从一个奇怪jar开始の奇妙分析

//场景的伪代码示例
void JNICALL ClassFileLoadHook(jvmtiEnv *jvmti_env, JNIEnv *jni_env, jclass class_being_loaded,
                               const char *name, jobject protection_domain, jint class_data_len,
                               const unsigned char *class_data, jint *new_class_data_len,
                               unsigned char **new_class_data) {
    // 在这里可以插入解密代码, 它会加载class文件之前进行解密操作

    std::cout << "Class file loaded: " << name << std::endl;

    // 例如，解密后的字节码存放到new_class_data中
    *new_class_data_len = class_data_len;  // 设置新的字节码长度
    *new_class_data = const_cast<unsigned char *>(class_data);  // 这里假设没有改变数据

    // 继续加载原始或解密后的class数据
}
jvmtiEnv *jvmti = nullptr;
JavaVM *jvm = nullptr;
JNIEXPORT jint JNICALL Agent_OnLoad(JavaVM *vm, char *options, void *reserved) {
    // 获取jvmti环境
    jint res = vm->GetEnv(reinterpret_cast<void **>(&jvmti), JVMTI_VERSION);
    if (res != JNI_OK || jvmti == nullptr) {
        std::cerr << "Error: Unable to access JVMTI version." << std::endl;
        return res;
    }

    // 注册ClassFileLoadHook回调
    jvmtiEventCallbacks callbacks = {0};
    callbacks.ClassFileLoadHook = &ClassFileLoadHook;

    res = jvmti->SetEventCallbacks(&callbacks, sizeof(callbacks));
    if (res != JVMTI_ERROR_NONE) {
        std::cerr << "Error: Unable to set event callbacks." << std::endl;
        return res;
    }

    // 启动ClassFileLoadHook事件
    res = jvmti->SetEventNotificationMode(JVMTI_EVENT_CLASS_FILE_LOAD, JVMTI_ENABLE, nullptr);
    if (res != JVMTI_ERROR_NONE) {
        std::cerr << "Error: Unable to enable class file load event." << std::endl;
        return res;
    }

    return JNI_OK;
}

  void post_to_env(JvmtiEnv* env, bool caching_needed) {
    unsigned char *new_data = NULL;
    jint new_len = 0;
  /*......*/
    JvmtiClassFileLoadEventMark jem(_thread, _h_name, _class_loader,
                                    _h_protection_domain,
                                    _h_class_being_redefined);
    JvmtiJavaThreadEventTransition jet(_thread);
    JNIEnv* jni_env =  (JvmtiEnv::get_phase() == JVMTI_PHASE_PRIMORDIAL)?
                                                        NULL : jem.jni_env();
    jvmtiEventClassFileLoadHook callback = env->callbacks()->ClassFileLoadHook;
    if (callback != NULL) {
      (*callback)(env->jvmti_external(), jni_env,
                  jem.class_being_redefined(),
                  jem.jloader(), jem.class_name(),
                  jem.protection_domain(),
                  _curr_len, _curr_data,
                  &new_len, &new_data);
    }
    if (new_data != NULL) {
      // this agent has modified class data.
      if (caching_needed && *_cached_class_file_ptr == NULL) {
        // data has been changed by the new retransformable agent
        // and it hasn't already been cached, cache it
        JvmtiCachedClassFileData *p;
        p = (JvmtiCachedClassFileData *)os::malloc(
          offset_of(JvmtiCachedClassFileData, data) + _curr_len, mtInternal);
        if (p == NULL) {
          vm_exit_out_of_memory(offset_of(JvmtiCachedClassFileData, data) + _curr_len,
            OOM_MALLOC_ERROR,
            "unable to allocate cached copy of original class bytes");
        }
        p->length = _curr_len;
        memcpy(p->data, _curr_data, _curr_len);
        *_cached_class_file_ptr = p;
      }

      if (_curr_data != *_data_ptr) {
        // curr_data is previous agent modified class data.
        // And this has been changed by the new agent so
        // we can delete it now.
        _curr_env->Deallocate(_curr_data);
      }

      // Class file data has changed by the current agent.
      _curr_data = new_data;
      _curr_len = new_len;
      // Save the current agent env we need this to deallocate the
      // memory allocated by this agent.
      _curr_env = env;
    }
  }
  /*......*/
};

// this entry is for class file load hook on class load, redefine and retransform
void JvmtiExport::post_class_file_load_hook(Symbol* h_name,
                                            Handle class_loader,
                                            Handle h_protection_domain,
                                            unsigned char **data_ptr,
                                            unsigned char **end_ptr,
                                            JvmtiCachedClassFileData **cache_ptr) {
  JvmtiClassFileLoadHookPoster poster(h_name, class_loader,
                                      h_protection_domain,
                                      data_ptr, end_ptr,
                                      cache_ptr);
  poster.post();
}

static void post_class_file_load_hook(Symbol* h_name, Handle class_loader,
                                      Handle h_protection_domain,
                                      unsigned char **data_ptr, unsigned char **end_ptr,
                                      JvmtiCachedClassFileData **cache_ptr) NOT_JVMTI_RETURN;

class SymbolBase : public MetaspaceObj {
 public:
  ATOMIC_SHORT_PAIR(
    volatile short _refcount,  // needs atomic operation
    unsigned short _length     // number of UTF8 characters in the symbol (does not need atomic op)
  );
  int            _identity_hash;
};

class Symbol : private SymbolBase {
  friend class VMStructs;
  friend class SymbolTable;
  friend class MoveSymbols;
 private:
  jbyte _body[1];
  .....
}