klassptr：版本对比 v1 → v2
v1（2026-10-03 23:13，zy）→ v2（2026-10-03 23:59，mcst12345）
共 13 行变更 · 新增 9 行 · 删除 1 行（左右分栏：左为旧版本，右为新版本）
| ⋯ 省略 5 行未变内容 ⋯ | |||
| 6 | {{#F9D949|"}"}} {{#AADAFB|_metadata}}; | 6 | {{#F9D949|"}"}} {{#AADAFB|_metadata}}; |
| 7 | {{#F9D949|"}"}}; | 7 | {{#F9D949|"}"}}; |
| 8 | oopDesc是每一个java对象头部都有的结构，_metadata这个联合体保存的就是java对象的类型，所以通过更改_metadata可以控制java对象的行为 | ||
| 8 | |||
| 9 | oopDesc是每一个java对象头部都有的结构，_metadata这个联合体保存的就是java对象的类型，所以通过更改_metadata可以控制java对象的行为。 | ||
| 10 | |||
| 11 | oopDesc is part of the metadata of a Java object. Field _klass (or _compressed_klass depending on the environment) stores the type of the object. Change it can spoof the JVM of the object's type. For example | ||
| 12 | |||
| 13 | <code>Unsafe unsafe = getUnsafe(); Object o = new Object(); unsafe.putInt(o,8L,unsafe.getInt(new ArrayList<>(),8L)); System.out.println(o.getClass());</code> | ||
| 14 | should print "class java.util.ArrayList". | ||
| 15 | **Sorry but I can't figure out how to nextline inside <code> block in this wiki | ||
| 16 | Unfortunately, changing an object's klass metadata is an undefined behaviour which will corrupt the gc state that it can easily crash JVM. I personally don't recommend anyone to use it. | ||