Tomcat自定义classLoader加密解密
class很好反编译，所以需要对class文件先进行加密，然后使用自己的classloader进行解密并加载。
【步骤】
大概分两步：
1.对class文件进行加密
2.写解密class文件并加载的classloader
3.将这个classloader加入到tomcat中，也就是使tomcat可以调用到这个classloader
【加密】
1.思路
字节流读取class文件，进行简单的移位
2.实现
做了一个小程序，实现了对某文件夹下所有class文件字节流读取，并+2位的加密方式
3.说明
swing是使用myeclipse的插件做的，可能比较乱
【classloader】
import java.io.ByteArrayOutputStream;
import java.io.FileInputStream;
import java.io.IOException;
import org.apache.catalina.loader.WebappClassLoader;
/**
* 自己的ClassLoader
* 用于解密加密过的class文件并加载
* @author uikoo9
*/
public class MyClassLoader extends WebappClassLoader{
/**
* 默认构造器
*/
public MyClassLoader() {
super();
}
/**
* 默认构造器
* @param parent
*/
public MyClassLoader(ClassLoader parent) {
super(parent);
}
/* (non-Javadoc)
* @see org.apache.catalina.loader.WebappClassLoader#findClass(java.lang.String)
*/
public Class<?> findClass(String name) throws ClassNotFoundException {
byte[] classBytes = null;
try {
classBytes = loadClassBytes(name);
} catch (Exception e) {
throw new ClassNotFoundException(name);
}
Class<?> cl= defineClass(name, classBytes, 0, classBytes.length);
if(cl == null) throw new ClassNotFoundException(name);
return cl;
}
/**
* 简单的解密
* @param name
* @return
* @throws IOException
*/
private byte[] loadClassBytes(String name) throws IOException{
String cname = name.replace('.', '/') + ".class";
FileInputStream in = new FileInputStream(cname);
try {
ByteArrayOutputStream buffer = new ByteArrayOutputStream();
int ch;
while((ch = in.read()) != -1){
if(cname.contains("uikoo9")){// 如果包含uikoo9说明是自己写的class，进行解密
System.out.println("++");
buffer.write((byte)(ch-2));
}else{
buffer.write((byte)ch);
}
}
in.close();
return buffer.toByteArray();
}finally{
in.close();
}
}
}
【加入到tomcat中】
1.网上
网上很多文章都问到tomcat怎么使用自己的classloader，但是说明白的几乎没有，
最后自己读了tomcat官网的文档，找到了答案，
地址：http://tomcat.apache.org/tomcat-6.0-doc/config/loader.html
2.方法
说简单点，就是在tomcat\conf\context.xml中添加以下这段代码：
<Loader loaderClass="com.uikoo9.MyClassLoader"></Loader >
3.classloader
但是注意，这里的com.uikoo9.MyClassLoader并不是项目中的，
而是需要放到tomcat\lib下。
【新的问题】
1.这个自己写的classloader确实起作用的，但是问题也随之而来，
原来tomcat在调用classloader之前会调用一个自己的classparser类来对class文件进行解析
2.classparser
位于org\apache\tomcat\util\bcel\classfile下的ClassParser.java，
源代码：
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
*/
package org.apache.tomcat.util.bcel.classfile;
import java.io.BufferedInputStream;
import java.io.DataInputStream;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.util.zip.ZipEntry;
import java.util.zip.ZipFile;
import org.apache.tomcat.util.bcel.Constants;
/**
* Wrapper class that parses a given Java .class file. The method <A
* href ="#parse">parse</A> returns a <A href ="JavaClass.html">
* JavaClass</A> object on success. When an I/O error or an
* inconsistency occurs an appropiate exception is propagated back to
* the caller.
*
* The structure and the names comply, except for a few conveniences,
* exactly with the <A href="ftp://java.sun.com/docs/specs/vmspec.ps">
* JVM specification 1.0</a>. See this paper for
* further details about the structure of a bytecode file.
*
* @version $Id: ClassParser.java 992409 2010-09-03 18:35:59Z markt $
* @author <A HREF="mailto:m.dahm@gmx.de">M. Dahm</A>
*/
public final class ClassParser {
private DataInputStream file;
private boolean fileOwned;
private String file_name;
private String zip_file;
private int class_name_index, superclass_name_index;
private int major, minor; // Compiler version
private int access_flags; // Access rights of parsed class
private int[] interfaces; // Names of implemented interfaces
private ConstantPool constant_pool; // collection of constants
private Field[] fields; // class fields, i.e., its variables
private Method[] methods; // methods defined in the class
private Attribute[] attributes; // attributes defined in the class
private boolean is_zip; // Loaded from zip file
private static final int BUFSIZE = 8192;
/**
* Parse class from the given stream.
