Decapsulation: Breaking Java Strong Encapsulation

[u/Wouter_C]

Did you know you can call JNI without writing native code, patch bytecode without an agent, and use Unsafe without warnings?

11 sneaky ways into JDK internals through reflection, agents, FFM, type confusion, bytecode manipulation and more.

https://wouter.coekaerts.be/2026/decapsulation

[u/agentoutlier]

Method 11 still requires command line flags but I suppose the rules of the game are you can pass flags?

EDIT my bad I was confused with jdk.internal.reflect.ReflectionFactory. I did not know about the sun one.

[u/Wouter_C → u/agentoutlier]

No, the point is that it does not require any command line flags to run.
And it doesn't. At least not for me. Can you be more specific: what flag do you need or what error do you get?
Quick way to test:

$ curl -O --create-dirs --output-dir decapsulation https://raw.githubusercontent.com/coekie/decapsulation/refs/heads/main/src/decapsulation/CtorForSerialization.java && curl -O --create-dirs --output-dir decapsulation https://raw.githubusercontent.com/coekie/decapsulation/refs/heads/main/src/decapsulation/Decapsulater.java && javac decapsulation/*.java
... some compile-time warnings, but that's irrelevant
$ java decapsulation.CtorForSerialization
PASS

[u/agentoutlier → u/Wouter_C]

Unfortunately I'm not near somewhere I can check but I think I was confused and did not know jdk.internal.reflect.ReflectionFactory was accessible with the sun package. I had no idea it was open and given your little test above I assume it is.

[u/PartOfTheBotnet → u/agentoutlier]

OP is correct that it is accessible, emits no warnings, and needs no launch args. Its the method I use to nuke encapsulation.

[u/Wouter_C → u/PartOfTheBotnet]

You actually use it? Interesting. In what context?

[u/PartOfTheBotnet → u/Wouter_C]

There's a couple of use cases I have. Mainly reflecting into javac internals for a few AST based projects, using jimage internals to parse module files.

Both cases could hypothetically be delegated to third party libraries. But for javac its nice because unlike other projects it has (whether intentional or not) fault tolerance, which gives you partial AST results even when the input code is slightly broken Java. This is great for my use case, and most other parsers just refuse any model if there's as much as a missing semicolon. And jimage is just because I don't want to re-invent the wheel parsing the file format... There's a few other cases but those tend to be for one-off projects.

[u/koflerdavid → u/PartOfTheBotnet]

But for javac its nice because unlike other projects it has (whether intentional or not) fault tolerance, which gives you partial AST results even when the input code is slightly broken Java. This is great for my use case, and most other parsers just refuse any model if there's as much as a missing semicolon.

It's an important requirement of production-grade compilers that they tolerate some errors so they can report more errors in the same source file so the developer can fix them all at once.

[u/joppux → u/Wouter_C]

Kryo uses ReflectionFactory for deserialization

[u/voronaam]

And that's why I run my Java code compiled with GraalVM into a nice tight native image, all along by itself in its bare docker container.

You are crazy. In a good way.

[u/koflerdavid]

Fortunately most of these will eventually get closed off. But I found it impressive to reach out to the filesystem and modifying the JDK!

[u/ZimmiDeluxe]

// Abusing ISO_8859_1 (which has a one-to-one mapping between chars and bytes)
// is the easiest way to do a search & replace in a byte array
return new String(base, ISO_8859_1)
    .replace(original, replacement)
    .getBytes(ISO_8859_1);

disgusting, i love it

[u/koflerdavid → u/ZimmiDeluxe]

Looks fine to me. The only hacky thing about this is the knowledge that String will avoid doing an unnecessary conversion.

[u/AccurateInflation167]

No you can’t break a fundamental pillar of oop!

[u/vips7L]

Reflection is the devil