.SER

Introduction

Java object serialisation is the built-in way for a Java program to turn objects into bytes and back, using ObjectOutputStream and ObjectInputStream. It has been part of Java since version 1.1. Files that hold such a stream are often named .ser, and the same bytes travel over the network in Java RMI and in many older enterprise systems.

Reading a stream creates objects of whatever classes it names, and some of those classes run code as they are rebuilt. Deserialising data from an untrusted source has led to many serious security holes, so it should be avoided or strictly filtered.

Structure

A stream starts with the magic number AC ED and the version 00 05. After that comes a run of items, each started by a type code byte, such as 73 for a new object, 72 for a class description, 74 for a string, 75 for an array and 71 for a reference back to an object already written. Numbers are big-endian.

A class description gives the class name, a 64-bit serial version number and the name and type of each field. The object’s field values follow, for each class from the top of its inheritance chain down, and objects already in the stream are referred to by number.

Links