Class File Analysis

Java source code and class files

Source code:

package classloader;public class TestCase {private int value;public int test(){return value++;}}

The class file opened by using editplus decompressing through hex Viewer:

　

 

Class file composition:

1. 00000000 ~ 00000003 (U4 0xca Fe ba be) magic number

2. 00000004 ~ 00000005 (U2 0x00) minor version number minor version

3. 00000006 ~ 00000007 (U2 0x00 34) Main version major version. The main version number and minor version number indicate that this class file is compiled by JDK.

4. 00000008 ~ 00000009 (U2 0x00 13) constant pool capacity Count value constant_pool_count, and this capacity count starts from 1.

0x0013 corresponds to 19 in decimal format. Because it is counted from 1, the number in the constant pool should be 19-1 = 18, use the javap-V command to check that the number of constant pools is exactly 18

Figure 1. testcase. Class file bytecode Information

　　　　

5. 0000000a (U1 0a)

By querying table 3 in another article, we can see that 0x0a corresponds to the symbolic reference (constant_methodref_info) of methods in the class)

6. 000b ~ 0000000c (U2 0x00 04)

Point to the index item of the class descriptor constant_class_info of the declaration method. from figure 1, we can see that the index in the constant pool is #1 = the class index location corresponding to methdref is #4, the hexadecimal value is 0x0004.

7. 0000000d ~ 0000000e (U2 0x00 0f)

Point to the index item of the name and type descriptor constant_name_type. from figure 1, we can see that the index in the constant pool is #1 = the class index corresponding to methdref is unknown #15, the hexadecimal value is 0x000f.

8. 0000000f (U1 0x09): by querying table 3 and table structure type in constant pool, 0x09 corresponds to the symbol reference of fields in the class.

9. 00000010 ~ 00000011 (U2 0x00 03)

Point to the index item of the class descriptor constant_class_info of the declaration method. from figure 1, we can see that the index in the constant pool is #2 = the class index location corresponding to fieldref is #3, the hexadecimal value is 0x0002.

10, 00000012 ~ 00000013 (U2 0x00 10)

Point to the index item of the name and type descriptor constant_name_type. from figure 1, we can see that the index in the constant pool is #2 = the class index corresponding to fieldref is unknown #16, the hexadecimal value is 0x0010.

11. 00000014 ~ 00000016 (u1 + U2 0x07 00 11)

By querying table 3 and table structure type in the constant pool, we can see that 07 corresponds to a class or interface symbol reference 0011 pointing to an index with a fully qualified name (0x0011 = 17)

12. 00000017 ~ 00000019 (u1 + U2 0x07 00 12)

By querying table 3 and table structure type in the constant pool, we can see that 07 corresponds to the class or interface symbol reference 0012 pointing to the fully qualified name index (0x0012 = 18)

13. 10000001a ~ 00000021 (u1 + u2 + U2 * U1 0x01 00 05 76 61 6C 75 65)

Mark 01 corresponding to the Utf-8 type constant, through the table 4, constant table in the various table structure known, UTF-8 type constant structure is (TAG + Length + bytes ), so length (00 05) = 5, so 76 61 6C 75 65 corresponds to the value field, that is, this constant represents the variable value.

14. 00000022 ~ 00000077

This represents the constant pool #5 ~ # Constants of 14, which are not described here

15. 00000078 ~ 0000007c (u1 + u2 + U2 0x0c 0007 0008)

Table 3 shows the constant_nameandtype_info corresponding to 0C. 0007 is the index pointing to the constant item of this field or method name, And 0008 is the index of the constant item of the descriptor of this field or method, #7 corresponds to the <init> variable name. The relevant content will be described in an article.

16. 10000007d ~ 00000081 (u1 + u2 + U2 0x0c 0005 0006)

Table 3 and table structure type in the constant pool show that the constant_nameandtype_info corresponding to 0C, 0005 is the index pointing to the constant item of this field or method name, 0006 points to the index of this field or the descriptor constant of the method. Because #5 and #6 correspond to the field names and types of values, the value ranges from ~ 00000081 describes the name and type of the Value Field.