*
* @param file Input stream
* @param file_name File name
*/
public ClassParser(InputStream file, String file_name) {
this.file_name = file_name;
fileOwned = false;
String clazz = file.getClass().getName(); // Not a very clean solution ...
is_zip = clazz.startsWith("java.util.zip.") || clazz.startsWith("java.util.jar.");
if (file instanceof DataInputStream) {
this.file = (DataInputStream) file;
} else {
this.file = new DataInputStream(new BufferedInputStream(file, BUFSIZE));
}
}
/**
* Parse the given Java class file and return an object that represents
* the contained data, i.e., constants, methods, fields and commands.
* A <em>ClassFormatException</em> is raised, if the file is not a valid
* .class file. (This does not include verification of the byte code as it
* is performed by the java interpreter).
*
* @return Class object representing the parsed class file
* @throws IOException
* @throws ClassFormatException
*/
public JavaClass parse() throws IOException, ClassFormatException {
ZipFile zip = null;
try {
if (fileOwned) {
if (is_zip) {
zip = new ZipFile(zip_file);
ZipEntry entry = zip.getEntry(file_name);
if (entry == null) {
throw new IOException("File " + file_name + " not found");
}
file = new DataInputStream(new BufferedInputStream(zip.getInputStream(entry),
BUFSIZE));
} else {
file = new DataInputStream(new BufferedInputStream(new FileInputStream(
file_name), BUFSIZE));
}
}
/****************** Read headers ********************************/
// Check magic tag of class file
readID();
// Get compiler version
readVersion();
/****************** Read constant pool and related **************/
// Read constant pool entries
readConstantPool();
// Get class information
readClassInfo();
// Get interface information, i.e., implemented interfaces
readInterfaces();
/****************** Read class fields and methods ***************/
// Read class fields, i.e., the variables of the class
readFields();
// Read class methods, i.e., the functions in the class
readMethods();
// Read class attributes
readAttributes();
// Check for unknown variables
//Unknown[] u = Unknown.getUnknownAttributes();
//for(int i=0; i < u.length; i++)
// System.err.println("WARNING: " + u[i]);
// Everything should have been read now
// if(file.available() > 0) {
// int bytes = file.available();
// byte[] buf = new byte[bytes];
// file.read(buf);
// if(!(is_zip && (buf.length == 1))) {
// System.err.println("WARNING: Trailing garbage at end of " + file_name);
// System.err.println(bytes + " extra bytes: " + Utility.toHexString(buf));
// }
// }
} finally {
// Read everything of interest, so close the file
if (fileOwned) {
try {
if (file != null) {
file.close();
}
if (zip != null) {
zip.close();
}
} catch (IOException ioe) {
//ignore close exceptions
}
}
}
// Return the information we have gathered in a new object
return new JavaClass(class_name_index, superclass_name_index, file_name, major, minor,
access_flags, constant_pool, interfaces, fields, methods, attributes);
}
/**
* Read information about the attributes of the class.
* @throws IOException
* @throws ClassFormatException
*/
private final void readAttributes() throws IOException, ClassFormatException {
int attributes_count;
attributes_count = file.readUnsignedShort();
attributes = new Attribute[attributes_count];
for (int i = 0; i < attributes_count; i++) {
attributes[i] = Attribute.readAttribute(file, constant_pool);
}
}
/**
* Read information about the class and its super class.
* @throws IOException
* @throws ClassFormatException
*/
private final void readClassInfo() throws IOException, ClassFormatException {
access_flags = file.readUnsignedShort();
/* Interfaces are implicitely abstract, the flag should be set
* according to the JVM specification.
*/
if ((access_flags & Constants.ACC_INTERFACE) != 0) {
access_flags |= Constants.ACC_ABSTRACT;
}
if (((access_flags & Constants.ACC_ABSTRACT) != 0)
&& ((access_flags & Constants.ACC_FINAL) != 0)) {
throw new ClassFormatException("Class " + file_name + " can't be both final and abstract");
}
class_name_index = file.readUnsignedShort();
superclass_name_index = file.readUnsignedShort();
}
/**
* Read constant pool entries.
