如何在Java中热交换java.lang类

Question

I know it's not a good demand. But I need to do that now.

I need to replace the method of Class.getResourceAsStream(String)

But ClassLoader.preDefineClass(String , ProtectionDomain) checks whether the class name of the full name starts with java. , and if so, throws an exception and is not allowed to load.

Is there a way to bypass runtime security checks instead of compile time ?

Update

The real requirement is that many older projects need to migrate to new environments, because some of these projects may be out of date and some of them may not be able to find the source code. I am required to simulate the old environment in a new environment so that these ancient projects can continue to function.

Upadte (GhostCat)

I tried the way which you given.

ClassLoader Class

public class ClassLoaderTest extends ClassLoader {
    @Override
    public InputStream getResourceAsStream(String name) {
        System.out.println("getResourceAsStream " + name);
        return new ByteArrayInputStream(new byte[]{1, 3, 5, 7, 9});
    }
    @Override
    public Class<?> loadClass(String name) throws ClassNotFoundException {
        System.out.println("Load class " + name);
        String fileName = name.substring(name.lastIndexOf(".") + 1) + ".class";
        InputStream is = getClass().getResourceAsStream(fileName);

        if (is == null) {
            return super.loadClass(name);
        }

        byte[] b = new byte[0];
        try {
            b = new byte[is.available()];
            is.read(b);
        } catch (IOException e) {
            e.printStackTrace();
        }

        return defineClass(name, b, 0, b.length);
    }
}

Invoke Class

public static void main(String[] args) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException, InstantiationException {
    ClassLoaderTest classLoaderTest = new ClassLoaderTest();
    Class clazz = Class.forName("com.Client", true, classLoaderTest);
    Object client = clazz.newInstance();
    Method method = clazz.getDeclaredMethod("method");
    method.invoke(client);
}

Client Class

public class Client {
    public void method() {
        System.out.println(this.getClass().getResourceAsStream("aaa"));
        System.out.println(Class.class.getResourceAsStream("bbb"));
        System.out.println("".getClass().getResourceAsStream("ccc"));
    }
}

It really works with this.getClass().getResourceAsStream(String) , but Class.class.getResourceAsStream(String) / "".getClass().getResourceAsStream(String) . Because I cannot load class using my custom ClassLoader which name start with java.

Answer 1

You can't.

This class gets loaded by the bootstrap class loader. And you can't change what this guy is doing - it is written in native code. In other words: this is at the core of the JVM - and you are not allowed to tamper with that.

That is the "whole idea" of that the java security concept: the user can't "get" into things that are guaranteed by the JVM platform.

Given the edit by the OP that this is about legacy code: it seems that you want to hook into Class.getResourceAsStream(String) for classes that are not part of the JVM - but that belong to your own code.

If that is the case, then the "answer" is simply: you have to make sure that all your classes are loaded by your class loader. The javadoc for getResourceAsStreeam() clearly states:

Finds a resource with a given name. The rules for searching resources associated with a given class are implemented by the defining class loader of the class. This method delegates to this object's class loader.

Thus: learn how to use a custom classloader. Start here for example.

Answer 2

Throwing an exception for attempts to define classes with a qualified name starting with java. , is part of the contract of defineClass , but that's irrelevant. Any attempt to define a class with the name of an existing class on a ClassLoader can only have one of two possible results:

1. If the existing class has been defined by the same ClassLoader , attempting to define it again will be rejected and an exception will be thrown. defineClass does not change existing classes, that's simply not within its functionality.

2. If the existing class has been loaded by a different ClassLoader (or the bootstrap loader), you may define a class with the same qualified name on this ClassLoader , but it will be an entirely different class, unrelated to the class with the same name but a different defining class loader.

The fact that you can not define such classes with the same name and a different loader for java.* classes is just an additional limitation, but your attempt wouldn't work anyway.

If you want to replace the class ClassLoader after it has been loaded, you can only use an Agent, eg a Java Agent using the Instrumentation API , or a debugger. Alternatively, you can simply add your own version to the bootstrap class path using the -Xbootclasspath/p:… command line option.

Of course replacing it with a specific version only works in the environment, from which this version has been derived. Also such applications are not allowed to be publicly deployed.

A more general solution would be an Instrumentation Agent using the current version of ClassLoader and modify it on-the-fly, however, if you have to option of developing a byte code transforming Agent, it would be much easier and more reliable to transform the application code instead, just replacing all invocations of Class.getResourceAsStream(String) with an invocation of a custom method, without touching code not needing such adaptation.

Answer 3

I wrote a longish answer on how to implement runtime class transforms here: how to retransform a class at runtime

An easier way would be my retransformer project at https://github.com/nickman/retransformer which will transform java.* classes, including native methods. (I used it to modify Runtime.availableProcessors )