3v4l.org

run code in 300+ PHP versions simultaneously
<? $defaultdata = array( "showpassword"=>"no", "bgcolor"=>"#ffffff"); function xor_encrypt($in) { //$key = '<censored>'; $key = 'U82q5TCMMQ9xuFoI3dYX61s7OZD9JKoK'; $text = $in; $outText = ''; // Iterate through each character for($i=0;$i<strlen($text);$i++) { $outText .= $text[$i] ^ $key[$i % strlen($key)]; } return $outText; } function xor_with_key($in, $key) { //$key = '<censored>'; //$key = 'U82q5TCMMQ9xuFoI3dYX61s7OZD9JKoK'; $text = $in; $outText = ''; // Iterate through each character for($i=0;$i<strlen($text);$i++) { $outText .= $text[$i] ^ $key[$i % strlen($key)]; } return $outText; } function loadData($def) { global $_COOKIE; $mydata = $def; if(array_key_exists("data", $_COOKIE)) { $tempdata = json_decode(xor_encrypt(base64_decode($_COOKIE["data"])), true); if(is_array($tempdata) && array_key_exists("showpassword", $tempdata) && array_key_exists("bgcolor", $tempdata)) { if (preg_match('/^#(?:[a-f\d]{6})$/i', $tempdata['bgcolor'])) { $mydata['showpassword'] = $tempdata['showpassword']; $mydata['bgcolor'] = $tempdata['bgcolor']; } } } return $mydata; } function saveData($d) { setcookie("data", base64_encode(xor_encrypt(json_encode($d)))); } // Taken from saveData() function encrypt($d){ return base64_encode(xor_encrypt(json_encode($d))); } function encrypt_step1($d){ return json_encode($d); } function encrypt_step2($d){ return xor_encrypt(json_encode($d)); } //Taken from loadData() function decrypt($d){ return json_decode(xor_encrypt(base64_decode($d)), true); } function decrypt_step1($d){ return base64_decode($d); } function decrypt_step2($d){ return xor_encrypt(base64_decode($d)); } /* $data = loadData($defaultdata); if(array_key_exists("bgcolor",$_REQUEST)) { if (preg_match('/^#(?:[a-f\d]{6})$/i', $_REQUEST['bgcolor'])) { $data['bgcolor'] = $_REQUEST['bgcolor']; } } saveData($data); */ /* */ // Show password = NO // bgcolor = #ffffff // XORED with some key $data = "ClVLIh4ASCsCBE8lAxMacFMZV2hdVVotEhhUJQNVAmhSEV4sFxFeaAw%3D"; $data = urldecode($data); echo "\n ENCRYPTED ASS COOKIE: \n"; var_dump($data); $xor_encrypted_json_orig = decrypt_step1($data); $json_orig = encrypt_step1(array( "showpassword"=>"no", "bgcolor"=>"#ffffff")); $xored_to_get_the_key = xor_with_key($json_orig, $xor_encrypted_json_orig ); echo "\nxor_encrypted_json_orig\n"; var_dump ($xor_encrypted_json_orig); echo "\njson_orig\n"; var_dump ($json_orig); echo "\nxored_to_get_the_key\n"; var_dump ($xored_to_get_the_key); echo "\n"; // echo "\nDecrypt Step 1 -> base64_decode(): \n"; // echo decrypt_step1($data); // echo "\nDecrypt Step 2 -> xor(): \n"; // echo decrypt_step2($data); // echo "\nDecrypt Step FINAL -> json_decode() \n"; // var_dump(decrypt($data)); // echo "\nJust creating the cookie from scratch:\n"; // $injected_cookie = array( "showpassword"=>"yes", "bgcolor"=>"#ffffff"); // var_dump($injected_cookie); // echo "\nIn encyrpted form!\n"; // $encrypted_good = encrypt($injected_cookie); // var_dump($encrypted_good); ?> <? // THIS RIGH HERE IS THE KEY. YOU NEED TO MAKE SHOW PASSWORD = YES //if($data["showpassword"] == "yes") { // print "The password for natas12 is <censored><br>"; //} ?>
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/rble4Y
function name:  (null)
number of ops:  38
compiled vars:  !0 = $defaultdata, !1 = $data, !2 = $xor_encrypted_json_orig, !3 = $json_orig, !4 = $xored_to_get_the_key
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    3     0  E >   ASSIGN                                                   !0, <array>
   94     1        ASSIGN                                                   !1, 'ClVLIh4ASCsCBE8lAxMacFMZV2hdVVotEhhUJQNVAmhSEV4sFxFeaAw%253D'
   95     2        INIT_FCALL                                               'urldecode'
          3        SEND_VAR                                                 !1
          4        DO_ICALL                                         $7      
          5        ASSIGN                                                   !1, $7
   97     6        ECHO                                                     '%0A+ENCRYPTED+ASS+COOKIE%3A+%0A'
   98     7        INIT_FCALL                                               'var_dump'
          8        SEND_VAR                                                 !1
          9        DO_ICALL                                                 
  101    10        INIT_FCALL                                               'decrypt_step1'
         11        SEND_VAR                                                 !1
         12        DO_FCALL                                      0  $10     
         13        ASSIGN                                                   !2, $10
  102    14        INIT_FCALL                                               'encrypt_step1'
         15        SEND_VAL                                                 <array>
         16        DO_FCALL                                      0  $12     
         17        ASSIGN                                                   !3, $12
  103    18        INIT_FCALL                                               'xor_with_key'
         19        SEND_VAR                                                 !3
         20        SEND_VAR                                                 !2
         21        DO_FCALL                                      0  $14     
         22        ASSIGN                                                   !4, $14
  107    23        ECHO                                                     '%0Axor_encrypted_json_orig%0A'
  108    24        INIT_FCALL                                               'var_dump'
         25        SEND_VAR                                                 !2
         26        DO_ICALL                                                 
  110    27        ECHO                                                     '%0Ajson_orig%0A'
  111    28        INIT_FCALL                                               'var_dump'
         29        SEND_VAR                                                 !3
         30        DO_ICALL                                                 
  113    31        ECHO                                                     '%0Axored_to_get_the_key%0A'
  114    32        INIT_FCALL                                               'var_dump'
         33        SEND_VAR                                                 !4
         34        DO_ICALL                                                 
  117    35        ECHO                                                     '%0A'
  136    36        ECHO                                                     '%0A'
  144    37      > RETURN                                                   1

Function xor_encrypt:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 42) Position 1 = 13
Branch analysis from position: 13
2 jumps found. (Code = 44) Position 1 = 16, Position 2 = 6
Branch analysis from position: 16
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 6
2 jumps found. (Code = 44) Position 1 = 16, Position 2 = 6
Branch analysis from position: 16
Branch analysis from position: 6
filename:       /in/rble4Y
function name:  xor_encrypt
number of ops:  18
compiled vars:  !0 = $in, !1 = $key, !2 = $text, !3 = $outText, !4 = $i
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    5     0  E >   RECV                                             !0      
    7     1        ASSIGN                                                   !1, 'U82q5TCMMQ9xuFoI3dYX61s7OZD9JKoK'
    8     2        ASSIGN                                                   !2, !0
    9     3        ASSIGN                                                   !3, ''
   12     4        ASSIGN                                                   !4, 0
          5      > JMP                                                      ->13
   13     6    >   FETCH_DIM_R                                      ~9      !2, !4
          7        STRLEN                                           ~10     !1
          8        MOD                                              ~11     !4, ~10
          9        FETCH_DIM_R                                      ~12     !1, ~11
         10        BW_XOR                                           ~13     ~9, ~12
         11        ASSIGN_OP                                     8          !3, ~13
   12    12        PRE_INC                                                  !4
         13    >   STRLEN                                           ~16     !2
         14        IS_SMALLER                                               !4, ~16
         15      > JMPNZ                                                    ~17, ->6
   16    16    > > RETURN                                                   !3
   17    17*     > RETURN                                                   null

