The PHP bytecode CPG is based on PHP opcodes. Recent PHP versions are compiled from the PHP source code to an intermediare bytecode used by the PHP virtual machine. Check out nikic's great blog for a better introduction and deep-dive into the topic.

This documentation is a work in progress.

• https://www.npopov.com/2017/04/14/PHP-7-Virtual-machine.html
• https://stackoverflow.com/questions/36031490/what-is-ext-nop-and-ext-stmt-php-opcode
• https://www.npopov.com/2022/05/22/The-opcache-optimizer.html
  • includes an explanation of the bitflags used below
• https://3v4l.org/ also offers opcode dumps
  • If you want to find out when a particular opcodes is generated, Google it with site:3v4l.org to find usages.
• PHP src
  • e.g. list of opcodes of PHP 7.4.28: https://github.com/php/php-src/blob/b3c6c35570283c457cd5ee6d56301a1bc7f2f8e6/Zend/zend_vm_opcodes.h
• PHP doc
  • documents some opcodes, but tends to be inconclusive

php -d zend_extension=opcache -d opcache.enable_cli=1 -d opcache.opt_debug_level=0x10000 --syntax-check <file.php>

Can be used to dump the opcodes. This is handy to get a feeling for PHP opcodes.

Since the CPG is built from bytecode it can not implement everything up-to-spec.

<?php
$x = $_GET["x"];
if($x > 10) {
    print("a");
}

converts to:

$_main: ; (lines=7, args=0, vars=1, tmps=4)
    ; (before optimizer)
    ; if.php:1-6
L0 (2):     T1 = FETCH_R (global) string("_GET")
L1 (2):     T2 = FETCH_DIM_R T1 string("x")
L2 (2):     ASSIGN CV0($x) T2
L3 (3):     T4 = IS_SMALLER int(10) CV0($x)
L4 (3):     JMPZ T4 L6
L5 (4):     ECHO string("a")
L6 (6):     RETURN int(1)

which is then converted to a cpg. The bytecode instructions are modeled as calls. The CPG only implements basic functionality from the spec, e.g it doesn't support constructs like cpg.assignment.

joern> cpg.assignment.l 
res0: List[operatorextension.OpNodes.Assignment] = List()

But that functionality can be queried via calls:

joern> cpg.call("ASSIGN").l 
res1: List[Call] = List(
  Call(
    id -> 512409557603043114L,
    argumentIndex -> -1,
    argumentName -> None,
    code -> "ASSIGN CV($x) T2",
    columnNumber -> None,
    dispatchType -> "STATIC_DISPATCH",
    dynamicTypeHintFullName -> ArraySeq(),
    lineNumber -> Some(value = 1),
    methodFullName -> "<empty>",
    name -> "ASSIGN",
    order -> 2,
    signature -> "",
    typeFullName -> "<empty>"
  )
)

This is a WIP list of documented bytecodes.