3v4l.org

run code in 300+ PHP versions simultaneously
<?php $v1=0;$v2=0;$v3=0;$v4=0; $a=(array)json_decode('{"a1":"1337hurensohn_","a2":[["ctf"],"011111111111111111111111111111111111111ctf","ctf","ctf","ctf"]}'); if(is_array($a)){ is_numeric($a["a1"])?die("nope"):NULL; if($a["a1"]){ ($a["a1"]>1336)?$v1=1:NULL; } if(is_array($a["a2"])){ if(count($a["a2"])!==5 OR !is_array($a["a2"][0])) die("nope"); $pos = array_search("ctf", $a["a2"]); $pos===false?die("nope"):NULL; foreach($a["a2"] as $key=>$val){ $val==="ctf"?die("nope"):NULL; } $v2=1; } } $b = '1.23.4'; if(preg_match("/^([0-9]+\.?[0-9]+)+$/",$b)){ $b=json_decode($b); if($var = $b === NULL){ ($var===true)?$v3=1:NULL; } } $c=''; $d=''; if($c[1]){ if(!strcmp($c[1],$d) && $c[1]!==$d){ eregi("3|1|c",$d.$c[0])?die("nope"):NULL; strpos(($c[0].$d), "31c3")?$v4=1:NULL; } } if($v1 && $v2 && $v3 && $v4){ include "flag.php"; echo $flag; } ?>
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 11, Position 2 = 72
Branch analysis from position: 11
2 jumps found. (Code = 43) Position 1 = 16, Position 2 = 19
Branch analysis from position: 16
1 jumps found. (Code = 79) Position 1 = -2
Branch analysis from position: 19
2 jumps found. (Code = 43) Position 1 = 23, Position 2 = 31
Branch analysis from position: 23
2 jumps found. (Code = 43) Position 1 = 26, Position 2 = 29
Branch analysis from position: 26
1 jumps found. (Code = 42) Position 1 = 30
Branch analysis from position: 30
2 jumps found. (Code = 43) Position 1 = 34, Position 2 = 72
Branch analysis from position: 34
2 jumps found. (Code = 47) Position 1 = 38, Position 2 = 43
Branch analysis from position: 38
2 jumps found. (Code = 43) Position 1 = 44, Position 2 = 45
Branch analysis from position: 44
1 jumps found. (Code = 79) Position 1 = -2
Branch analysis from position: 45
2 jumps found. (Code = 43) Position 1 = 53, Position 2 = 56
Branch analysis from position: 53
1 jumps found. (Code = 79) Position 1 = -2
Branch analysis from position: 56
2 jumps found. (Code = 77) Position 1 = 60, Position 2 = 70
Branch analysis from position: 60
2 jumps found. (Code = 78) Position 1 = 61, Position 2 = 70
Branch analysis from position: 61
2 jumps found. (Code = 43) Position 1 = 64, Position 2 = 67
Branch analysis from position: 64
1 jumps found. (Code = 79) Position 1 = -2
Branch analysis from position: 67
1 jumps found. (Code = 42) Position 1 = 60
Branch analysis from position: 60
Branch analysis from position: 70
2 jumps found. (Code = 43) Position 1 = 78, Position 2 = 92
Branch analysis from position: 78
2 jumps found. (Code = 43) Position 1 = 85, Position 2 = 92
Branch analysis from position: 85
2 jumps found. (Code = 43) Position 1 = 87, Position 2 = 90
Branch analysis from position: 87
1 jumps found. (Code = 42) Position 1 = 91
Branch analysis from position: 91
2 jumps found. (Code = 43) Position 1 = 96, Position 2 = 131
Branch analysis from position: 96
2 jumps found. (Code = 46) Position 1 = 103, Position 2 = 106
Branch analysis from position: 103
2 jumps found. (Code = 43) Position 1 = 107, Position 2 = 131
Branch analysis from position: 107
2 jumps found. (Code = 43) Position 1 = 114, Position 2 = 117
Branch analysis from position: 114
1 jumps found. (Code = 79) Position 1 = -2
Branch analysis from position: 117
2 jumps found. (Code = 43) Position 1 = 126, Position 2 = 129
Branch analysis from position: 126
1 jumps found. (Code = 42) Position 1 = 130
Branch analysis from position: 130
2 jumps found. (Code = 46) Position 1 = 132, Position 2 = 133
Branch analysis from position: 132
2 jumps found. (Code = 46) Position 1 = 134, Position 2 = 135
Branch analysis from position: 134
2 jumps found. (Code = 46) Position 1 = 136, Position 2 = 137
Branch analysis from position: 136
2 jumps found. (Code = 43) Position 1 = 138, Position 2 = 140
Branch analysis from position: 138
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 140
Branch analysis from position: 137
Branch analysis from position: 135
Branch analysis from position: 133
Branch analysis from position: 129
2 jumps found. (Code = 46) Position 1 = 132, Position 2 = 133
Branch analysis from position: 132
Branch analysis from position: 133
Branch analysis from position: 131
Branch analysis from position: 106
Branch analysis from position: 131
Branch analysis from position: 90
2 jumps found. (Code = 43) Position 1 = 96, Position 2 = 131
Branch analysis from position: 96
Branch analysis from position: 131
Branch analysis from position: 92
Branch analysis from position: 92
Branch analysis from position: 70
Branch analysis from position: 43
Branch analysis from position: 72
Branch analysis from position: 29
2 jumps found. (Code = 43) Position 1 = 34, Position 2 = 72
Branch analysis from position: 34
Branch analysis from position: 72
Branch analysis from position: 31
Branch analysis from position: 72
filename:       /in/VA0jD
function name:  (null)
number of ops:  141
compiled vars:  !0 = $v1, !1 = $v2, !2 = $v3, !3 = $v4, !4 = $a, !5 = $pos, !6 = $val, !7 = $key, !8 = $b, !9 = $var, !10 = $c, !11 = $d, !12 = $flag
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    2     0  E >   ASSIGN                                                   !0, 0
          1        ASSIGN                                                   !1, 0
          2        ASSIGN                                                   !2, 0
          3        ASSIGN                                                   !3, 0
    3     4        INIT_FCALL                                               'json_decode'
          5        SEND_VAL                                                 '%7B%22a1%22%3A%221337hurensohn_%22%2C%22a2%22%3A%5B%5B%22ctf%22%5D%2C%22011111111111111111111111111111111111111ctf%22%2C%22ctf%22%2C%22ctf%22%2C%22ctf%22%5D%7D'
