From 2b16edb0e243a3032d7b2ea3ed27962b77419b08 Mon Sep 17 00:00:00 2001 From: pen4uin Date: Sun, 15 Jun 2025 23:21:08 +0800 Subject: [PATCH] fix: https://github.com/pen4uin/java-memshell-generator/issues/39 --- .../java/jmg/core/config/AbstractConfig.java | 22 +++++++++++++++++-- .../java/jmg/core/format/BCELFormater.java | 11 +++++++++- .../jmg/core/format/BCELoaderGenerator.java | 4 ++-- .../src/main/java/jmg/gui/form/jMGForm.java | 2 -- 4 files changed, 32 insertions(+), 7 deletions(-) diff --git a/jmg-core/src/main/java/jmg/core/config/AbstractConfig.java b/jmg-core/src/main/java/jmg/core/config/AbstractConfig.java index 6af778e..3719b3b 100644 --- a/jmg-core/src/main/java/jmg/core/config/AbstractConfig.java +++ b/jmg-core/src/main/java/jmg/core/config/AbstractConfig.java @@ -410,6 +410,26 @@ public class AbstractConfig { private String jarClassName; + public byte[] getBytesInLoader() { + return bytesInLoader; + } + + public void setBytesInLoader(byte[] bytesInLoader) { + this.bytesInLoader = bytesInLoader; + } + + private byte[] bytesInLoader; + + public String getClassNameInLoader() { + return classNameInLoader; + } + + public void setClassNameInLoader(String classNameInLoader) { + this.classNameInLoader = classNameInLoader; + } + + private String classNameInLoader; + public void build() { // 检查 serverType、modelType、formatType 是否已设置 if (this.toolType == null || this.serverType == null || this.shellType == null || this.outputFormat == null || this.gadgetType == null) { @@ -429,8 +449,6 @@ public class AbstractConfig { this.setShellClassName(ClassNameUtil.getRandomShellClassName(this.getShellType())); if (this.getShellSimpleClassName() == null) this.setShellSimpleClassName(CommonUtil.getSimpleName(this.getShellClassName())); - if (this.getOutputFormat().contains(Constants.FORMAT_BCEL)) - this.setLoaderClassName(ClassNameUtil.getRandomLoaderClassName()); this.setSavePath(CommonUtil.getFileOutputPath(this.getOutputFormat(), this.getInjectorSimpleClassName(), this.getSavePath())); } } diff --git a/jmg-core/src/main/java/jmg/core/format/BCELFormater.java b/jmg-core/src/main/java/jmg/core/format/BCELFormater.java index 757a343..0abba2b 100755 --- a/jmg-core/src/main/java/jmg/core/format/BCELFormater.java +++ b/jmg-core/src/main/java/jmg/core/format/BCELFormater.java @@ -1,6 +1,7 @@ package jmg.core.format; import jmg.core.config.AbstractConfig; +import jmg.core.util.ClassNameUtil; import me.gv7.woodpecker.bcel.HackBCELs; import java.io.IOException; @@ -9,7 +10,15 @@ public class BCELFormater implements IFormater { public byte[] transform(byte[] clazzbyte, AbstractConfig config) throws IOException { - // 解决 BCEL 的classloader 的问题 + // 解决 BCEL ClassLoader 带来的问题 + if (config.isEnabledExtender()){ + config.setBytesInLoader(config.getExtenderBytes()); + config.setClassNameInLoader(config.getExtenderClassName()); + }else{ + config.setBytesInLoader(config.getInjectorBytes()); + config.setClassNameInLoader(config.getInjectorClassName()); + } + config.setLoaderClassName(ClassNameUtil.getRandomLoaderClassName()); byte[] bcelClzBytes = BCELoaderGenerator.generatorBCELoaderClass(config); return HackBCELs.encode(bcelClzBytes).getBytes(); } diff --git a/jmg-core/src/main/java/jmg/core/format/BCELoaderGenerator.java b/jmg-core/src/main/java/jmg/core/format/BCELoaderGenerator.java index 17ccf38..126b1ed 100644 --- a/jmg-core/src/main/java/jmg/core/format/BCELoaderGenerator.java +++ b/jmg-core/src/main/java/jmg/core/format/BCELoaderGenerator.java @@ -17,9 +17,9 @@ public class BCELoaderGenerator { ctClass.setName(config.getLoaderClassName()); ctClass.getClassFile().setVersionToJava5(); CtMethod getClassName = ctClass.getDeclaredMethod("getClassName"); - getClassName.setBody(String.format("{return \"%s\";}", config.getInjectorClassName())); + getClassName.setBody(String.format("{return \"%s\";}", config.getClassNameInLoader())); CtMethod getBase64String = ctClass.getDeclaredMethod("getBase64String"); - String base64ClassString = encodeToBase64(config.getInjectorBytes()).replace(System.lineSeparator(), ""); + String base64ClassString = encodeToBase64(config.getBytesInLoader()).replaceAll("[\\s*\t\n\r]", ""); String[] parts = splitChunks(base64ClassString, 40000); StringBuilder result = new StringBuilder(); for (int i = 0; i < parts.length; i++) { diff --git a/jmg-gui/src/main/java/jmg/gui/form/jMGForm.java b/jmg-gui/src/main/java/jmg/gui/form/jMGForm.java index 26242d5..7637b83 100644 --- a/jmg-gui/src/main/java/jmg/gui/form/jMGForm.java +++ b/jmg-gui/src/main/java/jmg/gui/form/jMGForm.java @@ -382,8 +382,6 @@ public class jMGForm { config.setUrlPattern("/*"); } } - if (config.getOutputFormat().contains(Constants.FORMAT_BCEL)) - config.setLoaderClassName(ClassNameUtil.getRandomLoaderClassName()); config.setInjectorSimpleClassName(CommonUtil.getSimpleName(config.getInjectorClassName())); }