字符串结构
struct _zend_string {
zend_refcounted_h gc; //引用计数
zend_ulong h; //哈希值，只有当字符串被作为数组索引时才计算该值
size_t len; //字符串长度，避免重复计算同时保证字符串操作的二进制安全
char val[1]; //柔性字符数组，保存实际的字符串
}
typedef struct _zend_refcounted_h {
uint32_t refcount; //引用计数的值
union {
struct {
ZEND_ENDIAN_LOHI_3(
zend_uchar type, //数据类型，同zval.u1.v.type
zend_uchar flags, //
uint16_t gc_info
)
} v;
uint32_t type_info;
} u;
} zend_refcounted_h;
gdb调试php时在execute_ex函数出下断点，第二个execute_ex函数开始执行php代码，或者在代码中加入echo语句，在ZEND_ECHO_SPEC_CV_HANDLER/ZEND_ECHO_SPEC_CONST_HANDLER函数下断点。全局变量等信息保存在executor_globals中executor_globals.symbol_table可以是一个保存了全局变量的数组。
字符串的写时分离
常量字符串
常量字符串是指在编译阶段已知的字符串，如给定的字符串，变量名，标识符，保留字等，对于$a="123";，'a'和'hello'都属于常量字符串，在编译阶段会被保存在一个编译变量表中，编译变量表不会在符号表的生命周期内重新分配，也不会被回收，因此常量字符串不需要进行引用计数。常量字符串引用计数refcount=0。对于php-fpm模式运行的php，常量字符串只会在该进程结束后被销毁（如果开启了opcache，那么字符串储存在共享内存中不会被销毁）。
临时字符串
在程序运行时才能得到的字符串，如函数的返回值。临时字符串会进行引用计数，当refcount=0或进行结束时会被销毁。
字符串标识符
字符串结构体zend_string内的引用计数部分gc结构体内的flags对字符串进行了一些标记。对字符串的标记有
//string
IS_STR_PERSISTENT //是malloc分配内存的字符串，开启opcache时常驻内存
IS_STR_INTERNED //内部字符串
IS_STR_PERMANENT //不可变的字符串
IS_STR_CONSTANT //代表常量的字符串
IS_STR_CONSTANT_UNQUALIFIED //带有可能命名空间的常量字符串
字符串类型转换输出
ZEND_API zend_string* ZEND_FASTCALL _zval_get_string_func(zval *op) /* {{{ */
{
try_again:
switch (Z_TYPE_P(op)) {
case IS_UNDEF:
case IS_NULL:
case IS_FALSE:
return ZSTR_EMPTY_ALLOC();
case IS_TRUE:
if (CG(one_char_string)['1']) {
return CG(one_char_string)['1'];
} else {
return zend_string_init("1", 1, 0);
}
case IS_RESOURCE: {
char buf[sizeof("Resource id #") + MAX_LENGTH_OF_LONG];
int len;
len = snprintf(buf, sizeof(buf), "Resource id #" ZEND_LONG_FMT, (zend_long)Z_RES_HANDLE_P(op));
return zend_string_init(buf, len, 0);
}
case IS_LONG: {
return zend_long_to_str(Z_LVAL_P(op));
}
case IS_DOUBLE: {
return zend_strpprintf(0, "%.*G", (int) EG(precision), Z_DVAL_P(op));//EG(precision)宏被替换为executor_globals.precision，标志浮点转字符串的精度，默认一般为14
}
case IS_ARRAY:
zend_error(E_NOTICE, "Array to string conversion");
return zend_string_init("Array", sizeof("Array")-1, 0);
case IS_OBJECT: {
zval tmp;
if (Z_OBJ_HT_P(op)->cast_object) {
if (Z_OBJ_HT_P(op)->cast_object(op, &tmp, IS_STRING) == SUCCESS) {
return Z_STR(tmp);
}
} else if (Z_OBJ_HT_P(op)->get) {
zval *z = Z_OBJ_HT_P(op)->get(op, &tmp);
if (Z_TYPE_P(z) != IS_OBJECT) {
zend_string *str = zval_get_string(z);
zval_ptr_dtor(z);
return str;
}
zval_ptr_dtor(z);
}
zend_error(EG(exception) ? E_ERROR : E_RECOVERABLE_ERROR, "Object of class %s could not be converted to string", ZSTR_VAL(Z_OBJCE_P(op)->name));
return ZSTR_EMPTY_ALLOC();
}
case IS_REFERENCE:
op = Z_REFVAL_P(op);
goto try_again;
case IS_STRING:
return zend_string_copy(Z_STR_P(op));
EMPTY_SWITCH_DEFAULT_CASE()
}
return NULL;
}
在浮点型转字符串时可能会有精度丢失，在2020信息安全竞赛技能赛线上赛一个web就是通过这个绕过的
trick1 = (string)$this->trick1;
if(strlen($this->trick1) > 5 || strlen($this->trick2) > 5){
die("你太长了");
}
if($this->trick1 !== $this->trick2 && md5($this->trick1) === md5($this->trick2) && $this->trick1 != $this->trick2){
