JAVA反序列化的简单探究

本文主要是探究，在反序列化过程中是怎么调用到readObject、readResolve、readExternal方法的问题

新建一个需要被序列化的类ObjectA，写入readResolve和readObject方法：

package com.yy.serialize.readResolve;

import java.io.IOException;

import java.io.Serializable;

public class ObjectA implements Serializable {

    private ObjectA() {

    }

    private static final ObjectA objectA = new ObjectA();

    public static ObjectA getInstance() {

        return objectA;

    }

    private Object readResolve() {

        System.out.println("执行了readResolve方法");

        return objectA;

    }

    private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException {

        //执行默认的readObject()方法

        in.defaultReadObject();

        System.out.println("执行了readObject方法");

    }

}

另一个类ObjectB则写入了readExternal方法：

package com.yy.serialize.readResolve;

import java.io.Externalizable;

import java.io.IOException;

import java.io.ObjectInput;

import java.io.ObjectOutput;

public class ObjectB implements Externalizable {

    @Override

    public void writeExternal(ObjectOutput out) throws IOException {

        System.out.println("执行了writeExternal");

    }

    @Override

    public void readExternal(ObjectInput in) throws IOException, ClassNotFoundException {

        System.out.println("执行了readExternal");

    }

}

测试类：

package com.yy.serialize.readResolve;

import java.io.*;

public class SerializeDemo {

    public static void main(String[] args) throws Exception {

        ObjectA objectA = ObjectA.getInstance();

        ObjectB objectB = new ObjectB();

        // 序列化

        FileOutputStream fos = new FileOutputStream("a.txt");

        ObjectOutputStream oos = new ObjectOutputStream(fos);

        oos.writeObject(objectA);

        oos.flush();

        // 反序列化

        FileInputStream fis = new FileInputStream("a.txt");

        ObjectInputStream ois = new ObjectInputStream(fis);

        ois.readObject();

    }

}

运行测试类生成a.txt文件后，可以使用SerializationDumper查看字节流的数据：

这里有两个关键的标识

TC_OBJECT：标记后面的数据为Object对象

TC_CLASSDESC：类描述符标识，表示一个类中的所有信息

    TC_CLASSDESC - 0x72

      className

        Length - 36 - 0x00 24

        Value - com.yy.serialize.readResolve.ObjectA - 0x636f6d2e79792e73657269616c697a652e726561645265736f6c76652e4f626a65637441

      serialVersionUID - 0xee 44 c6 e6 0d b3 64 b5

      newHandle 0x00 7e 00 00

      classDescFlags - 0x02 - SC_SERIALIZABLE

      fieldCount - 0 - 0x00 00

      classAnnotations

        TC_ENDBLOCKDATA - 0x78

      superClassDesc

        TC_NULL - 0x70