How to get opcodes of PHP?

Question

  <?php
      $show_value   = 123;
      echo 'sing_quote'.$show_value;
      echo "double_quote{$show_value}";

  ?>

Its opcode is:

1: <?php
2: $show_value   = 123;
        0  ASSIGN              !0, 123
3: echo 'sing_quote'.$show_value;
        1  CONCAT              'sing_quote', !0 =>RES[~1]     
        2  ECHO                ~1
4: echo "double_quote{$show_value}";
        3  ADD_STRING          'double_quote' =>RES[~2]     
        4  ADD_VAR             ~2, !0 =>RES[~2]     
        5  ECHO                ~2
        6  RETURN              1

who voted "not a real question"? It's an excellent question! — Paul Dixon, Nov 25 '09 at 08:26
who voted for not real question, because for them it is out of their focus. — Deep Kakkar, Mar 08 '16 at 11:16
There's a online version https://3v4l.org/ having multiple PHP versions and VLD installed. — Markus Zeller, Sep 03 '22 at 15:59

score 47 · Accepted Answer · edited Apr 18 '13 at 10:27

47

Check out the Vulcan Logic Disassembler PECL extension - see author's home page for more info.

The Vulcan Logic Disassembler hooks into the Zend Engine and dumps all the opcodes (execution units) of a script. It was written as as a beginning of an encoder, but I never got the time for that. It can be used to see what is going on in the Zend Engine.

Once installed, you can use it like this:

php -d vld.active=1 -d vld.execute=0 -f yourscript.php

See also this interesting blog post on opcode extraction, and the PHP manual page listing the available opcodes.

edited Apr 18 '13 at 10:27

Jamie Schembri

6,047
4
25
37

answered Nov 25 '09 at 08:28

Paul Dixon

295,876
54
310
348

@Paul Dixon how did you know the commands after the php: "-d vld.active=1 -d vld.execute=0 -f" i took a look at the pecl vld and there is no documentation for it. Thank you in advace. – Starlays Oct 30 '13 at 08:24
See second link in post. – Paul Dixon Oct 30 '13 at 15:58
The second link is broken. – MAChitgarha Sep 06 '22 at 11:26
A possible alternative to the second link: http://php.adamharvey.name/manual/en/internals2.opcodes.list.php (**note:** this is not a complete list, e.g. lacking `TYPE_CHECK`). – MAChitgarha Sep 06 '22 at 11:46

Kornel · Answer 2 · 2012-09-27T13:22:28.820

Parsekit has parsekit_compile_string().

sudo pecl install parsekit

var_dump(parsekit_compile_string(<<<PHP
 \$show_value   = 123;
 echo 'sing_quote'.\$show_value;
 echo "double_quote{\$show_value}";
PHP
));

The output is quite verbose, so you'd need to process it to get assembler-like format.

  ["opcodes"]=>
  array(10) {
    [0]=>
    array(9) {
      ["address"]=>
      int(44682716)
      ["opcode"]=>
      int(101)
      ["opcode_name"]=>
      string(13) "ZEND_EXT_STMT"
      ["flags"]=>
      int(4294967295)
      ["result"]=>
      array(8) {
        ["type"]=>
        int(8)
        ["type_name"]=>
        string(9) "IS_UNUSED"
        ["var"]=>
        int(0)
        ["opline_num"]=>
        string(1) "0"
        ["op_array"]=>
        string(1) "0"
        ["jmp_addr"]=>
        string(1) "0"
        ["jmp_offset"]=>
        string(8) "35419039"
        ["EA.type"]=>
        int(0)
      }
      ["op1"]=>
      array(8) {
        ["type"]=>
        int(8)
        ["type_name"]=>
        string(9) "IS_UNUSED"
        ["var"]=>
        int(0)
        ["opline_num"]=>
        string(1) "0"
        ["op_array"]=>
        string(1) "0"
        ["jmp_addr"]=>
        string(1) "0"
        ["jmp_offset"]=>
        string(8) "35419039"
        ["EA.type"]=>
        int(0)
      }

The parsekit incompatibility with PHP 5.4 is the subject of bug https://bugs.php.net/bug.php?id=61187 Remi collet has a patch (I haven't tested it out though) https://github.com/remicollet/remirepo/blob/master/php/pecl/php-pecl-parsekit/php-pecl-parsekit-1.3-php-5.4.patch — Antoine 'hashar' Musso, Jul 07 '13 at 09:45

mbomb007 · Answer 3 · 2022-09-02T21:41:50.843

You can run code and also see the opcodes if you use https://3v4l.org/

Note: It automatically shows the Vulcan Logic Disassembler (VLD) output, but only if you have "all supported versions" selected in the version dropdown.

Here's a simple example (shown below for posterity): https://3v4l.org/Gt8fd/vld

Code:

<?php
$arr = [1, 2, 3, 4];
print_r(array_map(fn(int $i): int => $i * $i, $arr));

Result:

Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/Gt8fd
function name:  (null)
number of ops:  10
compiled vars:  !0 = $arr
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    2     0  E >   ASSIGN                                                   !0, <array>
    3     1        INIT_FCALL                                               'print_r'
          2        INIT_FCALL                                               'array_map'
          3        DECLARE_LAMBDA_FUNCTION                                  '%00%7Bclosure%7D%2Fin%2FGt8fd%3A3%240'
          4        SEND_VAL                                                 ~2
          5        SEND_VAR                                                 !0
          6        DO_ICALL                                         $3      
          7        SEND_VAR                                                 $3
          8        DO_ICALL                                                 
          9      > RETURN                                                   1

Function %00%7Bclosure%7D%2Fin%2FGt8fd%3A3%240:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/Gt8fd
function name:  {closure}
number of ops:  6
compiled vars:  !0 = $i
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
          0  E >   RECV                                             !0      
          1        MUL                                              ~1      !0, !0
          2        VERIFY_RETURN_TYPE                                       ~1
          3      > RETURN                                                   ~1
          4*       VERIFY_RETURN_TYPE                                       
          5*     > RETURN                                                   null

End of function %00%7Bclosure%7D%2Fin%2FGt8fd%3A3%240

Generated using Vulcan Logic Dumper, using php 8.0.0

score 0 · Answer 4 · answered Sep 06 '22 at 11:35

Two options are, setting opcache.opt_debug_level INI setting or using phpdbg binary provided in a debug-enabled PHP environment (e.g. requiring you to either compile PHP from source or install the related package on Linux).

For more information and a full guide, refer to this php.watch article (also credits to this article).

How to get opcodes of PHP?

4 Answers4

Code:

Result:

Linked

Related