Skip to content

Instantly share code, notes, and snippets.

@forax

forax/LookupProxyTest.java

Created July 24, 2016 17:46
Show Gist options
  • Save forax/dddb80a1231320868c38bb742a3051e4 to your computer and use it in GitHub Desktop.
Save forax/dddb80a1231320868c38bb742a3051e4 to your computer and use it in GitHub Desktop.
Download ZIP
get the trusted lookup using Unsafe.defineAnonymousClass
Raw
LookupProxyTest.java
import java.lang.invoke.MethodHandle;
import java.lang.invoke.MethodHandles;
import java.lang.invoke.MethodHandles.Lookup;
import java.lang.invoke.MethodType;
import java.lang.reflect.Field;
import java.util.Base64;
public class LookupProxyTest {
static final String PROXY_CLASS =
"yv66vgAAADUAGQoABAAQCQAKABEHABIHABMBAAY8aW5pdD4BAAMoKVYBAARD" +
"b2RlAQAPTGluZU51bWJlclRhYmxlAQAGbG9va3VwBwAVAQAGTG9va3VwAQAM" +
"SW5uZXJDbGFzc2VzAQApKClMamF2YS9sYW5nL2ludm9rZS9NZXRob2RIYW5k" +
"bGVzJExvb2t1cDsBAApTb3VyY2VGaWxlAQAQTG9va3VwUHJveHkuamF2YQwA" +
"BQAGDAAWABcBABxqYXZhL2xhbmcvaW52b2tlL0xvb2t1cFByb3h5AQAQamF2" +
"YS9sYW5nL09iamVjdAcAGAEAJWphdmEvbGFuZy9pbnZva2UvTWV0aG9kSGFu" +
"ZGxlcyRMb29rdXABAAtJTVBMX0xPT0tVUAEAJ0xqYXZhL2xhbmcvaW52b2tl" +
"L01ldGhvZEhhbmRsZXMkTG9va3VwOwEAHmphdmEvbGFuZy9pbnZva2UvTWV0" +
"aG9kSGFuZGxlcwAhAAMABAAAAAAAAgABAAUABgABAAcAAAAdAAEAAQAAAAUq" +
"twABsQAAAAEACAAAAAYAAQAAAAUACQAJAA0AAQAHAAAAHAABAAAAAAAEsgAC" +
"sAAAAAEACAAAAAYAAQAAAAcAAgAOAAAAAgAPAAwAAAAKAAEACgAUAAsAGQ==";
public static void main(String[] args) throws Throwable {
byte[] array = Base64.getDecoder().decode(PROXY_CLASS);
Field theUnsafe = sun.misc.Unsafe.class.getDeclaredField("theUnsafe");
theUnsafe.setAccessible(true);
sun.misc.Unsafe unsafe = (sun.misc.Unsafe)theUnsafe.get(null);
Class<?> proxy = unsafe.defineAnonymousClass(java.lang.invoke.MethodHandles.class, array, null);
MethodHandle mh = MethodHandles.lookup().findStatic(proxy, "lookup", MethodType.methodType(Lookup.class));
Lookup trusted = (Lookup)mh.invokeExact();
System.out.println(trusted);
}
}
@mp911de
Copy link

mp911de commented Mar 1, 2017

FWIW: The base64 encoded class resolves to:

package java.lang.invoke;

public class LookupProxy {

    public LookupProxy() {
    }

    public static MethodHandles.Lookup lookup() {
        return MethodHandles.Lookup.IMPL_LOOKUP;
    }
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment