Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 11, Position 2 = 13
Branch analysis from position: 11
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 13
filename: /in/d2gsq
function name: (null)
number of ops: 14
compiled vars: none
line #* E I O op fetch ext return operands
-------------------------------------------------------------------------------------
23 0 E > INIT_FCALL 'define'
1 SEND_VAL '__FLAG__'
2 SEND_VAL 'flag%7Bhidden_flag%7D'
3 DO_ICALL
24 4 INIT_FCALL 'decrypt'
5 FETCH_R global ~1 '_REQUEST'
6 FETCH_DIM_R ~2 ~1, 'pass'
7 SEND_VAL ~2
8 DO_FCALL 0 $3
9 IS_EQUAL $3, 'pwning_the_phpreverse%21'
10 > JMPZ ~4, ->13
26 11 > FETCH_CONSTANT ~5 '__FLAG__'
12 FREE ~5
28 13 > > RETURN 1
Function decrypt:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 42) Position 1 = 30
Branch analysis from position: 30
2 jumps found. (Code = 44) Position 1 = 33, Position 2 = 29
Branch analysis from position: 33
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 29
2 jumps found. (Code = 44) Position 1 = 33, Position 2 = 29
Branch analysis from position: 33
Branch analysis from position: 29
filename: /in/d2gsq
function name: decrypt
number of ops: 34
compiled vars: !0 = $a, !1 = $tmp_1, !2 = $tmp_2, !3 = $tmp, !4 = $tmp_3, !5 = $tmp_5
line #* E I O op fetch ext return operands
-------------------------------------------------------------------------------------
2 0 E > RECV !0
4 1 INIT_FCALL 'strtolower'
2 INIT_FCALL 'strrev'
3 SEND_VAR !0
4 DO_ICALL $6
5 SEND_VAR $6
6 DO_ICALL $7
7 ASSIGN !1, $7
5 8 INIT_FCALL 'substr'
9 SEND_VAR !3
10 SEND_VAL 0
11 SEND_VAL 4
12 DO_ICALL $9
13 INIT_FCALL 'hexdec'
14 SEND_VAL 'BFF'
15 DO_ICALL $10
16 BW_XOR ~11 $9, $10
17 INIT_FCALL 'hexdec'
18 SEND_VAL 'D77D'
19 DO_ICALL $12
20 BW_XOR ~13 $12, ~11
21 ASSIGN !2, ~13
6 22 INIT_FCALL 'substr'
23 SEND_VAR !3
24 SEND_VAL 4
25 DO_ICALL $15
26 ASSIGN !4, $15
7 27 ASSIGN !5, 0
28 > JMP ->30
29 > PRE_INC !5
30 > STRLEN ~19 !4
31 IS_SMALLER !5, ~19
32 > JMPNZ ~20, ->29
11 33 > > RETURN null
End of function decrypt
Generated using Vulcan Logic Dumper, using php 8.0.0