使用sa-jli将ClassDump禁用到正在运行的JVM进程 [英] Disable ClassDump to a running JVM process by using sa-jli

问题描述

我试图通过设置-XX:+ DisableAttachMechanism来保护正在运行的JVM中的类.

I'm trying to protect my classes in a running JVM by setting -XX:+DisableAttachMechanism.

但是，我发现该过程阻止了诸如jconsole之类的工具的附加，但是我仍然可以使用以下命令来转储该JVM中所有已加载的类:

However, I found that the process prevents tools like jconsole to attach, but still I can use following command the dump all the loaded classes in that JVM:

java -Dsun.jvm.hotspot.tools.jcore.PackageNameFilter.pkgList=com.xxxx -classpath ".:./bin:$JAVA_HOME/lib/sa-jdi.jar" sun.jvm.hotspot.tools.jcore.ClassDump 1234

是否可以通过在运行的JVM中设置一些选项来停止此行为?还是有什么需要解决的?

Is there any way to stop this behavior by setting some options in the running JVM? Or anything to work around?

谢谢.

推荐答案

通常，这是不可能的.

可维护性代理(sa-jdi)不需要目标过程的合作.它只是使用 ptrace syscall停止目标JVM，并读取在没有JVM的情况下甚至不知道该进程的内存.

Serviceability Agent (sa-jdi) does not require cooperation from the target process. It just stops target JVM using ptrace syscall, and reads the memory of the process without JVM even knowing about that.

但是，通过覆盖Serviceability Agent使用的变量，可以使调试更加困难.特别是，如果重置gHotSpotVMStructs全局变量，SA将无法重建内部VM结构，因此基于SA的工具将停止工作.

However, you can make debugging harder by overwriting the variables used by Serviceability Agent. Particularly, if you reset gHotSpotVMStructs global variable, SA will not be able to reconstruct internal VM structures, so that tools based on SA will stop working.

为此，请编译以下novmstructs.c程序:

In order to do this, compile the following novmstructs.c program:

extern void *gHotSpotVMStructs;

int Agent_OnLoad(void *vm, char *options, void *reserved) {
    gHotSpotVMStructs = 0;
    return 0;
}

如何编译:

gcc -fPIC -nostdlib -shared -olibnostructs.so -O2 nostructs.c

然后运行带有附加的代理库的Java应用程序:

Then run your Java application with the produced library attached as the agent:

java -agentpath:/path/to/libnostructs.so ...

下次有人尝试调用ClassDump或其他基于SA的实用程序时，将发生异常:

The next time someone tries to invoke ClassDump or other SA-based utility, the exception will occur:

Attaching to process ID 574, please wait...
Exception in thread "main" java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at sun.tools.jstack.JStack.runJStackTool(JStack.java:140)
        at sun.tools.jstack.JStack.main(JStack.java:106)
Caused by: java.lang.RuntimeException: gHotSpotVMStructs was not initialized properly in the remote process; can not continue
        at sun.jvm.hotspot.HotSpotTypeDataBase.readVMStructs(HotSpotTypeDataBase.java:418)
        at sun.jvm.hotspot.HotSpotTypeDataBase.<init>(HotSpotTypeDataBase.java:91)
        at sun.jvm.hotspot.HotSpotAgent.setupVM(HotSpotAgent.java:395)
        at sun.jvm.hotspot.HotSpotAgent.go(HotSpotAgent.java:305)
        at sun.jvm.hotspot.HotSpotAgent.attach(HotSpotAgent.java:140)
        at sun.jvm.hotspot.tools.Tool.start(Tool.java:185)
        at sun.jvm.hotspot.tools.Tool.execute(Tool.java:118)
        at sun.jvm.hotspot.tools.JStack.main(JStack.java:92)
        ... 6 more

这篇关于使用sa-jli将ClassDump禁用到正在运行的JVM进程的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！