public static void genExploit(Object payload,String file) throws IOException {

        FileOutputStream fout = new FileOutputStream(file);
        SerializationContext context = new SerializationContext();
        AmfTrace trace = new AmfTrace();

        AmfMessageSerializer seri = new AmfMessageSerializer();
        seri.initialize(context, fout, trace);

        ActionMessage message = new ActionMessage(3);
        MessageBody body = new MessageBody();
        body.setData(payload);
        message.addBody(body);

        seri.writeMessage(message);

    }
 

@BeforeClass
public static void setup() {
    serverWrapper = new TestServerWrapper();
    serverPort = serverWrapper.startServer("classpath:/WEB-INF/flex/services-config.xml");
    if (serverPort == -1) {
        Assert.fail("Couldn't start server process");
    }

    AMFConnection.registerAlias(
            "remoting.amfclient.ServerCustomType" /* server type */,
            "remoting.amfclient.ClientCustomType" /* client type */);

    serializationContext = SerializationContext.getSerializationContext();
    ClassDeserializationValidator deserializationValidator =
            (ClassDeserializationValidator) serializationContext.getDeserializationValidator();
    deserializationValidator.addAllowClassPattern("remoting.amfclient.*");
}
 

/**
 * Constructor.
 * Construct an AmfxInput by passing in a <code>SerialziationContext</code> object
 *
 * @param context the <code>SerialziationContext</code> object
 */
public AmfxInput(SerializationContext context)
{
    this.context = context;

    stringTable = new ArrayList(64);
    objectTable = new ArrayList(64);
    traitsTable = new ArrayList(10);

    objectStack = new Stack();
    proxyStack = new Stack();
    arrayPropertyStack = new Stack();
    dictionaryStack = new Stack();
    strictArrayIndexStack = new Stack();
    ecmaArrayIndexStack = new Stack();
    traitsStack = new Stack();

    text = new StringBuffer(32);
}
 

/**
 * Translate an object to another object of type class.
 * obj types should be ASObject, Boolean, String, Double, Date, ArrayList
 */
public Object convert(Object source, Class desiredClass)
{
    if (source == null && !desiredClass.isPrimitive())
    {
        return null;
    }

    SerializationContext serializationContext = SerializationContext.getSerializationContext();

    ActionScriptDecoder decoder;
    if (serializationContext.restoreReferences)
        decoder = DecoderFactory.getReferenceAwareDecoder(source, desiredClass);
    else
        decoder = DecoderFactory.getDecoder(source, desiredClass);

    if (Trace.remote)
    {
        Trace.trace("Decoder for " + (source == null ? "null" : source.getClass().toString()) +
                " with desired " + desiredClass + " is " + decoder.getClass());
    }

    Object result = decoder.decodeObject(source, desiredClass);
    return result;
}
 

public Object decodeObject(Object shell, Object encodedObject, Class desiredClass)
{
    Object result = super.decodeObject(shell, encodedObject, desiredClass);

    // Only AMF 3 Dates can be sent by reference so we only
    // need to remember this translation to re-establish pointers
    // to the encodedObject if the incoming type was a Date object.
    if (result != null
            && SerializationContext.getSerializationContext().supportDatesByReference
            && encodedObject instanceof java.util.Date)
    {
        TypeMarshallingContext context = TypeMarshallingContext.getTypeMarshallingContext();
        context.getKnownObjects().put(encodedObject, result);
    }

    return result;
}
 

public Object decodeObject(Object shell, Object encodedObject, Class desiredClass)
{
    Object result = super.decodeObject(shell, encodedObject, desiredClass);