17. 00000082 ~ 00000098 (TAG + Length + bytes 0x01 0014 ...)

Tag = 01 indicates that this is also a constant of the UTF-8 type, with a length of 0014 = 20, the following 20 bytes indicate the full name of the Class Name (classloader/testcase. changed/

18, 00000098 ~ 1000000ab (TAG + Length + bytes 0x01 0010 ...)

Tag = 01 indicates that this is also a constant of the UTF-8 type, with a length of 0010 = 16, the following 16 bytes indicate the full name of the Class Name (Java/lang/obeject. changed/

19. 000000ac ~ 000000ad (U2 00 21)

The two bytes following the constant pool describe the access flag of the class or interface, 0x0021 = 0x0020 | 0x0001, by querying table 5 and Class Object Access attributes, we can see that the access signs of this class are acc_public and acc_super.

20. 201700ae ~ 201700b3 (u2 + u2 + U2 0003 0004 0000)

The three U2 types respectively indicate that the class index location in the constant pool is 0003 (#3), and the parent index location is 0004 (#4 ), the size of the API index set is 0000 (0)

21. 000000b4 ~ 000000bd (u2 + u2 + u2 + U2 0001 0002 0005 0006)

• The four U2 data items represent 0001 (1) variables in the class respectively.
• The variable access flag is 0002 (you can query table 7 and field table access modifier, And the access flag of this variable is acc_private)
• The index corresponding to the variable name in the constant pool is 0005 (#5)
• The index location of the variable type in the constant pool is 0006 (#6), and the number of attributes is 0000 (0). If a final modifier is added before the variable value in this example, the number of attributes will change to 0001, and the relevant information of the attributes will be followed later.

 

22. 000000be ~ 201700c7 (u2 + u2 + u2 + u2 + U2 0002 0001 0007 0008)

• The number of methods is 0002 (two are the test method and the other is the <init> method of the object, of which 22 ~ 24 steps represent the <init> method in the object, 25 ~ 27 represents the test () method we wrote)
• Method access flag 0001 (table 10, method table flag list shows that the access flag is acc_public)
• The index location of the method name in the constant pool is 0007 (#7)
• The index location of the method descriptor in the constant pool is 0008 (#8)
• The number of method attributes is 0001 (1 ).

23. 000000c9 ~ 000000de (u2 + U4 + u2 + U4 + U1 * U4 + u2 + U2 0009 + 0000001d + 0001 + 0001 + 00000005 + 2ab70001b1 + 0000 + 0001)

• The index location of the constant pool corresponding to the property of the method is 0009 (#9), and the corresponding constant is code, indicating that this attribute is the bytecode description of the method.
• The attribute length is 0x1d (29)
• Maximum Method operand stack depth is 0001 (1)
• The storage space (unit: slot) to be allocated to the local variable table. For data types with a length of up to 32 bits, such as byte, Char, float, Int, short, Boolean, and returnaddress, each local variable occupies one slot, while the double and long 64-bit data types require two slots for storage.
• The length of the byte code compiled by the Java source program is 00000005 (5)
• Length of bytecode after Java source code compilationByte Code Compiled by the Java source program (for the bytecode instruction table, refer 《JVM Virtual Machine bytecode instruction table), 2ab70001b1 translation process is

　　　　　　2a:The corresponding command is aload_0. Push the local variables of the reference type in the 0th slots to the top of the operand stack.

　　　　　　B7:The corresponding command is invokespecial (call the superclass construction method, instance initialization method, private method). This method has a U2 type parameter to indicate which method to call, it points to a constant_methodref_info constant in the constant pool, that is

Method symbol reference for this method

　　　　　　0001:This is the invokespecial parameter. The query constant pool shows the <init> method of the object.

　　　　　　B1:Query the VM bytecode instruction table. We can see that the command for B1 is return.

• The length of the exception table is 0000 (0). Because try... catch is not used in the code of this instance, there is no explicit exception.
• 0001 (1) attribute count

24. 000000df ~ 000000ea (u2 + U4 + u2 + u2 + 000a + 00000006 + 0001 + 0000 + 0003)

• The index 000a corresponding to the attribute name points to #10 (linenumbertable) in the constant pool)
• The attribute length is 00006 (6 ).
• The length of line_number_table is 0001.
• The row number corresponding to the bytecode is 0000
• The number of lines corresponding to Java source code is 0003 (3 ).

25. 000000ea ~ 201700f2 (u2 + u2 + u2 + U2 0001 000b 000c 0008 0001)

• Method access flag 0001 (table 10, method table flag list shows that the access flag is acc_public)
• The index location of the method name in the constant pool is 000b (#11, corresponding to test)
• The index location of the method descriptor in the constant pool is 000c (#12)
• The number of method attributes is 0001 (1 ).

26. 000000f3 ~ 0000010b (u2 + U4 + u2 + U4 + U1 * U4 + u2 + U2 0009 + 0000001f + 0002 + 0001 + 00000007 + 2ab400020460ac + 0000 + 0001)

• The index location of the constant pool corresponding to the property of the method is 0009 (#9), and the corresponding constant is code, indicating that this attribute is the bytecode description of the method.
• The attribute length is 0x1f (30)
• Maximum Method operand stack depth is 0002 (1)
• The storage space (unit: slot) to be allocated to the local variable table. For data types with a length of up to 32 bits, such as byte, Char, float, Int, short, Boolean, and returnaddress, each local variable occupies one slot, while the double and long 64-bit data types require two slots for storage.
• The length of the byte code compiled by the Java source program is 00000007 (7)
• Length of bytecode after Java source code compilationByte Code Compiled by the Java source program (for the bytecode instruction table, refer 《JVM Virtual Machine bytecode instruction table), 2ab70001b1 translation process is

　　　　　　2a:The corresponding command is aload_0. Push the local variables of the reference type in the 0th slots to the top of the operand stack (the local variables of the reference type here refer to the variable value)

 

　　　　　　B4:The corresponding command is getfield (get the instance domain of the specified class and press it to the top of the stack). It can be seen from the content queried by the javap command, 2a indicates pushing the instance of the value field to the top of the stack.

　　　　　　　　

　　　　　　0002:This is the getfield parameter, indicating that the index of the class corresponding to the field in the constant pool is #2

　　　　　　04:Query the VM bytecode command table. We can see that the command 04 is used to push int type 1 to the top of the stack (here int type 1 is + 1 in return)

　　　　　　60:Query the Virtual Machine bytecode command table. We can see that the 60 command is to add the two int-type values at the top of the stack and push the result to the top of the stack (the two int-type values at the top of the stack are variable values and numbers respectively. 1)

AC:Query the VM bytecode instruction table. We can see that the command 04 returns int (that is, the final value + 1 result) from the current method)

• The length of the exception table is 0000 (0). Because try... catch is not used in the code of this instance, there is no explicit exception.
• 0001 (1) attribute count

27, 0000010c ~ 00000117 (u2 + U4 + u2 + u2 + 000a + 00000006 + 0001 + 0000 + 0006)

• The index 000a corresponding to the attribute name points to #10 (linenumbertable) in the constant pool)
• The attribute length is 00006 (6 ).
• The length of line_number_table is 0001.
• The row number corresponding to the bytecode is 0000
• The number of lines corresponding to Java source code is 0006 (6 ).

28, 0000011b ~ 00000122 (u2 + U4 + U2 0001 + 00000006 + 0001) This is a sourcefile and corresponds to the object class.

• The index location corresponding to the sourcefile attribute name is #1
• The attribute length is 6.
• The index location corresponding to the sourcefile attribute is #1.

29, 00000123 ~ 0000012a (u2 + U4 + U2 000d + 00000002 + 000e) This is a sourcefile file, which corresponds to the testcase. Java class we wrote.

• The index location corresponding to the sourcefile attribute name is #13
• The attribute length is 2.
• The index location corresponding to the sourcefile attribute is #14 (testcase. Java)

Class File Analysis