In php5.6.30, i have following code:

<?php
eval("system("whoami");");

the opcode is:

line     #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   2     0  E >   EXT_STMT                                                 
         1        EXT_FCALL_BEGIN                                          
         2        INCLUDE_OR_EVAL                                          'system%28%22whoami%22%29%3B', EVAL
         3        EXT_FCALL_END                                            
         4      > RETURN     

i wrote a extension to hook INCLUDE_OR_EVAL, but failure.

PHP_MINIT_FUNCTION(taint)
{
    /* If you have INI entries, uncomment these lines 
    REGISTER_INI_ENTRIES();
    */
    
    php_printf("[+] hook readyn");

    // zend_set_user_opcode_handler(ZEND_ECHO, HOOK_INCLUDE_OR_EVAL);
    zend_set_user_opcode_handler(ZEND_INCLUDE_OR_EVAL, HOOK_INCLUDE_OR_EVAL);
    return SUCCESS;
}

i try to hook ZEND_ECHO, it works.
but ZEND_INCLUDE_OR_EVAL fail.