End of function xor_encrypt

Function xor_with_key:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 42) Position 1 = 13
Branch analysis from position: 13
2 jumps found. (Code = 44) Position 1 = 16, Position 2 = 6
Branch analysis from position: 16
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 6
2 jumps found. (Code = 44) Position 1 = 16, Position 2 = 6
Branch analysis from position: 16
Branch analysis from position: 6
filename:       /in/rble4Y
function name:  xor_with_key
number of ops:  18
compiled vars:  !0 = $in, !1 = $key, !2 = $text, !3 = $outText, !4 = $i
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   19     0  E >   RECV                                             !0      
          1        RECV                                             !1      
   22     2        ASSIGN                                                   !2, !0
   23     3        ASSIGN                                                   !3, ''
   26     4        ASSIGN                                                   !4, 0
          5      > JMP                                                      ->13
   27     6    >   FETCH_DIM_R                                      ~8      !2, !4
          7        STRLEN                                           ~9      !1
          8        MOD                                              ~10     !4, ~9
          9        FETCH_DIM_R                                      ~11     !1, ~10
         10        BW_XOR                                           ~12     ~8, ~11
         11        ASSIGN_OP                                     8          !3, ~12
   26    12        PRE_INC                                                  !4
         13    >   STRLEN                                           ~15     !2
         14        IS_SMALLER                                               !4, ~15
         15      > JMPNZ                                                    ~16, ->6
   30    16    > > RETURN                                                   !3
   31    17*     > RETURN                                                   null

End of function xor_with_key

Function loaddata:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 8, Position 2 = 41
Branch analysis from position: 8
2 jumps found. (Code = 46) Position 1 = 23, Position 2 = 25
Branch analysis from position: 23
2 jumps found. (Code = 46) Position 1 = 26, Position 2 = 28
Branch analysis from position: 26
2 jumps found. (Code = 43) Position 1 = 29, Position 2 = 41
Branch analysis from position: 29
2 jumps found. (Code = 43) Position 1 = 35, Position 2 = 41
Branch analysis from position: 35
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 41
Branch analysis from position: 41
Branch analysis from position: 28
Branch analysis from position: 25
Branch analysis from position: 41
filename:       /in/rble4Y
function name:  loadData
number of ops:  43
compiled vars:  !0 = $def, !1 = $mydata, !2 = $tempdata
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   33     0  E >   RECV                                             !0      
   34     1        FETCH_W                      global lock         $3      '_COOKIE'
          2        FETCH_W                      global              $4      '_COOKIE'
          3        ASSIGN_REF                                               $4, $3
   35     4        ASSIGN                                                   !1, !0
   36     5        FETCH_R                      global              ~6      '_COOKIE'
          6        ARRAY_KEY_EXISTS                                         'data', ~6
          7      > JMPZ                                                     ~7, ->41
   37     8    >   INIT_FCALL                                               'json_decode'
          9        INIT_FCALL                                               'xor_encrypt'
         10        INIT_FCALL                                               'base64_decode'
         11        FETCH_R                      global              ~8      '_COOKIE'
         12        FETCH_DIM_R                                      ~9      ~8, 'data'
         13        SEND_VAL                                                 ~9
         14        DO_ICALL                                         $10     
         15        SEND_VAR                                                 $10
         16        DO_FCALL                                      0  $11     
         17        SEND_VAR                                                 $11
         18        SEND_VAL                                                 <true>
         19        DO_ICALL                                         $12     
         20        ASSIGN                                                   !2, $12
   38    21        TYPE_CHECK                                  128  ~14     !2
         22      > JMPZ_EX                                          ~14     ~14, ->25
         23    >   ARRAY_KEY_EXISTS                                 ~15     'showpassword', !2
         24        BOOL                                             ~14     ~15
         25    > > JMPZ_EX                                          ~14     ~14, ->28
         26    >   ARRAY_KEY_EXISTS                                 ~16     'bgcolor', !2
         27        BOOL                                             ~14     ~16
         28    > > JMPZ                                                     ~14, ->41
   39    29    >   INIT_FCALL                                               'preg_match'
         30        SEND_VAL                                                 '%2F%5E%23%28%3F%3A%5Ba-f%5Cd%5D%7B6%7D%29%24%2Fi'
         31        FETCH_DIM_R                                      ~17     !2, 'bgcolor'
         32        SEND_VAL                                                 ~17
         33        DO_ICALL                                         $18     
         34      > JMPZ                                                     $18, ->41
   40    35    >   FETCH_DIM_R                                      ~20     !2, 'showpassword'
         36        ASSIGN_DIM                                               !1, 'showpassword'
         37        OP_DATA                                                  ~20
   41    38        FETCH_DIM_R                                      ~22     !2, 'bgcolor'
         39        ASSIGN_DIM                                               !1, 'bgcolor'
         40        OP_DATA                                                  ~22
   45    41    > > RETURN                                                   !1
   46    42*     > RETURN                                                   null

