Binary patching of Java classes for fun and profit. Jfokus 2011, Stockholm



Similar documents
ASM 4.0 A Java bytecode engineering library. Eric Bruneton

CSE 308. Coding Conventions. Reference

Java Crash Course Part I

Recent Java exploitation trends and malware

All Your Code Belongs To Us Dismantling Android Secrets With CodeInspect. Steven Arzt Secure Software Engineering Group Steven Arzt 1

WebSphere v5 Administration, Network Deployment Edition

Instrumenting Java bytecode

Performance Monitoring API for Java Enterprise Applications

Android Packer. facing the challenges, building solutions. Rowland YU. Senior Threat Researcher Virus Bulletin 2014

Chapter 1. JOnAS and JMX, registering and manipulating MBeans

Introduction to programming

Installing Java (Windows) and Writing your First Program

Kohsuke Kawaguchi Sun Microsystems, Inc. hk2.dev.java.net, glassfish.dev.java.net. Session ID

The Java Series. Java Essentials I What is Java? Basic Language Constructs. Java Essentials I. What is Java?. Basic Language Constructs Slide 1

Web Application Access Control with Java SE Security

Java History. Java History (cont'd)

OpenOffice.org Extensions development in Java with NetBeans in practise. Jürgen Schmidt OpenOffice.org Sun Microsystems, Inc.

Module 13 Implementing Java EE Web Services with JAX-WS

Tutorial 5: Developing Java applications

WHAT ARE PACKAGES? A package is a collection of related classes. This is similar to the notion that a class is a collection of related methods.

Hadoop WordCount Explained! IT332 Distributed Systems

ZeroTurnaround License Server User Manual 1.4.0

WRITING DATA TO A BINARY FILE

HP AppPulse Mobile. Adding HP AppPulse Mobile to Your Android App

Smartphone Security for Android Applications

JAVA r VOLUME II-ADVANCED FEATURES. e^i v it;

JAAS Java Authentication and Authorization Services

An Overview of Java. overview-1

jmonitor: Java Runtime Event Specification and Monitoring Library

02 B The Java Virtual Machine

Introduction to Object-Oriented Programming

CS170 Lab 11 Abstract Data Types & Objects

Developing a Web Server Platform with SAPI Support for AJAX RPC using JSON

Install Java Development Kit (JDK) 1.8

Problem Solving. Software Engineering. Behavior. OCD in a Nutshell. Behavior. Objects Operations Algorithm. Object-Centered Design

matsimj An Overview of the new MATSim Implementation in Java Marcel Rieser VSP, TU Berlin

Eclipse Rich Client Platform. Kai Tödter Karsten Becker et al. Organized by:

Continuous Integration Part 2

CS 106 Introduction to Computer Science I

Comparing the Effectiveness of Penetration Testing and Static Code Analysis

Web-Service Example. Service Oriented Architecture

Chapter 1 Java Program Design and Development

AVRO - SERIALIZATION

Amazon Glacier. Developer Guide API Version

How To Run A Test File Extension On A Rexx (Unix) On A Microsoft Linux (Amd64) (Orchestra) (For Windows) (

Aspect Oriented Programming. with. Spring

Light and Dark side of Code Instrumentation. Dmitriy D1g1 Evdokimov DSecRG, Security Researcher

EJB 3.0 and IIOP.NET. Table of contents. Stefan Jäger / stefanjaeger@bluewin.ch

Handout 1. Introduction to Java programming language. Java primitive types and operations. Reading keyboard Input using class Scanner.

RE-TRUST Design Alternatives on JVM

Introduction to NaviGenie SDK Client API for Android

Java Web Services SDK

The Java Virtual Machine (JVM) Pat Morin COMP 3002

Using jvmstat and visualgc to Solve Memory Management Problems

ID TECH UniMag Android SDK User Manual

Under the Hood: The Java Virtual Machine. Lecture 24 CS 2110 Fall 2011

An Android-based Instant Message Application

Habanero Extreme Scale Software Research Project

Programming in Python. Basic information. Teaching. Administration Organisation Contents of the Course. Jarkko Toivonen. Overview of Python

Introduction to Java

Example of a Java program

Introduction to Java. CS 3: Computer Programming in Java

How To Write A Program In Java (Programming) On A Microsoft Macbook Or Ipad (For Pc) Or Ipa (For Mac) (For Microsoft) (Programmer) (Or Mac) Or Macbook (For

Production time profiling On-Demand with Java Flight Recorder

JavaSnoop: How to hack anything in Java

Customizing the Security Architecture

Java Language Tools COPYRIGHTED MATERIAL. Part 1. In this part...

Word Count Code using MR2 Classes and API

Programming Languages

Custom Encryption in Siebel & Siebel Web Service Security Test Guide 1.0

Topics. Introduction. Java History CS 146. Introduction to Programming and Algorithms Module 1. Module Objectives

MarkLogic Server. Java Application Developer s Guide. MarkLogic 8 February, Copyright 2015 MarkLogic Corporation. All rights reserved.

