Hi Xinxing, thanks for your kind words. It generally doesn’t matter what the intended object type is or if you can get a hold of the source code or not. As long as it’s a serialized object that you can control, it’s worth testing out. Although if you can’t read the source code, exploitation would require more time and effort once the vulnerability is confirmed.