public byte[] serialize(T o) throws SerializationException {
        if (o == null) {
            String msg = "argument cannot be null.";
            throw new IllegalArgumentException(msg);
        }
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        BufferedOutputStream bos = new BufferedOutputStream(baos);

        try {
            ObjectOutputStream oos = new ObjectOutputStream(bos);
            oos.writeObject(o);
            oos.close();
            baos.flush();
            return baos.toByteArray();
        } catch (IOException e) {
            String msg = "Unable to serialize object [" + o + "].  "
                    + "In order for the DefaultSerializer to serialize this object, "
                    + " the [" + o.getClass().getName() + "] class must implement java.io.Serializable.";
            throw new SerializationException(msg, e);
        }
    }
This implementation serializes the Object by using an {@link ObjectOutputStream} backed by a
{@link ByteArrayOutputStream}.  The {@code ByteArrayOutputStream}'s backing byte array is returned.

@param o the Object to convert into a byte[] array.
@return the bytes representing the serialized object using standard JVM serialization.
@throws SerializationException wrapping a {@link IOException} if something goes wrong with the streams.
lang/src/main/java/org/apache/shiro/lang/io/DefaultSerializer.java