Skip to content

Instantly share code, notes, and snippets.

@nubs
Last active December 18, 2015 21:48
Show Gist options
  • Save nubs/5849633 to your computer and use it in GitHub Desktop.
Save nubs/5849633 to your computer and use it in GitHub Desktop.
No alphabetic or non-ascii characters.
  • 91 ([): 210
  • 93 (]): 210

Array to string conversion is the only way to get access to a useful string in PHP. We luck out that the conversion includes an uppercase A, otherwise we may not be able to get uppercase letters without including other characters.

  • 32 ( ): 1
  • 33 (!): 1
  • 44 (,): 1

The only real way of generating these from alphabetic letters is to use binary operators like ^. For example, we could take advantage of the fact that d^H==',', h^H==' ', and i^H=='!'. This should make it possible to remove these three characters adding only the ^ operator.

  • 36 ($): 280
  • 123 ({): 176
  • 125 (}): 176

I'm fairly certain php's limited use of operators on expressions keeps us from being able to write this code in a variableless manner. The restrictions on variable names further means that all of variables need to be generated using ${} syntax. Because we are also trying to not add quotes to the characters used, all of the variable names are based off of variables named things like ArrayArrayArray and similar.

  • 61 (=): 17

The equals sign is used for two purposes, neither of which can be replaced as far as I know. One is to assign values to variables - there aren't many ways to do this, and all but = and its variants use other characters. The other purpose is for doing output, which is fortunate because without it we'd have to call a function which would require letters in the code.

  • 60 (<): 132
  • 62 (>): 132
  • 63 (?): 264

The opening php tag is obviously needed, without it php wouldn't execute anything. The closing one would be possible to do without, but since we have to do output using <?= it would mean our entire program would have to fit inside an output statement. This would require using , to order the statements rather than a ; or ?><? and would require using ! to make sure that values that might print stuff get converted to false which does not print anything.

  • 43 (+): 248

The plus may be able to be done without, although doing so would seemingly require adding another bitwise operator. The ^ operator alone cannot get us all the characters we need as it can only get the characters in the string "ArrayJRY38j+\x13\x18\x20\xb".

  • 46 (.): 55

String concatenation is most likely necessary. We need some way of converting an array to a string, and the concatenation operator appears to be our only real choice. Many of the uses of it in the program could likely be changed to ++-based solutions, but at some point we have to get those initial characters into the program.

<?${1}=[].'';${2}=${1}{0};${2}++;${2}++;${2}++;${2}++;${2}++;${2}++;${2}++;${3}=${2};${3}++;${3}++;${3}++;${3}++;${3}++;${3}++;${3}++;${3}++;${3}++;${3}++;${3}++;${3}++;${3}++;${3}++;${3}++;${4}=${1}{3};${4}++;${4}++;${5}=++${4};${6}=++${5};${6}++;${6}++;${6}++;${6}++;${6}++;${6}++;${7}=++${6};${7}++;${7}++;${8}=++${7};${8}++;${8}++;${8}++?><?="${2}${5}${6}${6}${7}, ${3}${7}${8}${6}${4}!";
<?${[]}=[].[].[].[].[]?><?${[].[]}=[].[]?><?${[]}+=[].[]?><?${[].[].[]}=${[]}?><?${[].[].[]}++?><?${[].[].[]}++?><?${[].[].[]}++?><?$${[]}=${[].[]}{${[]}}?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?${[]}++?><?$${[]}=${[].[]}{${[].[].[]}}?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?${[]}++?><?$${[]}=${[].[]}{${[].[].[]}}?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?${[]}++?><?$${[]}=${[].[]}{${[].[].[]}}?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?${[]}++?><?$${[]}=${[].[]}{${[].[].[].[]}}?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?${[]}++?><?$${[]}=${[].[]}{${[].[].[]}}?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?${[]}++?><?$${[]}=${[].[]}{${[].[].[]}}?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?${[]}++?><?$${[]}=${[].[]}{${[].[].[]}}?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?${[]}++?><?$${[]}=${[].[]}{${[].[].[]}}?><?$${[]}++?><?$${[]}++?><?$${[]}++?><?${[]}=[].[].[].[].[]?><?${[]}+=[].[].[]?><??><?=${${[]}++}.${${[]}++}.$${[]}.${${[]}++}.${${[]}++}?>, <?=${${[]}++}.${${[]}++}.${${[]}++}.${${[]}++}.${${[]}++}?>!
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment