php反射利用总结

ctf php

Word count: 739Reading time: 4 min

 2021/08/31   Share

反射的概念

反射通常被定义为程序在执行时检查自身并修改其逻辑的能力。在技术方面，反射是要求对象告诉你它的属性和方法，并改变那些成员（甚至是私有成员）

反射的利用

ReflectionClass

ReflectionClass implements Reflector {
	/* 常量 */
	const integer IS_IMPLICIT_ABSTRACT = 16 ;
	const integer IS_EXPLICIT_ABSTRACT = 32 ;
	const integer IS_FINAL = 64 ;
	/* 属性 */
	public $name ;
	/* 方法 */
	public __construct ( mixed $argument )
	public static export ( mixed $argument [, bool $return = false ] ) : string
	public getConstant ( string $name ) : mixed
	public getConstants ( ) : array
	public getConstructor ( ) : ReflectionMethod
	public getDefaultProperties ( ) : array
	public getDocComment ( ) : string
	public getEndLine ( ) : int
	public getExtension ( ) : ReflectionExtension
	public getExtensionName ( ) : string
	public getFileName ( ) : string
	public getInterfaceNames ( ) : array
	public getInterfaces ( ) : array
	public getMethod ( string $name ) : ReflectionMethod
	public getMethods ([ int $filter ] ) : array
	public getModifiers ( ) : int
	public getName ( ) : string
	public getNamespaceName ( ) : string
	public getParentClass ( ) : ReflectionClass
	public getProperties ([ int $filter ] ) : array
	public getProperty ( string $name ) : ReflectionProperty
	public getReflectionConstant ( string $name ) : ReflectionClassConstant|false
	public getReflectionConstants ( ) : array
	public getShortName ( ) : string
	public getStartLine ( ) : int
	public getStaticProperties ( ) : array
	public getStaticPropertyValue ( string $name [, mixed &$def_value ] ) : mixed
	public getTraitAliases ( ) : array
	public getTraitNames ( ) : array
	public getTraits ( ) : array
	public hasConstant ( string $name ) : bool
	public hasMethod ( string $name ) : bool
	public hasProperty ( string $name ) : bool
	public implementsInterface ( string $interface ) : bool
	public inNamespace ( ) : bool
	public isAbstract ( ) : bool
	public isAnonymous ( ) : bool
	public isCloneable ( ) : bool
	public isFinal ( ) : bool
	public isInstance ( object $object ) : bool
	public isInstantiable ( ) : bool
	public isInterface ( ) : bool
	public isInternal ( ) : bool
	public isIterable ( ) : bool
	public isIterateable ( ) : bool
	public isSubclassOf ( string $class ) : bool
	public isTrait ( ) : bool
	public isUserDefined ( ) : bool
	public newInstance ( mixed $args [, mixed $... ] ) : object
	public newInstanceArgs ([ array $args ] ) : object
	public newInstanceWithoutConstructor ( ) : object
	public setStaticPropertyValue ( string $name , string $value ) : void
	public __toString ( ) : string
}

__construct

ReflectionClass的__construct用于构造类对象

<?php

class Test{
	private $a;
	public $b;
	public function hello(){
		echo "hello";
	}
}

$class = new ReflectionClass('Test');
var_dump($class);

输出结果

class ReflectionClass#1 (1) {
  public $name =>
  string(4) "Test"
}

获取方法并执行

创建实例并执行方法

1
2
3

$class = new ReflectionClass('Test');
$test=$class->newInstance();
$test->hello();

输出结果

hello

反射读取私有成员

用到getProperties方法，然后setAccessible设置变量可读

<?php
 class FlagSDK {
   private $hash='xxxx';
}
$sdk = new FlagSDK();
$reflect = new ReflectionClass($sdk);
$props   = $reflect->getProperties(ReflectionProperty::IS_PUBLIC | ReflectionProperty::IS_PRIVATE | ReflectionProperty::IS_PROTECTED);
foreach ($props as $prop) {
    $prop->setAccessible(true);
    print $prop->getName() . "t";
    print $prop->getValue($sdk)."n";
}

输出结果

1
2

hash
xxxx

反射执行私有方法

使用getMethod获取Method，然后setAccessible设置方法可读

<?php
class FlagSDK {
private $hash='xxxx';
public function verify($key)
{

 if (sha1($key) === $this->getHash()) {

   return "too{young-too-simple}";
    }
  return false;
}

private function getHash()
{

    return 'xxxxx';
}

}
    $hash=new FlagSDK();
    $objReflectClass = new ReflectionClass('FlagSDK');
    $method = $objReflectClass->getMethod('getHash');
    $method->setAccessible(true);
    $re=$method->invokeArgs($hash,array());
    echo $re;

读取公有变量

$FlagSDK = new FlagSDK;
$reflectionClass = new ReflectionClass('FlagSDK');
$reflectionClass->getProperty('hash')->setValue($FlagSDK,'aaaa');
var_dump($FlagSDK->hash);

读取私有变量

$FlagSDK = new FlagSDK;
$reflectionClass = new ReflectionClass('FlagSDK');
$reflectionProperty = $reflectionClass->getProperty('hash');
$reflectionProperty->setAccessible(true);
$reflectionProperty->setValue($FlagSDK, 'aaaa');
var_dump($reflectionProperty->getValue($FlagSDK));

查看所有类的方法

以下脚本是查找所有包括__destruct()…的方法和对应类

<?php
$classes = get_declared_classes();
foreach ($classes as $class) {
    $methods = get_class_methods($class);
    foreach ($methods as $method) {
        if (in_array($method, array(
            '__destruct',
            '__wakeup',
            '__call',
            '__callStatic',
            'open'
        ))) {
            print $class . '::' . $method . "\n";
        }
    }
}

php反射利用总结

反射的概念

反射的利用

ReflectionClass

__construct

获取方法并执行

反射读取私有成员

反射执行私有方法

读取公有变量

读取私有变量

查看所有类的方法

更多用法