手把手教你写一个 Java Agent，实现 “免费激活”- 今日头条

1
2
3
4
5
6
7
8
9

import java.lang.instrument.Instrumentation;

public class Agent {
  public static void premain(String args, Instrumentation instrumentation){
    ClassLoggerTransformer transformer = new ClassLoggerTransformer();
    instrumentation.addTransformer(transformer);
  }
}
复制代码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

public interface ClassFileTransformer {
    byte[]
    transform(  ClassLoader         loader,
                String              className,//className，全类名（包括路径，"/"分割）
                Class<?>            classBeingRedefined,//类定义转换时的Class对象，初始加载时为空
                ProtectionDomain    protectionDomain,//protection...
                byte[]              classfileBuffer)//加载的Class字节码数据
        throws IllegalClassFormatException;
}

复制代码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

public class ClassLoggerTransformer implements ClassFileTransformer {
    
    //返回值是替换的字节码数据
  @Override
  public byte[] transform(ClassLoader loader,
                          String className,
                          Class<?> classBeingRedefined,
                          ProtectionDomain protectionDomain,
                          byte[] classfileBuffer) throws IllegalClassFormatException {
    try {
      Path path = Paths.get("classes/" + className + ".class");
      //将字节码数据classfileBuffer，存储到classes目录下，以.class文件作为后缀
      Files.write(path, classfileBuffer); 
    } catch (Throwable ignored) { // ignored, don’t do this at home kids
    } finally { return classfileBuffer; }
  }
}
复制代码

1
2
3
4
5

Manifest-Version: 1.0
Premain-Class: com.github.kongwu.agentsamples.firstagent.Agent//Agent Class的全类名
Can-Redefine-Classes: true //允许重新定义
Can-Retransform-Classes: true //允许运行时转换
复制代码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-jar-plugin</artifactId>
  ...
  <configuration>
    <archive>
      <manifestFile>src/main/resources/META-INF/MANIFEST.MF</manifestFile>
    </archive>
  </configuration>
  ...
</plugin>
复制代码

1
2
3
4
5
6
7
8

# 随便找个项目，或者可执行的jar包

# 默认的启动方式，直接java -jar
java -jar first-app.jar

# 启动时添加我们刚才构建的first-agent.jar
java -javaagent:/path/to/first-agent.jar -jar first-app.jar
复制代码

1
2
3
4
5
6
7
8
9

public boolean verifyLicense(String encryptedLicense){
	//请求服务器验证许可……
    boolean passed = licenseServer.verifyLicense(encryptedLicense);
    if(!passed){
    	//do sth
    }
    return passed;
}
复制代码

1
2
3
4
5

public boolean verifyLicense(String encryptedLicense){
    //修改后，直接返回true
	return true;
}
复制代码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

import java.io.IOException;
import java.io.InputStream;
import java.lang.instrument.ClassFileTransformer;
import java.lang.instrument.IllegalClassFormatException;
import java.security.ProtectionDomain;

public class HackVerifierClassFileTransformer implements ClassFileTransformer {

    @Override
    public byte[] transform(ClassLoader loader, String className, Class<?> classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) throws IllegalClassFormatException {
        //只替换这个验证的类 - LicenseVerifier
        if(className.equals("com/github/kongwu/agentsamples/firstagent/verifierapp/LicenseVerifier")){
            return loadHackClassBuffer(loader);
        }
        return null;
    }

    private byte[] loadHackClassBuffer(ClassLoader loader) {
        //反编译 -> 修改 -> 重新编译的LicenseVerifier.class 文件，换个后缀防止被JVM自动加载
        try (InputStream input = loader.getResourceAsStream("LicenseVerifier.classdata")){
            int n;
            ByteArrayOutputStream outputBuffer = new ByteArrayOutputStream();
            byte[] buffer = new byte[4096];//4k
            //-1 : end of file
            while (-1 != (n = input.read(buffer))) {
                outputBuffer.write(buffer,0,n);
            }
            return outputBuffer.toByteArray();
        }catch (IOException e){
            System.err.println("load the hackfile failed!");
            return null;
        }
    }
}
复制代码

1
2
3
4
5
6
7
8
9

import java.lang.instrument.Instrumentation;

public class Agent {
  public static void premain(String args, Instrumentation instrumentation){
    HackVerifierClassFileTransformer transformer = new HackVerifierClassFileTransformer();
    instrumentation.addTransformer(transformer);
  }
}
复制代码

1
2
3
4
5
6

# 默认的启动方式，直接java -jar
java -jar verifier-app.jar

# 启动时添加我们刚才构建的agent.jar
java -javaagent:/path/to/hack-agent.jar -jar verifier-app.jar
复制代码