我是字节码注入的新手。到目前为止，通过详尽的研究和痛苦的反复试验，我能够得到我想要的一切 :-) 但我似乎已经达到了我目前追求的目标的极限。所以，这就是：我的第一个 stackoverflow 问题！
我的目标是通过 java 代理跟踪方法调用的对象引用。我正在使用 ASM 4.0 库并实现了 AdviceAdapter。我重写的 visitMethodInsn() 方法如下所示：
/**
* Visits a method instruction. A method instruction is an instruction that invokes a method.
* The stack before INVOKEINTERFACE, INVOKESPECIAL and INVOKEVIRTUAL instructions is:
* "objectref, [arg1, arg2, ...]"
*
* @param opcode the opcode of the type instruction to be visited. This opcode is either INVOKEVIRTUAL, INVOKESPECIAL, INVOKESTATIC or INVOKEINTERFACE.
* @param owner the internal name of the method's owner class.
* @param name the method's name.
* @param desc the method's descriptor.
*/
@Override
public void visitMethodInsn(int opcode, String owner, String name, String desc) {
if (isExcluded()) {
super.visitMethodInsn(opcode, owner, name, desc);
return;
}
int arraySlot = -1;
boolean isStatic = false;
if (opcode == INVOKEVIRTUAL || opcode == INVOKEINTERFACE) {
arraySlot = saveMethodParameters(owner, desc);
super.visitMethodInsn(opcode, owner, name, desc);
} else if (opcode == INVOKESTATIC) {
isStatic = true;
super.visitMethodInsn(opcode, owner, name, desc);
} else if (opcode == INVOKESPECIAL && !owner.equals("java/lang/Object")) {
//TODO: Causes VerifyError
arraySlot = saveMethodParameters(owner, desc);
super.visitMethodInsn(opcode, owner, name, desc);
} else {
super.visitMethodInsn(opcode, owner, name, desc);
}
if (arraySlot > 0) {
loadLocal(arraySlot);
push(0);
arrayLoad(Type.getType(Object.class));
} else {
super.visitInsn(ACONST_NULL);
}
super.visitMethodInsn(INVOKESTATIC, "net/myjavaagent/MethodLogger",
"writeToLoggerTest", "(Ljava/lang/Object;)V");
}
/**
* Pops the method invocation' arguments and objectref off the stack, saves them into a local array variable and
* then puts them back on the stack again.
*
* @param owner owner class of the method
* @param desc method descriptor
* @return the identifier of the local variable containing the parameters.
*/
private int saveMethodParameters(String owner, String desc) {
JavaTracerAgent.agentErrorLogger.info("Save method parameters: " + owner + " " + desc);
// Preparing the array construction
Type objectType = Type.getType(Object.class);
Type objectArrayType = Type.getType("[Ljava/lang/Object;");
Type[] invokeParamTypes = getMethodParamTypes(owner, desc);
int invokeParamCount = invokeParamTypes.length;
// allocate a slot for the method parameters array
int arrayLocal = newLocal(objectArrayType);
// construct the object array
push(invokeParamCount);
newArray(objectType);
// store array in the local variable
storeLocal(arrayLocal);
// pop the arguments off the stack into the array
// note: the top one is the last parameter !
