SlideShare a Scribd company logo
PHP
Under The Hood
What Is PHP?
● An Easy To Learn Language?
○ Sure!
● A Simple Language?
○ Usually
● A Well Designed Language?
○ HA!
● An Effective Language!
○ Absolutely!
PHP, Under The Hood - DPC
PHP Is...
Dynamically
Typed
$a = 1;
$b = "a";
PHP Is...
Weak Typed
1 + "1b" == 2
PHP Is...
Implementation
Defined
Implementations
Main:
C-PHP: www.php.net
Alt:
HipHop - Facebook
Roadsend - Compiler
Phalanger - .NET
PHP Compiler - Compiler
PHPPHP - PHP
PHP, Under The Hood - DPC
Interesting Note:
C-PHP Requires
PHP To Compile!
PHP Is...
Compiled
PHP, Under The Hood - DPC
PHP Is...
Dynamically
Compiled
On-Demand
PHP, Under The Hood - DPC
It All Starts With The
SAPI
SAPI
● Server API
● "Starts" PHP and issues request(s)
● Common SAPIs:
○ CLI
○ CGI (and FastCGI)
○ mod_php
○ FPM
○ etc...
Execution Pipeline
Execution Pipeline
Start Up
Request
Shut Down
SAPI
Execution Pipeline
Start Up
Request
Shut Down
SAPI
Config Init
Engine Init
Module Init
Zend/zend.c
PHPPHP/PHP.php
Execution Pipeline
Start Up
Request
Shut Down
SAPI
Module
Shutdown
Engine
Shutdown
Zend/zend.c
Execution Pipeline
Start Up
Request
Shut Down
SAPI
Request Init
Compile Code
Execute Code
Request
Shutdown
PHP, Under The Hood - DPC
Compiler Pipeline
Lexer
Lexer Step
● C-PHP
○ Tokenizes using RE2C
○ Produces Array of Tokens
● PHPPHP
○ Uses core tokenizer (or emulative)
○ PHPParser Powered
Zend/zend_language_scanner.l
PHPParser/Lexer/Emulative.php
Compiler Pipeline
Lexer
Parser
Parse Step
● C-PHP
○ Directly Generates OPCode Array
○ BISON Powered
● PHPPHP
○ Generates AST Structure
○ PHPParser Powered
Zend/zend_language_parser.y
Compiler Pipeline
Lexer
Parser
Compiler
Compile Step
● C-PHP
○ Compiled Directly During Parse
○ Single Pass Compilation
● PHPPHP
○ Recurses Over AST
○ Single Pass (for now)
○
PHPPHP/Engine/Compiler.php
Compiler Pipeline
Lexer
Parser
Compiler
OpCode
OpCodes
● A Series of Operations
○ Just like Assembler Opcodes
○ Represent "units of functionality"
● Designed to run on Virtual Machine
○ Zend Engine
○ Or PHPPHP!
$a = 1;
$b = 2;
echo $a + $b;
PHP, Under The Hood - DPC
Notice Anything?
PHP, Under The Hood - DPC
PHP, Under The Hood - DPC
What If We
Cached The
OpCodes?
We Can Cache!
● Given the compiler is Idempodent
○ (has no side-effects)
○ (hint: it's not)
● OpCodes are really Pointers
○ Swizzling!!!
In Other Words
OpCode Caching
Is Hard!
PHP, Under The Hood - DPC
Time To Execute!
Zend/zend_vm_execute.h
PHPPHP/Engine/Executor.php
Executor Pipeline
OpCode
Is
Return?No Yes
Return
PHP, Under The Hood - DPC
But What Are We
Executing?
Zend/zend_vm_execute.h
Interesting Note:
vm_execute.h
Is Generated By
PHP
PHPPHP/Engine/OpLines/Add.php
Variables!
Zend/zend.h
PHPPHP/Engine/Zval/Value.php
PHP, Under The Hood - DPC
Ref-Counting
● RefCount + References
○ Allows Copy-On-Write
● Variable Is "Deleted" When
RefCount = 0
● Enables Primitive Garbage
Collection
○ Circular GC is also implemented
That's All There Is
To It!
PHP, Under The Hood - DPC
Let's Look At An
Example
$a = 1;
$b = 2;
var_dump(
$a + $b
);
line # op return operands
-----------------------------------
2 0 ASSIGN !0, 1
3 1 ASSIGN !1, 2
6 2 ADD ~2 !0, !1
3 SEND_VAL ~2
4 DO_FCALL 'var_dump'
5 RETURN 1
[0] => PHPPHPEngineOpLinesAssign
[1] => PHPPHPEngineOpLinesAssign
[2] => PHPPHPEngineOpLinesAdd
[3] => PHPPHPEngineOpLinesInitFCallByName
[4] => PHPPHPEngineOpLinesSend
[5] => PHPPHPEngineOpLinesFunctionCall
[6] => PHPPHPEngineOpLinesReturnOp
[0] => PHPPHPEngineOpLinesAssign Object (
[op1] => PHPPHPEngineZvalPtr Object (
[zval:protected] => PHPPHPEngineZvalVariable Object (
[name:protected] => PHPPHPEngineZvalPtr Object (
[zval:protected] => PHPPHPEngineZvalValue Object (
[value:protected] => a
[refcount:protected] => 1
[isRef:protected] =>
[dtorFunc:protected] =>
)
)
[class:protected] =>
[zval:protected] =>
[executor:protected] =>
[scope] => 1
)
)
[op2] => PHPPHPEngineZvalPtr Object (
[zval:protected] => PHPPHPEngineZvalValue Object (
[value:protected] => 1
[refcount:protected] => 1
[isRef:protected] =>
[dtorFunc:protected] =>
)
)
[result] =>
[lineno] => 2
)
PHPPHP/Engine/OpLines/Assign.php
PHPPHP/Engine/OpLines/Add.php
PHPPHP/Engine/OpLines/InitFCallByName.php
PHPPHP/Engine/OpLines/Send.php
PHPPHP/Engine/OpLines/FunctionCall.php
There's A Ton
More
PHP, Under The Hood - DPC
PHP, Under The Hood - DPC
Get Involved!
PHP, Under The Hood - DPC
More Info
● github.com/php/php-src
● lxr.php.net
● github.com/ircmaxell/PHPPHP
● Reference Series
○ wiki.php.net
○ blog.ircmaxell.com
■ PHP Internals Series
Anthony Ferrara
Joind.in/8443
@ircmaxell
blog.ircmaxell.com
ircmaxell@php.net
youtube.com/ircmaxell

