Java

A two-stage Java AOT-cache app whose integrity hash covers bytecode and pointers but not the archived heap — patching the pre-resolved heap String redirects the image directory and reads /flag.

Reversing a Javalin app whose real password validator lives in an AOT/CDS cache that overrides the jar — dumping the loaded class with the HotSpot Serviceability Agent unlocks a file-read to /flag.