for (int i = invokeParamCount - 1; i >= 0; i--) {
Type type = invokeParamTypes[i];
JavaTracerAgent.agentErrorLogger.info("Get from stack [" + i + "]:" + type.toString());
if (type != null) {
// convert value to object if needed
box(type);
// load array and swap under value
loadLocal(arrayLocal);
swap(objectArrayType, objectType);
// load index and swap under value
push(i);
swap(Type.INT_TYPE, objectType);
} else {
// this is a static method and index is 0 so we put null into the array
// load array index and then null
loadLocal(arrayLocal);
push(i);
push((Type) null);
}
// store the value in the array as an object
arrayStore(objectType);
}
// now restore the stack and put back the arguments from the array in increasing order
for (int i = 0; i < invokeParamCount; i++) {
Type type = invokeParamTypes[i];
JavaTracerAgent.agentErrorLogger.info("Put to stack [" + i + "]:" + type.toString());
if (type != null) {
// load the array
loadLocal(arrayLocal);
//retrieve the object at index i
push(i);
arrayLoad(objectType);
//unbox if needed
unbox(type);
} else {
// this is a static method so no target instance has to be put on stack
}
}
return arrayLocal;
}
/**
* Returns a type array containing the parameters of a method invocation:
* <ul><li>owner type</li><li>arg1 type</li><li>arg2 type</li><li>...</li><li>argN type</li></ul>
*
* @param owner owner class
* @param desc method descriptor
* @return method parameter types
*/
public Type[] getMethodParamTypes(String owner, String desc) {
Type ownerType = Type.getObjectType(owner);
Type[] argTypes = Type.getArgumentTypes(desc);
int numArgs = argTypes.length;
Type[] result = new Type[numArgs + 1];
result[0] = ownerType;
System.arraycopy(argTypes, 0, result, 1, numArgs);
return result;
}
简而言之，我试图在 INVOKESOMETHING 操作执行到局部变量之前保存堆栈上的所有内容。为了启用方法操作的执行，我必须将整个东西放回堆栈。之后我假设被调用对象的引用是我本地数组中的第一个条目。
以下是我的测试课程之一。这个很简单：它只是启动另一个线程：
/**
* My test class.
*/
public class ThreadStarter {
public static void main(String args[]) {
Thread thread = new Thread("Hugo") {
@Override
public void run() {
System.out.println("Hello World");
}
};
thread.start();
}
}
关于 INVOKEVIRTUAL、INVOKEINTERFACE 和 INVOKESTATIC，我没有遇到任何问题。一切似乎都很好，日志输出正是我所期望的。但是，INVOKESPECIAL 指令似乎存在问题。我在这里遇到了一个丑陋的 VerifyError，所以我想我处理堆栈的方式一定有问题。
Exception in thread "main" java.lang.VerifyError: (class: net/petafuel/qualicore/examples/ThreadStarter, method: main signature: ([Ljava/lang/String;)V) Expecting to find object/array on stack
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Class.java:171)
at com.intellij.rt.execution.application.AppMain.main(AppMain.java:113)
使用“-noverify”启动测试类会使 VerifyError 消失。一切似乎都很完美，我得到了想要的输出。我可以就这样离开它，但实际上整个问题让我感到痛苦，让我睡得很糟糕;-)
如果我的理解是正确的，那么像“new Thread()”这样的语句就会变成
NEW java/lang/Thread
DUP
INVOKESPECIAL <init>
在字节码中。新创建的对象在调用构造函数之前仍未初始化，会不会是个问题？
我不明白为什么代码可以正常工作，但 JVM 在验证期间抱怨。
即使在检测后查看反编译的代码也无济于事：
// Decompiled by Jad v1.5.8g. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.kpdus.com/jad.html
// Decompiler options: packimports(3)
// Source File Name: ThreadStarter.java
public class ThreadStarter
{
public ThreadStarter()
{
MethodLogger.writeToLoggerTest(null);
}
public static void main(String args[])
{
JVM INSTR new #2 <Class ThreadStarter$1>;
JVM INSTR dup ;
"Hugo";
Object aobj[] = new Object[2];
aobj;
JVM INSTR swap ;
1;
JVM INSTR swap ;
JVM INSTR aastore ;
aobj;
JVM INSTR swap ;
0;
JVM INSTR swap ;
JVM INSTR aastore ;
((_cls1)aobj[0])._cls1((String)aobj[1]);
MethodLogger.writeToLoggerTest(aobj[0]);
Thread thread;
thread;
thread;
Object aobj1[] = new Object[1];
aobj1;
JVM INSTR swap ;
0;
JVM INSTR swap ;
JVM INSTR aastore ;
((Thread)aobj1[0]).start();
MethodLogger.writeToLoggerTest(aobj1[0]);
return;
}
}
一些附加信息：我正在使用 IntelliJ IDEA 10.5.4 进行开发并使用 jdk1.6.0_39。
最后，我希望这里有人可以帮助我获得必要的见解。提前致谢！