Fhtml%3E%0A' 88 1 > RETURN null End of function print_failed Function print_logoff: Finding entry points Branch analysis from position: 0 1 jumps found. (Code = 62) Position 1 = -2 filename: /in/323kq function name: print_logoff number of ops: 2 compiled vars: none line #* E I O op fetch ext return operands ------------------------------------------------------------------------------------- 92 0 E > ECHO '%3C%21doctype+html%3E%0A%3Chtml%3E%0A%3Chead%3E%3Ctitle%3EExample+Remote+Splash+Page%3C%2Ftitle%3E%3C%2Fhead%3E%0A%3Cbody%3E%3Ch1%3EGoodBye%3C%2Fh1%3E%3C%2Fbody%3E%0A%3C%2Fhtml%3E%0A' 98 1 > RETURN null End of function print_logoff
Generated using Vulcan Logic Dumper, using php 8.0.0