It helps if you wrote a good chunk of it. But one way that is easier than diving into the source code is to just dump the opcodes using vld (see pecl.vld). I h

It helps if you wrote a good chunk of it. But one way that is easier than diving into the source code is to just dump the opcodes using vld (see pecl.vld). I have a little wrapper shell script /usr/local/bin/vld: #!/bin/sh -e exec php -dvld.active=1 -d vld.execute=0 "$@" Then for the hello world program with the print() call: % vld hello1.php Finding entry points Branch analysis from position: 0 Return found filename: /tmp/hello1.php function name: (null) number of ops: 3 compiled vars: none line # * op fetch ext return operands --------------------------------------------------------------------------------- 2 0 > PRINT ~0 'Hello+World' 1 FREE ~0 4 2 > RETURN 1 branch: # 0; line: 2- 4; sop: 0; eop: 2 path #1: 0, vs. the one that just contains the string: Hello World % vld hello2.php Finding entry points Branch analysis from position: 0 Return found filename: /tmp/hello2.php function name: (null) number of ops: 2 compiled vars: none line # * op fetch ext return operands --------------------------------------------------------------------------------- 2 0 > ECHO 'Hello+World%0A' 1 > RETURN 1 branch: # 0; line: 2- 2; sop: 0; eop: 1 path #1: 0,