2022/03/14ctfshow卷王杯easy unserialize

数组结构
$year2=array(0=>“h2”,“h3”);
year2是数组名字
0是键名
h2,h3是值

public function MeMeMe() {
    array_walk($this, function($fn, $prev){
        if ($fn[0] === "Happy_func" && $prev === "year_parm") {
            global $talk;
            echo "$talk"."</br>";
            global $flag;
            echo $flag;
        }
    });
}

自己写个例子

<?php
class one
{
    public $year1=array("h1");
    public function aa()
    {
        array_walk($this,function($fn,$prev)
        {
            echo "=====one=====<br>";
            echo $fn[0];
            echo "<br>";
            echo $prev;
            echo "<br>";
            echo "=====one=====<br>";
        });
    }
}
class two
{
    public $year2=array(0=>"h2","h3");
    public function bb()
    {
        array_walk($this,function($fn,$prev)
        {
            echo "=====two=====<br>";
            echo $fn[0];
            echo "<br>";
            echo $fn[1];
            echo "<br>";
            echo $prev;
            echo "<br>";
            echo "=====two=====<br>";
        });
    }
}
$a=new one();
$b=new two();
$a->aa();
$b->bb();
?>

输出为

=====one=====
h1
year1
=====one=====
=====two=====
h2
h3
year2
=====two=====

fn[0]是指第一个值，不是键为0的对于的值