【技能库】--Unsafe 调戏String (intern) (201)

本文链接：https://blog.youkuaiyun.com/qfzhangwei/article/details/71775460

本文介绍如何利用Java反射机制和Unsafe类直接操作字符串内部的char数组，实现字符串的修改，并展示了完整的示例代码及其运行结果。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

1 通过反射获取unsafe实例

2 获取char[]数组变量偏移地址
3 获取实例char[]

4 unsafe --> (arrayBaseOffset)第一个元素位置和每个元素大小(arrayIndexScale) 修改数组

5 代码如下

    public static Unsafe getUnsafeInstance() throws Exception{
        Field unsafeStaticField =
                Unsafe.class.getDeclaredField("theUnsafe");
        unsafeStaticField.setAccessible(true);
        return (Unsafe) unsafeStaticField.get(Unsafe.class);
    }
	
    public static void main(String[] args) throws Exception {	    
		String s = "abc";
//      s.intern();//JDK 8 自动
        String s1 = "abc";
        Unsafe u = getUnsafeInstance();

//获取变量value
        Field valueInString = String.class.getDeclaredField("value");
//获取value的变量偏移值
        long offset = u.objectFieldOffset(valueInString);
//获取value
        char[] values = (char[]) u.getObject(s1, offset);


//value本身是一个char[],要修改它元素的值，仍要获取baseOffset和indexScale
        long base = u.arrayBaseOffset(char[].class);

        long scale = u.arrayIndexScale(char[].class);
//为value赋值
        u.putChar(values, base + scale, 'c');
        System.out.println("s:"+s+" s1:"+s1);

        String s2 = "abc";

        System.out.println("s="+s+" s1="+s1+" s2="+s2);
	}

结果

s:acc s1:acc
s=acc s1=acc s2=acc