More Related Content

PDF
Windows 10 Nt Heap Exploitation (English version)
PPTX
php and sapi and zendengine2 and...
PPTX
php-src の歩き方
PDF
Play with FILE Structure - Yet Another Binary Exploit Technique
PDF
Instruction Combine in LLVM
PDF
Why rust?
PDF
A story of the passive aggressive sysadmin of AEM
PPTX
PHP と SAPI と ZendEngine3 と
Windows 10 Nt Heap Exploitation (English version)
php and sapi and zendengine2 and...
php-src の歩き方
Play with FILE Structure - Yet Another Binary Exploit Technique
Instruction Combine in LLVM
Why rust?
A story of the passive aggressive sysadmin of AEM
PHP と SAPI と ZendEngine3 と

What's hot (20)

PDF
Golang and Eco-System Introduction / Overview
PPTX
You didnt see it’s coming? "Dawn of hardened Windows Kernel"
PDF
from Binary to Binary: How Qemu Works
PDF
PHPの関数実行とその計測
PPTX
Write microservice in golang
PDF
Interpreter, Compiler, JIT from scratch
PDF
How A Compiler Works: GNU Toolchain
PPTX
Bash Shell Scripting
PDF
Zend OPcacheの速さの秘密を探る
PPT
PDF
Shell scripting
PDF
MacOS memory allocator (libmalloc) Exploitation
PPTX
Php cookies
PDF
Launch the First Process in Linux System
PDF
Address/Thread/Memory Sanitizer
ODP
Introduction to triggers
PPTX
Triton and Symbolic execution on GDB@DEF CON China
PPTX
Writing php extensions in golang
PPTX
Security in PHP - 那些在滲透測試的小技巧
PDF
Deep drive into rust programming language
Golang and Eco-System Introduction / Overview
You didnt see it’s coming? "Dawn of hardened Windows Kernel"
from Binary to Binary: How Qemu Works
PHPの関数実行とその計測
Write microservice in golang
Interpreter, Compiler, JIT from scratch
How A Compiler Works: GNU Toolchain
Bash Shell Scripting
Zend OPcacheの速さの秘密を探る
Shell scripting
MacOS memory allocator (libmalloc) Exploitation
Php cookies
Launch the First Process in Linux System
Address/Thread/Memory Sanitizer
Introduction to triggers
Triton and Symbolic execution on GDB@DEF CON China
Writing php extensions in golang
Security in PHP - 那些在滲透測試的小技巧
Deep drive into rust programming language
Ad

Viewers also liked (14)

PDF
PHP 7 new engine
PDF
Being functional in PHP (PHPDay Italy 2016)
PPTX
PPTX
Internet of Things With PHP
PPTX
PHP Optimization
PDF
PHP WTF
PDF
PHP 7 performances from PHP 5
PPTX
Php internal architecture
PPTX
Laravel Beginners Tutorial 1
KEY
Php 101: PDO
PDF
[Community Open Camp] 給 PHP 開發者的 VS Code 指南
PPT
How PHP Works ?
PDF
LaravelConf Taiwan 2017 開幕
PDF
Route 路由控制
PHP 7 new engine
Being functional in PHP (PHPDay Italy 2016)
Internet of Things With PHP
PHP Optimization
PHP WTF
PHP 7 performances from PHP 5
Php internal architecture
Laravel Beginners Tutorial 1
Php 101: PDO
[Community Open Camp] 給 PHP 開發者的 VS Code 指南
How PHP Works ?
LaravelConf Taiwan 2017 開幕
Route 路由控制
Ad

