3v4l.org

run code in 300+ PHP versions simultaneously
<?php class FileDumper { private $filename; public function __construct($filename) { $this->filename = $filename; } public function dump() { file_put_contents($this->filename); } // // Below is basically what Macroable does // private $macros = []; public function macro($name, $callable) { $this->macros[$name] = $callable; } public function __call($name, $arguments) { return call_user_func_array($this->macros[$name], $arguments); } } $exampleFileDumper = new FileDumper('/foo/bar.txt'); echo serialize($exampleFileDumper); // The plain, unedited FileDumper object // This is the one we tampered with $serialized = 'O:10:"FileDumper":2:{s:20:"FileDumperfilename";s:11:"/etc/passwd";s:18:"FileDumpermacros";a:1:{s:4:"open";a:2:{i:0;r:1;i:1;s:4:"dump";}}}'; /* Neatly formatted with explanations: O:10:"FileDumper":2:{ # instance of FileDumper class with 2 properties s:20:"FileDumperfilename"; # property "filename" on "FileDumper" s:11:"/etc/passwd"; # altered to "/etc/passwd" - note the different length s:18:"FileDumpermacros"; # property "macros" on "FileDumper" - this was empty before, but we added something to it a:1:{ # it's an array with one element s:4:"open"; # under the key "open": a:2:{ # an array with 2 elements i:0; # under key 0: r:1; # a reference to the object itself (essentially just $this) i:1; # and under key 1: s:4:"dump"; # the string "dump" } } } */ $modifiedDumper = unserialize($serialized); $modifiedDumper->open();
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/33cmF
function name:  (null)
number of ops:  16
compiled vars:  !0 = $exampleFileDumper, !1 = $serialized, !2 = $modifiedDumper
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   29     0  E >   NEW                                              $3      'FileDumper'
          1        SEND_VAL_EX                                              '%2Ffoo%2Fbar.txt'
          2        DO_FCALL                                      0          
          3        ASSIGN                                                   !0, $3
   30     4        INIT_FCALL                                               'serialize'
          5        SEND_VAR                                                 !0
          6        DO_ICALL                                         $6      
          7        ECHO                                                     $6
   33     8        ASSIGN                                                   !1, 'O%3A10%3A%22FileDumper%22%3A2%3A%7Bs%3A20%3A%22FileDumperfilename%22%3Bs%3A11%3A%22%2Fetc%2Fpasswd%22%3Bs%3A18%3A%22FileDumpermacros%22%3Ba%3A1%3A%7Bs%3A4%3A%22open%22%3Ba%3A2%3A%7Bi%3A0%3Br%3A1%3Bi%3A1%3Bs%3A4%3A%22dump%22%3B%7D%7D%7D'
   55     9        INIT_FCALL                                               'unserialize'
         10        SEND_VAR                                                 !1
         11        DO_ICALL                                         $8      
         12        ASSIGN                                                   !2, $8
   56    13        INIT_METHOD_CALL                                         !2, 'open'
         14        DO_FCALL                                      0          
         15      > RETURN                                                   1

Class FileDumper:
Function __construct:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/33cmF
function name:  __construct
number of ops:  4
compiled vars:  !0 = $filename
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    6     0  E >   RECV                                             !0      
    7     1        ASSIGN_OBJ                                               'filename'
          2        OP_DATA                                                  !0
    8     3      > RETURN                                                   null

End of function __construct

Function dump:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/33cmF
function name:  dump
number of ops:  5
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   11     0  E >   INIT_FCALL                                               'file_put_contents'
          1        FETCH_OBJ_R                                      ~0      'filename'
          2        SEND_VAL                                                 ~0
          3        DO_ICALL                                                 
   12     4      > RETURN                                                   null

End of function dump

Function macro:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/33cmF
function name:  macro
number of ops:  6
compiled vars:  !0 = $name, !1 = $callable
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   20     0  E >   RECV                                             !0      
          1        RECV                                             !1      
   21     2        FETCH_OBJ_W                                      $2      'macros'
          3        ASSIGN_DIM                                               $2, !0
          4        OP_DATA                                                  !1
   22     5      > RETURN                                                   null

End of function macro

Function __call:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/33cmF
function name:  __call
number of ops:  10
compiled vars:  !0 = $name, !1 = $arguments
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   24     0  E >   RECV                                             !0      
          1        RECV                                             !1      
   25     2        FETCH_OBJ_R                                      ~2      'macros'
          3        FETCH_DIM_R                                      ~3      ~2, !0
          4        INIT_USER_CALL                                0          'call_user_func_array', ~3
          5        SEND_ARRAY                                               !1
          6        CHECK_UNDEF_ARGS                                         
          7        DO_FCALL                                      0  $4      
          8      > RETURN                                                   $4
   26     9*     > RETURN                                                   null

End of function __call

End of class FileDumper.

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
173.67 ms | 1392 KiB | 19 Q