DEV Community

Hideaki
Hideaki

Posted on

Use variable variables of PHP to obfuscate code

I came across a weird PHP concept—variable variables.

It works like this:

$a = 'foo';
$$a='bar';
print $foo;
Enter fullscreen mode Exit fullscreen mode

The variable $foo in line 3 is not directly declared. Instead, $$a in line 2 is interpreted as $foo because PHP expands the value of $a from line 1.

I use this feature to obfuscate this Quine in PHP:

<?php $SS='${"$$"}=" ";for($ss=33;$ss<127;$ss++)${chr($ss-1)}=chr($ss);
eval(preg_replace("/\s/","",substr($SS,132)));printf($_,$SS);#$$$$$$$$$
$_=$$$$$$$$$$$$$$$$$$$$$$$$$$$$${"$$"}.$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
{"$$"}.$$$$$$$$$$$$$$$$$$$$$$$$$      $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$$${"$$"}.$$      $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$        $$$$$$${"$$"}.$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$$$$$                   $$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$${"$$"}.${"$                        $"}.$$$$${"$$"}.$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$                           $$$$$$$$$$$$$$$$$$$$$${
"$$"}.$$$$$$$$$$$$$$             $$              $$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$${"$$"             }.$$$            $$$$$$$$$$$$$$$$$$$$$$
$$$$${"$$"}.$$$$$$$             ${"$$             "}.$$$$$${"$$"}.$$$$$
$$$$$$$$$$$$$$$$$$$             $$$$$             $$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$              $$$$             $$$$$$$$$$${"$$"}.$$$
$$$$${"$$"}.$$$$$$$               $$$$$$$$$$$$$$$$$$$$${"$$"}.$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$                 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$${"$$"}.$$$$$$$                    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$$                     $$$$$$$$$$$$$$$$$$$$$$$$$$$$
{"$$"}.$$$$$$$$$$$$$$$$$                      $$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$$$${"                      $$"}.$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$                     $$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$${"$$"}.$$$$$$$$${"$$"}                   .$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$                 $$$$$$$$$$$$$$$$$$$$
$$$$$$$$$${"$$"}.$$            $$$$$               $$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$             $$$$$              $$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$${"$$             "}.$$              $$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$             $$$$$              $$$$$$$$$$$$$$$$$$$$
${"$$"}.$$$$$$$$$$$             $$$$$              $$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$            $$$$$             $$$$$$$$$$$$$$$$$$$$$
$${"$$"}.$$$$$$$$$$$$                            $$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$$                          $$$$$$$$$$$$$$$$$$$$$$$
$$$$$${"$$"}.$$$$$$$$$$$                      $$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$                $$$$$$$$$$$$$$$$$$$${"$$"}.$
$$$$$$$${"$$"}.$$$$${"$$"}.$$$$$      $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$${"$$"}.$$$$$$$$$$$      $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$${"$$"}.$$$$$$$$$$$$${"$$      "}.$$$$$$$$$$$$$$$$${"$$"}.$$$$$$
$$$$$$${"$$"}.$$$$$$$$$$$$$$$$$${"$$"}.$$$$$$$$$$$$$$$$$$$${"$$"}.$$$$$
$$$$$$$$$$$$$${"$$"}.$$$$$$$$$${"$$"}.$$$$$$$$$${"$$"}.$$$$$$$$$$$$$$$$
$$$$$$$$$$$${"$$"};#$$$$$$$$$$$$$$$$$$$$$$$$$';eval(substr($SS,0,132));
Enter fullscreen mode Exit fullscreen mode

The key part of this code is:

$SS='${"$$"}=" ";for($ss=33;$ss<127;$ss++)${chr($ss-1)}=chr($ss);
Enter fullscreen mode Exit fullscreen mode

Firstly, PHP usually uses only alphanumeric characters and underscores for variable names. But if you use the ${} syntax, you can use pretty much any character for variable names, even the dollar sign itself.

${'$'} = 'dollar';
print ${'$'}; // dollar
Enter fullscreen mode Exit fullscreen mode

Let's look at the Quine code again, cleaned up a bit:

${"$$"}=" ";

for($ss=33;$ss<127;$ss++){
    ${chr($ss-1)}=chr($ss);
}
Enter fullscreen mode Exit fullscreen mode

This code creates an ASCII ↔ variable variable conversion.

The code starts with ${'$$'}=' ';. Note that space is ASCII code 32.

The for-loop creates variable variables that follow this pattern:

${[ASCII code N-1]} = '[ASCII code N]';

For example, when N=33, this code is interpreted as follows:

${' '}='!' (ASCII code 32 is space, 33 is !).

When N=34, it will look like ${’!‘}=’"’ and so on.

Now, because ! is defined as ${' '} and space is defined by ${'$$'}, ! can also be represented as $${'$$'} using variable variables. Likewise, " is $$${'$$'}, and so on.

After the for-loop is finished, all ASCII characters can be written as [$ for (ASCII code - 31) times]{'$$'}

Here are some examples:

print ${'$$'}; // space: ASCII 32
print $${'$$'}; // !: ASCII 33
print $$${'$$'}; // #: ASCII 34
print $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$${"$$"} // A: ASCII 65
print $$$$$$$$$$$$$$$$$${"$$"} // 1: ASCII 49
Enter fullscreen mode Exit fullscreen mode

Using this, a "Hello World" program looks like this:

<?php

${"$$"}=" ";

for($ss=33;$ss<127;$ss++){
    ${chr($ss-1)}=chr($ss);
}

print $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$${"$$"}. // H
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$${"$$"}. // e
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$${"$$"}. // l
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$${"$$"}. // l
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$${"$$"}. // o
$$$$$$$$$$$$${"$$"}. // ,
${"$$"}.// ' '
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$${"$$"}. // W
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$${"$$"}. // o
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$${"$$"}. // r
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$${"$$"}. // l
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$${"$$"}. // d
$${"$$"}; // !

Enter fullscreen mode Exit fullscreen mode

Note that you can't use single-letter variables in this code, such as $i for the counter. All single-letter variables are defined in the for loop (e.g., $i is defined as the string j).

Now, all that's left is to write a Quine using this technique, which gives us the code shown at the top of the article.

I hope you enjoyed this article. Happy coding!

Top comments (0)