    // Only AMF 3 Dates can be sent by reference so we only
    // need to remember this translation to re-establish pointers
    // to the encodedObject if the incoming type was a Date object.
    if (result != null
            && SerializationContext.getSerializationContext().supportDatesByReference
            && encodedObject instanceof java.util.Date)
    {
        TypeMarshallingContext context = TypeMarshallingContext.getTypeMarshallingContext();
        context.getKnownObjects().put(encodedObject, result);
    }

    return result;
}
 

/**
 * {@inheritDoc}
 *
 * @see marshalsec.BlazeDSBase#marshal(java.lang.Object)
 */
@Override
public byte[] marshal ( Object o ) throws Exception {
    ByteArrayOutputStream bos = new ByteArrayOutputStream();
    SerializationContext sc = new SerializationContext();
    AmfMessageSerializer serializer = new AmfMessageSerializer();
    serializer.initialize(sc, bos, new AmfTrace());
    ActionMessage am = new ActionMessage(MessageIOConstants.AMF3);
    am.addHeader(new MessageHeader("payl", false, o));
    serializer.writeMessage(am);
    return bos.toByteArray();
}
 

/**
 * {@inheritDoc}
 *
 * @see marshalsec.BlazeDSBase#unmarshal(byte[])
 */
@Override
public Object unmarshal ( byte[] data ) throws Exception {
    SerializationContext sc = new SerializationContext();
    AmfMessageDeserializer deserializer = new AmfMessageDeserializer();
    deserializer.initialize(sc, new ByteArrayInputStream(data), new AmfTrace());
    ActionMessage am = new ActionMessage(MessageIOConstants.AMF3);
    ActionContext ac = new ActionContext();
    deserializer.readMessage(am, ac);
    return am.getHeader(0);
}
 

/**
 * {@inheritDoc}
 *
 * @see marshalsec.MarshallerBase#marshal(java.lang.Object)
 */
@Override
public byte[] marshal ( Object o ) throws Exception {
    SerializationContext sc = new SerializationContext();
    ByteArrayOutputStream bos = new ByteArrayOutputStream();
    AmfxMessageSerializer out = new AmfxMessageSerializer();
    out.initialize(sc, bos, null);
    ActionMessage m = new ActionMessage();
    m.addHeader(new MessageHeader("foo", false, o));
    out.writeMessage(m);
    return bos.toByteArray();
}
 

/**
 * {@inheritDoc}
 *
 * @see marshalsec.MarshallerBase#unmarshal(java.lang.Object)
 */
@Override
public Object unmarshal ( byte[] data ) throws Exception {
    SerializationContext sc = new SerializationContext();
    AmfxMessageDeserializer amfxMessageDeserializer = new AmfxMessageDeserializer();
    amfxMessageDeserializer.initialize(sc, new ByteArrayInputStream(data), null);
    ActionMessage m = new ActionMessage();
    amfxMessageDeserializer.readMessage(m, null);
    return m.getHeader(0).getData();
}
 

/**
 * {@inheritDoc}
 *
 * @see marshalsec.MarshallerBase#marshal(java.lang.Object)
 */
@Override
public byte[] marshal ( Object o ) throws Exception {
    SerializationContext sc = new SerializationContext();
    ByteArrayOutputStream bos = new ByteArrayOutputStream();
    try ( AbstractAmfOutput out = createOutput(sc) ) {
        out.setOutputStream(bos);
        out.writeObject(o);
        return bos.toByteArray();
    }
}
 

/**
 * {@inheritDoc}
 *
 * @see marshalsec.MarshallerBase#unmarshal(java.lang.Object)
 */
@Override
public Object unmarshal ( byte[] data ) throws Exception {
    SerializationContext sc = new SerializationContext();
    try ( AbstractAmfInput in = createInput(sc) ) {
        in.setInputStream(new ByteArrayInputStream(data));
        return in.readObject();
    }
}
 

/**
 * Convert Java Object to AMF3 protocol's byte[]
 *
 * @param msg Java object
 * @return return byte array see: {@link ByteBuf}.
 * @throws IOException          amf3 output exception.
 * @throws NullPointerException where the msg is Null, throw the NullPointerException.
 */
public static ByteBuf convertJavaObjToAmf3(Object msg) throws IOException {
    if (msg == null) {
        throw new NullPointerException("msg");
    }
    final ByteArrayOutputStream bout = new ByteArrayOutputStream();
    final Amf3Output op = new Amf3Output(SerializationContext.getSerializationContext());
    op.setOutputStream(bout);
    op.writeObject(msg);
    op.flush();
    op.close();
    return Unpooled.wrappedBuffer(bout.toByteArray());
}
 