* @throws IOException
* @throws ClassFormatException
*/
private final void readConstantPool() throws IOException, ClassFormatException {
constant_pool = new ConstantPool(file);
}
/**
* Read information about the fields of the class, i.e., its variables.
* @throws IOException
* @throws ClassFormatException
*/
private final void readFields() throws IOException, ClassFormatException {
int fields_count;
fields_count = file.readUnsignedShort();
fields = new Field[fields_count];
for (int i = 0; i < fields_count; i++) {
fields[i] = new Field(file, constant_pool);
}
}
/******************** Private utility methods **********************/
/**
* Check whether the header of the file is ok.
* Of course, this has to be the first action on successive file reads.
* @throws IOException
* @throws ClassFormatException
*/
private final void readID() throws IOException, ClassFormatException {
int magic = 0xCAFEBABE;
if (file.readInt() != magic) {
throw new ClassFormatException(file_name + " is not a Java .class file");
}
}
/**
* Read information about the interfaces implemented by this class.
* @throws IOException
* @throws ClassFormatException
*/
private final void readInterfaces() throws IOException, ClassFormatException {
int interfaces_count;
interfaces_count = file.readUnsignedShort();
interfaces = new int[interfaces_count];
for (int i = 0; i < interfaces_count; i++) {
interfaces[i] = file.readUnsignedShort();
}
}
/**
* Read information about the methods of the class.
* @throws IOException
* @throws ClassFormatException
*/
private final void readMethods() throws IOException, ClassFormatException {
int methods_count;
methods_count = file.readUnsignedShort();
methods = new Method[methods_count];
for (int i = 0; i < methods_count; i++) {
methods[i] = new Method(file, constant_pool);
}
}
/**
* Read major and minor version of compiler which created the file.
* @throws IOException
* @throws ClassFormatException
*/
private final void readVersion() throws IOException, ClassFormatException {
minor = file.readUnsignedShort();
major = file.readUnsignedShort();
}
}
3.问题
发现这个解析类的文件会先去判断class的头信息来确定是不是class文件，
但是由于我们对class进行了加密，所以头信息变了，所以这个解析class文件的类会报错，也就不会调用到classloader了。
【继续】
文章有点长，不知道有人有耐心看完不。
1.上面的问题折腾了一天，才发现是自己解密的部分有问题，
2.不过也是有收获的，发现自定写的loader只能加载非class的文件，而不能加载class
3.意思就是说，你需要将原来的class文件加密并改变文件后缀，然后配合自己的loader使用
【delegate】
由于自己英语水平有限，所以之前的tomcat文章一知半解，
通过今天的研究发现context.xml中的delegate属性的用法。
1.loader的代码：
package com.uikoo9.loader;
import java.io.ByteArrayOutputStream;
import java.io.FileInputStream;
import java.io.IOException;
import org.apache.catalina.loader.WebappClassLoader;
/**
* 自定义的classloader
* 可以解密文件并加载
* @author uikoo9
*/
public class UClassLoader extends WebappClassLoader{
/**
* 默认构造器
*/
public UClassLoader() {
super();
}
/**
* 默认构造器
* @param parent
*/
public UClassLoader(ClassLoader parent) {
super(parent);
}
/* (non-Javadoc)
* @see org.apache.catalina.loader.WebappClassLoader#findClass(java.lang.String)
*/
public Class<?> findClass(String name) throws ClassNotFoundException {
byte[] classBytes = null;
try {
if(name.contains("uikoo9")){
System.out.println("++++++" + name);
classBytes = loadClassBytesEncrypt(name);
}else{
System.out.println("-------" + name);
classBytes = loadClassBytesDefault(name);
}
} catch (Exception e) {
e.printStackTrace();
}
Class<?> cl = defineClass(name, classBytes, 0, classBytes.length);
if (cl == null)
throw new ClassNotFoundException(name);
return cl;
}
@Override
public Class<?> loadClass(String name) throws ClassNotFoundException {
if(name.contains("uikoo9")){
