背景

旧方法

柳暗

花明

public final class Class<T> {    private transient ClassLoader classLoader;    private transient Class<?> componentType;    private transient Object dexCache;    private transient ClassExt extData;    private transient Object[] ifTable;    private transient Class<? super T> superClass;    private transient Object vtable;    private transient long iFields;    private transient long methods;    private transient long sFields;    private transient int accessFlags;    private transient int classFlags;    //还有其他成员，这里就写了}

class Class {  // Pointer to an ArtMethod length-prefixed array. All the methods where this class is the place  // where they are logically defined. This includes all private, static, final and virtual methods  // as well as inherited default methods and miranda methods.  //  // The slice methods_ [0, virtual_methods_offset_) are the direct (static, private, init) methods  // declared by this class.  //  // The slice methods_ [virtual_methods_offset_, copied_methods_offset_) are the virtual methods  // declared by this class.  //  // The slice methods_ [copied_methods_offset_, |methods_|) are the methods that are copied from  // interfaces such as miranda or default methods. These are copied for resolution purposes as this  // class is where they are (logically) declared as far as the virtual dispatch is concerned.  //  // Note that this field is used by the native debugger as the unique identifier for the type.  uint64_t methods_;};

inline LengthPrefixedArray<ArtMethod>* Class::GetMethodsPtr() {  return reinterpret_cast<LengthPrefixedArray<ArtMethod>*>(      static_cast<uintptr_t>(GetField64(OFFSET_OF_OBJECT_MEMBER(Class, methods_))));}

template<typename T>class LengthPrefixedArray {  static size_t OffsetOfElement(size_t index,                                size_t element_size = sizeof(T),                                size_t alignment = alignof(T)) {    DCHECK_ALIGNED_PARAM(element_size, alignment);    return RoundUp(offsetof(LengthPrefixedArray<T>, data_), alignment) + index * element_size;  }  T& AtUnchecked(size_t index, size_t element_size, size_t alignment) {    return *reinterpret_cast<T*>(        reinterpret_cast<uintptr_t>(this) + OffsetOfElement(index, element_size, alignment));  }  uint32_t size_;  uint8_t data_[0];};

public abstract class Executable {    /**     * @hide - exposed for use by {@code java.lang.invoke.*}.     */    public final long getArtMethod() {        return artMethod;    }}

public abstract class MethodHandle {  //其他成员...  /** @hide */ protected final long artFieldOrMethod;}

稳定性分析

源码

• 2021南极动物厂游戏高赛竞赛决赛分析01

• 2021南极动物厂游戏高赛竞赛决赛分析02
  

• 理解frame faking 栈迁移+例题详解(含图示)

• 关于谷歌P0的AppContainer逃逸的一种简单的复现
  

• MS12-027及利用样本分析

• EFS Web Server 7.2远程代码执行漏洞分析

• FTPServer的Fuzzing