3v4l.org

run code in 300+ PHP versions simultaneously
<?php class foo { public function __wakeup() { echo 'exploited'; } } $userInput = serialize(new foo); echo $userInput; $serialisedStr = serialize([ $userInput, ]); unserialize($serialisedStr);
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/SNVN4
function name:  (null)
number of ops:  16
compiled vars:  !0 = $userInput, !1 = $serialisedStr
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   10     0  E >   INIT_FCALL                                               'serialize'
          1        NEW                                              $2      'foo'
          2        DO_FCALL                                      0          
          3        SEND_VAR                                                 $2
          4        DO_ICALL                                         $4      
          5        ASSIGN                                                   !0, $4
   11     6        ECHO                                                     !0
   13     7        INIT_FCALL                                               'serialize'
   14     8        INIT_ARRAY                                       ~6      !0
          9        SEND_VAL                                                 ~6
         10        DO_ICALL                                         $7      
   13    11        ASSIGN                                                   !1, $7
   16    12        INIT_FCALL                                               'unserialize'
         13        SEND_VAR                                                 !1
         14        DO_ICALL                                                 
         15      > RETURN                                                   1

Class foo:
Function __wakeup:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/SNVN4
function name:  __wakeup
number of ops:  2
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    5     0  E >   ECHO                                                     'exploited'
    6     1      > RETURN                                                   null

End of function __wakeup

End of class foo.

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
173.45 ms | 1395 KiB | 17 Q