          6        DO_ICALL                                         $17     
          7        CAST                                          7  ~18     $17
          8        ASSIGN                                                   !4, ~18
    4     9        TYPE_CHECK                                  128          !4
         10      > JMPZ                                                     ~20, ->72
    5    11    >   INIT_FCALL                                               'is_numeric'
         12        FETCH_DIM_R                                      ~21     !4, 'a1'
         13        SEND_VAL                                                 ~21
         14        DO_ICALL                                         $22     
         15      > JMPZ                                                     $22, ->19
         16    > > EXIT                                                     'nope'
         17*       QM_ASSIGN                                        ~23     <true>
         18*       JMP                                                      ->20
         19    >   QM_ASSIGN                                        ~23     null
         20        FREE                                                     ~23
    6    21        FETCH_DIM_R                                      ~24     !4, 'a1'
         22      > JMPZ                                                     ~24, ->31
    7    23    >   FETCH_DIM_R                                      ~25     !4, 'a1'
         24        IS_SMALLER                                               1336, ~25
         25      > JMPZ                                                     ~26, ->29
         26    >   ASSIGN                                           ~27     !0, 1
         27        QM_ASSIGN                                        ~28     ~27
         28      > JMP                                                      ->30
         29    >   QM_ASSIGN                                        ~28     null
         30    >   FREE                                                     ~28
    9    31    >   FETCH_DIM_R                                      ~29     !4, 'a2'
         32        TYPE_CHECK                                  128          ~29
         33      > JMPZ                                                     ~30, ->72
   10    34    >   FETCH_DIM_R                                      ~31     !4, 'a2'
         35        COUNT                                            ~32     ~31
         36        IS_NOT_IDENTICAL                                 ~33     ~32, 5
         37      > JMPNZ_EX                                         ~33     ~33, ->43
         38    >   FETCH_DIM_R                                      ~34     !4, 'a2'
         39        FETCH_DIM_R                                      ~35     ~34, 0
         40        TYPE_CHECK                                  128  ~36     ~35
         41        BOOL_NOT                                         ~37     ~36
         42        BOOL                                             ~33     ~37
         43    > > JMPZ                                                     ~33, ->45
         44    > > EXIT                                                     'nope'
   11    45    >   INIT_FCALL                                               'array_search'
         46        SEND_VAL                                                 'ctf'
         47        FETCH_DIM_R                                      ~38     !4, 'a2'
         48        SEND_VAL                                                 ~38
         49        DO_ICALL                                         $39     
         50        ASSIGN                                                   !5, $39
   12    51        TYPE_CHECK                                    4          !5
         52      > JMPZ                                                     ~41, ->56
         53    > > EXIT                                                     'nope'
         54*       QM_ASSIGN                                        ~42     <true>
         55*       JMP                                                      ->57
         56    >   QM_ASSIGN                                        ~42     null
         57        FREE                                                     ~42
   13    58        FETCH_DIM_R                                      ~43     !4, 'a2'
         59      > FE_RESET_R                                       $44     ~43, ->70
         60    > > FE_FETCH_R                                       ~45     $44, !6, ->70
         61    >   ASSIGN                                                   !7, ~45
   14    62        IS_IDENTICAL                                             !6, 'ctf'
         63      > JMPZ                                                     ~47, ->67
         64    > > EXIT                                                     'nope'
         65*       QM_ASSIGN                                        ~48     <true>
         66*       JMP                                                      ->68
         67    >   QM_ASSIGN                                        ~48     null
         68        FREE                                                     ~48
   13    69      > JMP                                                      ->60
         70    >   FE_FREE                                                  $44
   16    71        ASSIGN                                                   !1, 1
   19    72    >   ASSIGN                                                   !8, '1.23.4'
