3v4l.org

run code in 300+ PHP versions simultaneously
<?php $x[0] = "sys"."tem"; $x[0]("echo 1337 > $(pwd)../../../../tmp/loldongas"); if(file_exists(getcwd().'../../../../tmp/loldongas')){print 'gay';}
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 13, Position 2 = 14
Branch analysis from position: 13
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 14
filename:       /in/B1ZBA
function name:  (null)
number of ops:  15
compiled vars:  !0 = $x
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    1     0  E >   ASSIGN_DIM                                               !0, 0
          1        OP_DATA                                                  'system'
          2        FETCH_DIM_R                                      ~2      !0, 0
          3        INIT_DYNAMIC_CALL                                        ~2
          4        SEND_VAL_EX                                              'echo+1337+%3E+%24%28pwd%29..%2F..%2F..%2F..%2Ftmp%2Floldongas'
          5        DO_FCALL                                      0          
    2     6        INIT_FCALL                                               'file_exists'
          7        INIT_FCALL                                               'getcwd'
          8        DO_ICALL                                         $4      
          9        CONCAT                                           ~5      $4, '..%2F..%2F..%2F..%2Ftmp%2Floldongas'
         10        SEND_VAL                                                 ~5
         11        DO_ICALL                                         $6      
         12      > JMPZ                                                     $6, ->14
         13    >   ECHO                                                     'gay'
         14    > > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
144.64 ms | 1394 KiB | 17 Q