The Java Virtual Machine and Mobile Devices. John Buford, Ph.D. Oct 2003 Presented to Gordon College CS 311

CSCI E 98: Managed Environments for the Execution of Programs

Word count example Abdalrahman Alsaedi

Getting to know Apache Hadoop

JAVA API FOR XML WEB SERVICES (JAX-WS)

Chapter 2 Introduction to Java programming

Mobile Application Languages XML, Java, J2ME and JavaCard Lesson 04 Java

Messing with the Android Runtime

Creating a 2D Game Engine for Android OS. Introduction

Many applications consist of one or more classes, each containing one or more methods. If you become part of a development team in industry, you may

Testing Providers with PyWBEM

e(fx)clipse - JavaFX Tooling and Runtime

Experimental Evaluation of Distributed Middleware with a Virtualized Java Environment

Manual. Programmer's Guide for Java API

Mobile Application Development Android

Arjun V. Bala Page 20

A generic framework for game development

Tutorial Reference Manual. Java WireFusion 4.1

Transcription:

Binary patching of Java classes for fun and profit Jfokus 2011, Stockholm

whoami Anton Arhipov ZeroTurnaround JRebel http://arhipov.blogspot.com @antonarhipov @javarebel

What s Binary Patching? Ninja.class 10101010101 11000101010 10101010001 00010001110 11011101011 Ninja.class 10101010101 11100001010 10101010001 00010001110 11011101110

Why Binary Patching? ClassLoader MyClass.class New code: 1001010010010 0101011001010 JRebel agent MyObject

Framework Why Binary Patching? ClassLoader MyClass.class New code: 1001010010010 0101011001010 JRebel agent MyObject

Framework Why Binary Patching? ClassLoader MyClass.class New code: 1001010010010 0101011001010 JRebel agent MyObject Configuration (XML, annotations)

How? Using javaagent to hook into class loading process Using bytecode manipulation libraries (e.g. Javassist)

java.lang.instrument import java.lang.instrument.classfiletransformer; import java.lang.instrument.instrumentation; public class Agent { public static void premain(string args, Instrumentation inst) throws Exception { inst.addtransformer(new ClassFileTransformer { );

java.lang.instrument import java.lang.instrument.classfiletransformer; import java.lang.instrument.instrumentation; public class Agent { META-INF/MANIFEST.MF Agent-Class: Agent public static void premain(string args, Instrumentation inst) throws Exception { inst.addtransformer(new ClassFileTransformer { );

java.lang.instrument import java.lang.instrument.classfiletransformer; import java.lang.instrument.instrumentation; public class Agent { META-INF/MANIFEST.MF Agent-Class: Agent public static void premain(string args, Instrumentation inst) throws Exception { inst.addtransformer(new ClassFileTransformer { ); java javaagent:agent.jar

java.lang.instrument + Javassist new ClassFileTransformer() { public byte[] transform(classloader loader, String classname, Class<?>classBeingRedefined, ProtectionDomain protectiondomain, byte[] classfilebuffer){

java.lang.instrument + Javassist new ClassFileTransformer() { public byte[] transform(classloader loader, String classname, Class<?>classBeingRedefined, ProtectionDomain protectiondomain, byte[] classfilebuffer){ ClassPool cp = ClassPool.getDefault(); CtClass ct = pool.makeclass(new ByteArrayInputStream(classfileBuffer));

java.lang.instrument + Javassist new ClassFileTransformer() { public byte[] transform(classloader loader, String classname, Class<?>classBeingRedefined, ProtectionDomain protectiondomain, byte[] classfilebuffer){ ClassPool cp = ClassPool.getDefault(); CtClass ct = pool.makeclass(new ByteArrayInputStream(classfileBuffer)); transformclass(ct, cp);

java.lang.instrument + Javassist new ClassFileTransformer() { public byte[] transform(classloader loader, String classname, Class<?>classBeingRedefined, ProtectionDomain protectiondomain, byte[] classfilebuffer){ ClassPool cp = ClassPool.getDefault(); CtClass ct = pool.makeclass(new ByteArrayInputStream(classfileBuffer)); transformclass(ct, cp); return ct.tobytecode();

JRebel SDK

Javassist + JRebel cp.importpackage("org.zeroturnaround.javarebel");

Javassist + JRebel cp.importpackage("org.zeroturnaround.javarebel"); ct.addinterface( cp.get(classeventlistener.class.getname()));

Javassist + JRebel cp.importpackage("org.zeroturnaround.javarebel"); ct.addinterface( cp.get(classeventlistener.class.getname())); ct.addmethod(ctnewmethod.make( "public void onclassevent(int eventtype, Class clazz) {"+ "cache.evict();" + "", ct));

Javassist + JRebel CtClass ct = CtConstructor[] cs = ct.getconstructors();

Javassist + JRebel CtClass ct = CtConstructor[] cs = ct.getconstructors(); for (CtConstructor c : cs) { if (c.callssuper()) { c.insertafter("reloaderfactory.getinstance().addclassreloadlistener($0);");

Javassist + JRebel CtClass ct = ct.getdeclaredmethod("service").insertbefore( "ReloaderFactory.getInstance().checkAndReload(Application.class);");

Integration Highlights Implement ClassEventListener Register listener instance to JRebel ReloaderFactory#addClassReloadListener( ); Trigger the re-load event ReloaderFactory#checkAndReload( );

Pros/Cons

Pros/Cons

Pros/Cons

Thx! Want JRebel free? Come to our booth!