   20    73        INIT_FCALL                                               'preg_match'
         74        SEND_VAL                                                 '%2F%5E%28%5B0-9%5D%2B%5C.%3F%5B0-9%5D%2B%29%2B%24%2F'
         75        SEND_VAR                                                 !8
         76        DO_ICALL                                         $51     
         77      > JMPZ                                                     $51, ->92
   21    78    >   INIT_FCALL                                               'json_decode'
         79        SEND_VAR                                                 !8
         80        DO_ICALL                                         $52     
         81        ASSIGN                                                   !8, $52
   22    82        TYPE_CHECK                                    2  ~54     !8
         83        ASSIGN                                           ~55     !9, ~54
         84      > JMPZ                                                     ~55, ->92
   23    85    >   TYPE_CHECK                                    8          !9
         86      > JMPZ                                                     ~56, ->90
         87    >   ASSIGN                                           ~57     !2, 1
         88        QM_ASSIGN                                        ~58     ~57
         89      > JMP                                                      ->91
         90    >   QM_ASSIGN                                        ~58     null
         91    >   FREE                                                     ~58
   26    92    >   ASSIGN                                                   !10, ''
   27    93        ASSIGN                                                   !11, ''
   28    94        FETCH_DIM_R                                      ~61     !10, 1
         95      > JMPZ                                                     ~61, ->131
   29    96    >   INIT_FCALL                                               'strcmp'
         97        FETCH_DIM_R                                      ~62     !10, 1
         98        SEND_VAL                                                 ~62
         99        SEND_VAR                                                 !11
        100        DO_ICALL                                         $63     
        101        BOOL_NOT                                         ~64     $63
        102      > JMPZ_EX                                          ~64     ~64, ->106
        103    >   FETCH_DIM_R                                      ~65     !10, 1
        104        IS_NOT_IDENTICAL                                 ~66     !11, ~65
        105        BOOL                                             ~64     ~66
        106    > > JMPZ                                                     ~64, ->131
   30   107    >   INIT_FCALL_BY_NAME                                       'eregi'
        108        SEND_VAL_EX                                              '3%7C1%7Cc'
        109        FETCH_DIM_R                                      ~67     !10, 0
        110        CONCAT                                           ~68     !11, ~67
        111        SEND_VAL_EX                                              ~68
        112        DO_FCALL                                      0  $69     
        113      > JMPZ                                                     $69, ->117
        114    > > EXIT                                                     'nope'
        115*       QM_ASSIGN                                        ~70     <true>
        116*       JMP                                                      ->118
        117    >   QM_ASSIGN                                        ~70     null
        118        FREE                                                     ~70
   31   119        INIT_FCALL                                               'strpos'
        120        FETCH_DIM_R                                      ~71     !10, 0
        121        CONCAT                                           ~72     ~71, !11
        122        SEND_VAL                                                 ~72
        123        SEND_VAL                                                 '31c3'
        124        DO_ICALL                                         $73     
        125      > JMPZ                                                     $73, ->129
        126    >   ASSIGN                                           ~74     !3, 1
        127        QM_ASSIGN                                        ~75     ~74
        128      > JMP                                                      ->130
        129    >   QM_ASSIGN                                        ~75     null
        130    >   FREE                                                     ~75
   34   131    > > JMPZ_EX                                          ~76     !0, ->133
        132    >   BOOL                                             ~76     !1
        133    > > JMPZ_EX                                          ~76     ~76, ->135
        134    >   BOOL                                             ~76     !2
        135    > > JMPZ_EX                                          ~76     ~76, ->137
        136    >   BOOL                                             ~76     !3
        137    > > JMPZ                                                     ~76, ->140
   35   138    >   INCLUDE_OR_EVAL                                          'flag.php', INCLUDE
   36   139        ECHO                                                     !12
   38   140    > > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
159.19 ms | 1400 KiB | 25 Q