return findClass(name);
}else{
return super.loadClass(name);
}
}
/**
* 加载加密后的class字节流
* @param name
* @return
* @throws IOException
*/
private byte[] loadClassBytesEncrypt(String name) throws IOException {
String cname = name.replace('.', '/') + ".uikoo9";
FileInputStream in = null;
in = new FileInputStream(cname);
try {
ByteArrayOutputStream buffer = new ByteArrayOutputStream();
int ch;
while ((ch = in.read()) != -1) {
buffer.write((byte)(ch - 2));
}
in.close();
return buffer.toByteArray();
} finally {
in.close();
}
}
/**
* 加载普通的class字节流
* @param name
* @return
* @throws IOException
*/
private byte[] loadClassBytesDefault(String name) throws IOException {
String cname = name.replace('.', '/') + ".class";
FileInputStream in = null;
in = new FileInputStream(cname);
try {
ByteArrayOutputStream buffer = new ByteArrayOutputStream();
int ch;
while ((ch = in.read()) != -1) {
buffer.write((byte)ch);
}
in.close();
return buffer.toByteArray();
} finally {
in.close();
}
}
}
2.delegate="false"时，启动tomcat：
<Loader loaderClass="com.uikoo9.loader.UClassLoader" delegate="false"></Loader >
3.delegate="true"时，启动tomcat：
<Loader loaderClass="com.uikoo9.loader.UClassLoader" delegate="true"></Loader >
4.总结
delegate为true的时候自定义的loader只用来加载自己的代码
【新问题】
以上的代码整理一下，启动tomcat，没有报错，
但是当点击页面的时候，也就是向后台请求的时候依然报错，
【end】
经过中午的挣扎，这个问题终于解决了，
注意，这个只适合没有spring的，因为spring有自己的classloader。
【classloader】
1.代码：
import java.io.ByteArrayOutputStream;
import java.io.FileInputStream;
import java.io.IOException;
import org.apache.catalina.loader.WebappClassLoader;
/**
* 自定义的classloader
* 可以解密文件并加载
* @author uikoo9
*/
public class UClassLoader extends WebappClassLoader{
/**
* 默认构造器
*/
public UClassLoader() {
super();
}
/**
* 默认构造器
* @param parent
*/
public UClassLoader(ClassLoader parent) {
super(parent);
}
/* (non-Javadoc)
* @see org.apache.catalina.loader.WebappClassLoader#findClass(java.lang.String)
*/
public Class<?> findClass(String name) throws ClassNotFoundException {
if(name.contains("uikoo9")){
return findClassEncrypt(name);
}else{
return super.findClass(name);
}
}
/**
* 查找class
* @param name
* @return
* @throws ClassNotFoundException
*/
private Class<?> findClassEncrypt(String name) throws ClassNotFoundException{
byte[] classBytes = null;
try {
System.out.println("++++++" + name);
classBytes = loadClassBytesEncrypt(name);
} catch (Exception e) {
e.printStackTrace();
}
Class<?> cl = defineClass(name, classBytes, 0, classBytes.length);
if (cl == null)
throw new ClassNotFoundException(name);
return cl;
}
/**
* 加载加密后的class字节流
* @param name
* @return
* @throws IOException
*/
private byte[] loadClassBytesEncrypt(String name) throws IOException {
String basepath = "Z:/program/workspaces/_work_03_bzb/WebRoot/WEB-INF/classes/";// 项目物理地址
String cname = basepath + name.replace('.', '/') + ".uikoo9";
System.out.println(cname);
FileInputStream in = new FileInputStream(cname);
try {
ByteArrayOutputStream buffer = new ByteArrayOutputStream();
int ch;
while ((ch = in.read()) != -1) {
buffer.write((byte)(ch - 2));
}
in.close();
return buffer.toByteArray();
} finally {
in.close();
}
}
}
【加入到tomcat】
1.context.xml
找到tomcat下contex.xml，在context之间加入以下代码：
<Loader loaderClass="com.uikoo9.loader.UClassLoader" delegate="true"></Loader>
其中loaderClass就是自己写loader，delegate=“true”的意思是只解密非系统的class和jar
2.添加loader
将自己写的loader的class文件放到tomcat\lib下
【开始】
1.使用加密程序对classes下所有文件加密，加密之后所有的class文件后缀变为uikoo9，可以自己修改源代码
2.将原classes文件夹删除，将加密后的classes文件夹复制进去
3.修改context.xml
4.tomcat\lib下添加loader.class
5.启动tomcat
原文：http://blog.csdn.net/uikoo9/article/details/17281403