End of function loaddata

Function savedata:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/rble4Y
function name:  saveData
number of ops:  15
compiled vars:  !0 = $d
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   48     0  E >   RECV                                             !0      
   49     1        INIT_FCALL                                               'setcookie'
          2        SEND_VAL                                                 'data'
          3        INIT_FCALL                                               'base64_encode'
          4        INIT_FCALL                                               'xor_encrypt'
          5        INIT_FCALL                                               'json_encode'
          6        SEND_VAR                                                 !0
          7        DO_ICALL                                         $1      
          8        SEND_VAR                                                 $1
          9        DO_FCALL                                      0  $2      
         10        SEND_VAR                                                 $2
         11        DO_ICALL                                         $3      
         12        SEND_VAR                                                 $3
         13        DO_ICALL                                                 
   50    14      > RETURN                                                   null

End of function savedata

Function encrypt:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/rble4Y
function name:  encrypt
number of ops:  12
compiled vars:  !0 = $d
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   52     0  E >   RECV                                             !0      
   53     1        INIT_FCALL                                               'base64_encode'
          2        INIT_FCALL                                               'xor_encrypt'
          3        INIT_FCALL                                               'json_encode'
          4        SEND_VAR                                                 !0
          5        DO_ICALL                                         $1      
          6        SEND_VAR                                                 $1
          7        DO_FCALL                                      0  $2      
          8        SEND_VAR                                                 $2
          9        DO_ICALL                                         $3      
         10      > RETURN                                                   $3
   54    11*     > RETURN                                                   null

End of function encrypt

Function encrypt_step1:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/rble4Y
function name:  encrypt_step1
number of ops:  6
compiled vars:  !0 = $d
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   56     0  E >   RECV                                             !0      
   57     1        INIT_FCALL                                               'json_encode'
          2        SEND_VAR                                                 !0
          3        DO_ICALL                                         $1      
          4      > RETURN                                                   $1
   58     5*     > RETURN                                                   null

End of function encrypt_step1

Function encrypt_step2:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/rble4Y
function name:  encrypt_step2
number of ops:  9
compiled vars:  !0 = $d
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   59     0  E >   RECV                                             !0      
   60     1        INIT_FCALL                                               'xor_encrypt'
          2        INIT_FCALL                                               'json_encode'
          3        SEND_VAR                                                 !0
          4        DO_ICALL                                         $1      
          5        SEND_VAR                                                 $1
          6        DO_FCALL                                      0  $2      
          7      > RETURN                                                   $2
   61     8*     > RETURN                                                   null

End of function encrypt_step2

Function decrypt:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/rble4Y
function name:  decrypt
number of ops:  13
compiled vars:  !0 = $d
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   64     0  E >   RECV                                             !0      
   65     1        INIT_FCALL                                               'json_decode'
          2        INIT_FCALL                                               'xor_encrypt'
          3        INIT_FCALL                                               'base64_decode'
          4        SEND_VAR                                                 !0
          5        DO_ICALL                                         $1      
          6        SEND_VAR                                                 $1
          7        DO_FCALL                                      0  $2      
          8        SEND_VAR                                                 $2
          9        SEND_VAL                                                 <true>
         10        DO_ICALL                                         $3      
         11      > RETURN                                                   $3
   66    12*     > RETURN                                                   null

End of function decrypt

Function decrypt_step1:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/rble4Y
function name:  decrypt_step1
number of ops:  6
compiled vars:  !0 = $d
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   68     0  E >   RECV                                             !0      
   69     1        INIT_FCALL                                               'base64_decode'
          2        SEND_VAR                                                 !0
          3        DO_ICALL                                         $1      
          4      > RETURN                                                   $1
   70     5*     > RETURN                                                   null

End of function decrypt_step1

Function decrypt_step2:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/rble4Y
function name:  decrypt_step2
number of ops:  9
compiled vars:  !0 = $d
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   72     0  E >   RECV                                             !0      
   73     1        INIT_FCALL                                               'xor_encrypt'
          2        INIT_FCALL                                               'base64_decode'
          3        SEND_VAR                                                 !0
          4        DO_ICALL                                         $1      
          5        SEND_VAR                                                 $1
          6        DO_FCALL                                      0  $2      
          7      > RETURN                                                   $2
   74     8*     > RETURN                                                   null

End of function decrypt_step2

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
185.32 ms | 1419 KiB | 38 Q