echo file_get_contents("/flag");
}
}
}
highlight_file(__FILE__);
unserialize($_GET['trick']);
$a = new trick();
$a->trick1='';
$a->trick2=NULL;
echo serialize($a);
payload为
trick=O:5:"trick":2:{s:6:"trick1";d:1.00000000000001;s:6:"trick2";d:1.00000000000002;}
单双引号的解析
对于一个字符串ab\0c，在文件中的实际形式是ab\\0c，单引号处理时，会直接将这个字符串初始化为zend_string，双引号处理时，将获取的字符串传入zend_scan_escape_string函数进行处理，该函数对字符串进行转义处理。并且双引号会对字符串里的变量进行解析，解析方法为ZEND_ROPE_INIT_SPEC_UNUSED_CV_HANDLER，ZEND_ROPE_ADD_SPEC_TMP_CV_HANDLER，ZEND_ROPE_END_SPEC_TMP_CV_HANDLER。
使用gdb调试php代码时查看php变量
全局变量一般在executor_globals.symbol_table中，这是一个php的数组。首先要在赋值后的地方打一个断点，可以在代码中加入echo语句，在ZEND_ECHO_SPEC_CV_HANDLER/ZEND_ECHO_SPEC_CONST_HANDLER函数下断点，能直接在需要的地方停下。
whye@ubuntu:~/Desktop/php/php_compile/bin$ cat s.php
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
}
(gdb) p executor_globals.symbol_table.arData[7]
$2 = {val = {value = {lval = 140737347924080, dval = 6.9533488696094804e-310, counted = 0x7ffff7a13070, str = 0x7ffff7a13070, arr = 0x7ffff7a13070, obj = 0x7ffff7a13070, res = 0x7ffff7a13070,
ref = 0x7ffff7a13070, ast = 0x7ffff7a13070, zv = 0x7ffff7a13070, ptr = 0x7ffff7a13070, ce = 0x7ffff7a13070, func = 0x7ffff7a13070, ww = {w1 = 4154536048, w2 = 32767}}, u1 = {v = {type = 13 '\r',
type_flags = 0 '\000', u = {extra = 0}}, type_info = 13}, u2 = {next = 4294967295, cache_slot = 4294967295, opline_num = 4294967295, lineno = 4294967295, num_args = 4294967295, fe_pos = 4294967295,
fe_iter_idx = 4294967295, access_flags = 4294967295, property_guard = 4294967295, constant_flags = 4294967295, extra = 4294967295}}, h = 9223372036854953478, key = 0x55555617dd00}
(gdb) p executor_globals.symbol_table.arData[7].key
$3 = (zend_string *) 0x55555617dd00
(gdb) p *executor_globals.symbol_table.arData[7].key
$4 = {gc = {refcount = 1, u = {type_info = 454}}, h = 9223372036854953478, len = 1, val = "a"}
(gdb) p executor_globals.symbol_table.arData[7].val.value.zv
$5 = (zval *) 0x7ffff7a13070
(gdb) p executor_globals.symbol_table.arData[7].val.value.zv.value
$6 = {lval = 140737347855104, dval = 6.9533488662016132e-310, counted = 0x7ffff7a02300, str = 0x7ffff7a02300, arr = 0x7ffff7a02300, obj = 0x7ffff7a02300, res = 0x7ffff7a02300, ref = 0x7ffff7a02300,
ast = 0x7ffff7a02300, zv = 0x7ffff7a02300, ptr = 0x7ffff7a02300, ce = 0x7ffff7a02300, func = 0x7ffff7a02300, ww = {w1 = 4154467072, w2 = 32767}}
(gdb) p *executor_globals.symbol_table.arData[7].val.value.zv.value.str
$7 = {gc = {refcount = 1, u = {type_info = 70}}, h = 14084700777245673025, len = 17, val = "h"}
executor_globals(EG)内存放的是zend执行时相关的全局变量。相应的有compiler_globals(CG)内存放的是编译时相关的全局变量。编译时的常量会存放在CG的interned_string中
(gdb) p *compiler_globals.interned_strings.arData[65].val.value.str
$33 = {gc = {refcount = 1, u = {type_info = 70}}, h = 14084700777245673025, len = 17, val = "h"}
(gdb) p *(char (*)[17])(&compiler_globals.interned_strings.arData[65].val.value.str.val)
$34 = "hello hello hello"