Created
July 24, 2016 17:46
-
-
Save forax/dddb80a1231320868c38bb742a3051e4 to your computer and use it in GitHub Desktop.
get the trusted lookup using Unsafe.defineAnonymousClass
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import java.lang.invoke.MethodHandle; | |
import java.lang.invoke.MethodHandles; | |
import java.lang.invoke.MethodHandles.Lookup; | |
import java.lang.invoke.MethodType; | |
import java.lang.reflect.Field; | |
import java.util.Base64; | |
public class LookupProxyTest { | |
static final String PROXY_CLASS = | |
"yv66vgAAADUAGQoABAAQCQAKABEHABIHABMBAAY8aW5pdD4BAAMoKVYBAARD" + | |
"b2RlAQAPTGluZU51bWJlclRhYmxlAQAGbG9va3VwBwAVAQAGTG9va3VwAQAM" + | |
"SW5uZXJDbGFzc2VzAQApKClMamF2YS9sYW5nL2ludm9rZS9NZXRob2RIYW5k" + | |
"bGVzJExvb2t1cDsBAApTb3VyY2VGaWxlAQAQTG9va3VwUHJveHkuamF2YQwA" + | |
"BQAGDAAWABcBABxqYXZhL2xhbmcvaW52b2tlL0xvb2t1cFByb3h5AQAQamF2" + | |
"YS9sYW5nL09iamVjdAcAGAEAJWphdmEvbGFuZy9pbnZva2UvTWV0aG9kSGFu" + | |
"ZGxlcyRMb29rdXABAAtJTVBMX0xPT0tVUAEAJ0xqYXZhL2xhbmcvaW52b2tl" + | |
"L01ldGhvZEhhbmRsZXMkTG9va3VwOwEAHmphdmEvbGFuZy9pbnZva2UvTWV0" + | |
"aG9kSGFuZGxlcwAhAAMABAAAAAAAAgABAAUABgABAAcAAAAdAAEAAQAAAAUq" + | |
"twABsQAAAAEACAAAAAYAAQAAAAUACQAJAA0AAQAHAAAAHAABAAAAAAAEsgAC" + | |
"sAAAAAEACAAAAAYAAQAAAAcAAgAOAAAAAgAPAAwAAAAKAAEACgAUAAsAGQ=="; | |
public static void main(String[] args) throws Throwable { | |
byte[] array = Base64.getDecoder().decode(PROXY_CLASS); | |
Field theUnsafe = sun.misc.Unsafe.class.getDeclaredField("theUnsafe"); | |
theUnsafe.setAccessible(true); | |
sun.misc.Unsafe unsafe = (sun.misc.Unsafe)theUnsafe.get(null); | |
Class<?> proxy = unsafe.defineAnonymousClass(java.lang.invoke.MethodHandles.class, array, null); | |
MethodHandle mh = MethodHandles.lookup().findStatic(proxy, "lookup", MethodType.methodType(Lookup.class)); | |
Lookup trusted = (Lookup)mh.invokeExact(); | |
System.out.println(trusted); | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
FWIW: The base64 encoded class resolves to: