Use the class in Sa-jdi.jar dump memory

Objective

When analyzing a jar package, it was found that he loaded the key class in the way it was used by the runtime classloader . Do not bother to analyze the algorithm, you can use their jdk own tools out of the dump need class .

Body

There are two ways to dump a class file from a running Java process,

• Using the agent Attatch to the process, and then using instrumentation and Classfiletransformer to get to the class bytecode.

• Use the tools in the Sd-jdi.jar

This article describes the use of sd-jdi.jar dump. sd-jdi.jar sun.jvm.hotspot.tools.jcore.ClassDumpcan dump class content into a file.

ClassDumpCan be set in two System properties :

• Sun.jvm.hotspot.tools.jcore.filter the class name of the filter
• Directory of Sun.jvm.hotspot.tools.jcore.outputDir output

Example

First write a filter class

import sun.jvm.hotspot.tools.jcore.ClassFilter;import sun.jvm.hotspot.oops.InstanceKlass;import sun.jvm.hotspot.tools.jcore.ClassDump;public class MyFilter implements ClassFilter {    @Override    public boolean canInclude(InstanceKlass kls) {        String klassName = kls.getName().asString();        return klassName.startsWith("com/fr/license/selector/");    }}  

The code is obvious, and the function is the dump com/fr/license/selector/ byte code of all classes that begin with.

and compile it into a class file.

To use this first need to sa-jdi.jar add to java the classpath inside.

Go to the filter directory of the class file that you just wrote. Perform

java  -Dsun.jvm.hotspot.tools.jcore.filter=MyFilter  -Dsun.jvm.hotspot.tools.jcore.outputDir=d:\dump  sun.jvm.hotspot.tools.jcore.ClassDump 5308

MyFilterchange to your own class name for the 5308 target Java process pid (can be used to jps view). d:\dumpthe corresponding file will then be generated class .

Problem solving

• If you click on the app's EXE directly to launch the application, using JPS to get the PID, there may be no way to attach, so we have to find the command to start, such as the bat script inside.

• General large applications will bring their own JRE, we will use the above technology, replace the JRE, for our, to normal dump, otherwise there will be a version mismatch.

• Windows also needs to be sawindbg.dll placed in the jre/bin/ same directory as Java.exe. Otherwise, you may encounter problems that do not load this DLL.

At last

The first step in Java application is to find the command to start, which is convenient for later analysis. Do not use the exe startup app in general

Use the class in Sa-jdi.jar dump memory