Similar to PHP, Under The Hood - DPC (20)

PPTX
Php’s guts
PDF
Php engine
PDF
PHP Internals and Virtual Machine
PDF
Quick tour of PHP from inside
PDF
Introduction to PHP (SDPHP)
PPTX
Php extensions
PDF
Php7 extensions workshop
PPT
Introduction to PHP - SDPHP
PPTX
Zend Framework Workshop
PPTX
PHP ITCS 323
PDF
Phpをいじり倒す10の方法
PPTX
Introduction to PHP.pptx
PPT
PPT
Php classes in mumbai
PPTX
Php extensions
PPTX
Php Extensions for Dummies
PPTX
Php extensions
PDF
PPT
Prersentation
PPT
Synapseindia reviews on array php
Php’s guts
Php engine
PHP Internals and Virtual Machine
Quick tour of PHP from inside
Introduction to PHP (SDPHP)
Php extensions
Php7 extensions workshop
Introduction to PHP - SDPHP
Zend Framework Workshop
PHP ITCS 323
Phpをいじり倒す10の方法
Introduction to PHP.pptx
Php classes in mumbai
Php extensions
Php Extensions for Dummies
Php extensions
Prersentation
Synapseindia reviews on array php

More from Anthony Ferrara (11)

PDF
Password Storage And Attacking In PHP - PHP Argentina
PDF
Beyond design patterns phpnw14
PDF
Don't Be STUPID, Grasp SOLID - ConFoo Edition
PDF
Development By The Numbers - ConFoo Edition
PDF
Don't Be STUPID, Grasp SOLID - DrupalCon Prague
PDF
Don't be STUPID, Grasp SOLID - North East PHP
PDF
Development by the numbers
PDF
Don't Be Stupid, Grasp Solid - MidWestPHP
PDF
Cryptography For The Average Developer - Sunshine PHP
PDF
Password Storage and Attacking in PHP
PDF
Cryptography For The Average Developer
Password Storage And Attacking In PHP - PHP Argentina
Beyond design patterns phpnw14
Don't Be STUPID, Grasp SOLID - ConFoo Edition
Development By The Numbers - ConFoo Edition
Don't Be STUPID, Grasp SOLID - DrupalCon Prague
Don't be STUPID, Grasp SOLID - North East PHP
Development by the numbers
Don't Be Stupid, Grasp Solid - MidWestPHP
Cryptography For The Average Developer - Sunshine PHP
Password Storage and Attacking in PHP
Cryptography For The Average Developer

Recently uploaded (20)

PDF
Unlocking AI with Model Context Protocol (MCP)
PDF
Diabetes mellitus diagnosis method based random forest with bat algorithm
PPTX
Tartificialntelligence_presentation.pptx
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
PDF
Machine learning based COVID-19 study performance prediction
PDF
Per capita expenditure prediction using model stacking based on satellite ima...
PPT
Teaching material agriculture food technology
PPTX
Programs and apps: productivity, graphics, security and other tools
PDF
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
PDF
NewMind AI Weekly Chronicles - August'25-Week II
PDF
Accuracy of neural networks in brain wave diagnosis of schizophrenia
PDF
A comparative study of natural language inference in Swahili using monolingua...
PDF
Mushroom cultivation and it's methods.pdf
PDF
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
PPTX
SOPHOS-XG Firewall Administrator PPT.pptx
PDF
Network Security Unit 5.pdf for BCA BBA.
PDF
A comparative analysis of optical character recognition models for extracting...
PPTX
TLE Review Electricity (Electricity).pptx
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
PDF
Video forgery: An extensive analysis of inter-and intra-frame manipulation al...
Unlocking AI with Model Context Protocol (MCP)
Diabetes mellitus diagnosis method based random forest with bat algorithm
Tartificialntelligence_presentation.pptx
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Machine learning based COVID-19 study performance prediction
Per capita expenditure prediction using model stacking based on satellite ima...
Teaching material agriculture food technology
Programs and apps: productivity, graphics, security and other tools
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
NewMind AI Weekly Chronicles - August'25-Week II
Accuracy of neural networks in brain wave diagnosis of schizophrenia
A comparative study of natural language inference in Swahili using monolingua...
Mushroom cultivation and it's methods.pdf
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOPHOS-XG Firewall Administrator PPT.pptx
Network Security Unit 5.pdf for BCA BBA.
A comparative analysis of optical character recognition models for extracting...
TLE Review Electricity (Electricity).pptx
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
Video forgery: An extensive analysis of inter-and intra-frame manipulation al...

PHP, Under The Hood - DPC