@BeforeClass
public static void setup() {
    standardValidationServerWrapper = new TestServerWrapper();
    standardValidationServerPort = standardValidationServerWrapper.startServer("classpath:/WEB-INF/flex/services-config.xml");
    if (standardValidationServerPort == -1) {
        Assert.fail("Couldn't start server (standard validation) process");
    }

    customValidationServerWrapper = new TestServerWrapper();
    customValidationServerPort = customValidationServerWrapper.startServer("classpath:/WEB-INF/flex/services-config-customized-validation.xml");
    if(customValidationServerPort == -1) {
        Assert.fail("Couldn't start server (custom validation) process");
    }

    AMFConnection.registerAlias(
            "remoting.amfclient.ServerCustomType" /* server type */,
            "remoting.amfclient.ClientCustomType" /* client type */);

    serializationContext = SerializationContext.getSerializationContext();
    ClassDeserializationValidator deserializationValidator =
            (ClassDeserializationValidator) serializationContext.getDeserializationValidator();
    deserializationValidator.addAllowClassPattern("remoting.amfclient.*");
    serializationContext.createASObjectForMissingType = true;
    // Make sure collections are written out as Arrays (vs. ArrayCollection),
    // in case the server does not recognize ArrayCollections.
    serializationContext.legacyCollection = true;
    // When legacyMap is true, Java Maps are serialized as ECMA arrays
    // instead of anonymous Object.
    serializationContext.legacyMap = true;
    // Disable serialization of xml documents.
    serializationContext.allowXml = false;
}
 

public static void createThreadLocals()
{
    // allocate static thread local objects
    FlexContext.createThreadLocalObjects();
    SerializationContext.createThreadLocalObjects();
    TypeMarshallingContext.createThreadLocalObjects();
}
 

protected static void destroyThreadLocals()
{
    // clear static member variables
    Log.clear();
    MBeanServerLocatorFactory.clear();

    // Destroy static thread local objects
    FlexContext.releaseThreadLocalObjects();
    SerializationContext.releaseThreadLocalObjects();
    TypeMarshallingContext.releaseThreadLocalObjects();
}
 

/**
 * Constructs an <code>AbstractEndpoint</code> with the indicated management.
 *
 * @param enableManagement <code>true</code> if the <code>AbstractEndpoint</code>
 * is manageable; <code>false</code> otherwise.
 */
public AbstractEndpoint(boolean enableManagement)
{
    super(enableManagement);
    this.log = Log.getLogger(getLogCategory());
    serializationContext = new SerializationContext();
}
 

/**
 *
 */
public void setThreadLocals()
{
    if (serializationContext != null)
    {
        SerializationContext context = (SerializationContext)serializationContext.clone();
        // Get the latest deserialization validator from the broker.
        MessageBroker broker = getMessageBroker();
        DeserializationValidator validator = broker == null? null : broker.getDeserializationValidator();
        context.setDeserializationValidator(validator);
        SerializationContext.setSerializationContext(context);
    }

    TypeMarshallingContext.setTypeMarshaller(getTypeMarshaller());
}
 

/**
 * Establishes the context for reading in data from the given InputStream.
 * A null value can be passed for the trace parameter if a record of the
 * AMFX data should not be made.
 *
 * @param context SerializationContext object
 * @param in InputStream to process
 * @param trace AmfTrace object
 */
public void initialize(SerializationContext context, InputStream in, AmfTrace trace)
{
    amfxIn = new AmfxInput(context);
    this.in = in;

    debugTrace = trace;
    isDebug = debugTrace != null;

    if (debugTrace != null)
        amfxIn.setDebugTrace(debugTrace);
}
 

public AmfxOutput(SerializationContext context)
{
    super(context);

    objectTable = new IdentityHashMap(64);
    traitsTable = new HashMap(10);
    stringTable = new HashMap(64);
}
 

/**
 * Establishes the context for writing out data to the given OutputStream.
 * A null value can be passed for the trace parameter if a record of the
 * AMFX data should not be made.
 *
 * @param context The SerializationContext specifying the custom options.
 * @param out The OutputStream to write out the AMFX data.
 * @param trace If not null, turns on "trace" debugging for AMFX responses.
 */
public void initialize(SerializationContext context, OutputStream out, AmfTrace trace)
{
    amfxOut = new AmfxOutput(context);
    amfxOut.setOutputStream(out);
    debugTrace = trace;
    isDebug = debugTrace != null;
    amfxOut.setDebugTrace(trace);
    
}
 

public void initialize(SerializationContext context, OutputStream out, AmfTrace trace)
{
    amfOut = new Amf0Output(context);
    amfOut.setOutputStream(out);
    amfOut.setAvmPlus(version >= MessageIOConstants.AMF3);

    debugTrace = trace;
    isDebug = trace != null;
    amfOut.setDebugTrace(debugTrace);
}
 

protected boolean canUseByReference(Object o)
{
    if (o == null)
        return false;

    else if (o instanceof String)
        return false;

    else if (o instanceof Number)
        return false;

    else if (o instanceof Boolean)
        return false;

    else if (o instanceof Date)
    {
        return SerializationContext.getSerializationContext().supportDatesByReference;
    }

    else if (o instanceof Calendar)
        return false;

    else if (o instanceof Character)
        return false;

    return true;
}
 

/**
 * Construct a deserializer without connecting it to an input stream.
 * @param context serialization parameters.
 */
public AbstractAmfInput(SerializationContext context)
{
    super(context);

    readMaxStringBytes();
}
 

/**
 * Connects to the URL provided. Any previous connections are closed.
 *
 * @param connectUrl The url to connect to.
 *
 * @throws ClientStatusException If there is a client side exception.
 */
public void connect(String connectUrl) throws ClientStatusException
{
    SerializationContext serializationContext = new SerializationContext();
    serializationContext.createASObjectForMissingType = true;
    // Make sure collections are written out as Arrays (vs. ArrayCollection),
    // in case the server does not recognize ArrayCollections.
    serializationContext.legacyCollection = true;
    // When legacyMap is true, Java Maps are serialized as ECMA arrays
    // instead of anonymous Object.
    serializationContext.legacyMap = true;
    connect(connectUrl, serializationContext);
}
 

public void initialize(SerializationContext context, InputStream in, AmfTrace trace)
{
    amfIn = new Amf0Input(context);
    amfIn.setInputStream(in);

    debugTrace = trace;
    isDebug = debugTrace != null;
    amfIn.setDebugTrace(debugTrace);
}
 

public Amf3Input(SerializationContext context)
{
    super(context);

    stringTable = new ArrayList(64);
    objectTable = new ArrayList(64);
    traitsTable = new ArrayList(10);
}
 

/**
 * Construct a serializer without connecting it to an output stream.
 * @param context the context to use
 */
public Amf0Output(SerializationContext context)
{
    super(context);
    context.supportDatesByReference = false;

    serializedObjects = new IdentityHashMap(64);
}
 

@Before
public void setUp() throws Exception {
    ClassDeserializationValidator classDeserializationValidator = new ClassDeserializationValidator();
    classDeserializationValidator.addAllowClassPattern("flex.messaging.io.amfx.testtypes.*");
    serializationContext = new SerializationContext();
    serializationContext.setDeserializationValidator(classDeserializationValidator);
    SerializationContext.setSerializationContext(serializationContext);
    //trace = new AmfTrace();
}
 

public MessageGenerator() {
    super(new SerializationContext());
    DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance();
    docBuilderFactory.setIgnoringComments(true);
    docBuilderFactory.setIgnoringElementContentWhitespace(true);
    try {
        docBuilder = docBuilderFactory.newDocumentBuilder();
    } catch (ParserConfigurationException ex) {
        throw new RuntimeException(ex);
    }
}