Spectrum相关详解笔记

运行效果

命令

运行结果

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
2022-08-22 17:04:10,066 [main] WARN  [com.example.demo.DemoApplication] DemoApplication.java:19 - asd
jvas-v1.0.0: <<< on library loading, lib_ref:0 <<<
libcTask initiate ok
XML document correct, ./conf/JVASconf.xml
RUN:{
NONTRIVIAL:Auto,
MODE:{behavior:IAST, independent:False, silent:False, quiet:True, distribute:False, auto:True}
JAVA:{classpath:, libpath:/usr/local/lib/}
SENTRY-LIBPATH:{jvas:/usr/local/lib/libSentry.so, jvas_swi:/usr/local/lib/libSentry.so}
}
ESSENTIAL-JAVA-CLASSES:{
package:jsentry/,
class_count:3,
classes:[
{name:jvas_swi, must:True, sabi:True, main:True, define-if-possible:True},
{name:jvas_swi$jvas_init, must:True, sabi:False, main:False, define-if-possible:True},
{name:sabi, must:True, sabi:False, main:False, define-if-possible:True}
]
}
CLASS-LOADER-SEARCH:{JAR_COUNT:1, JAR:[
{name:jsentry.jar, bootstrap:False, system:False}
]
}
CLASS-TRANSFORM:{preload:True, define-home:"conf/tc/"}
jvas-v1.0.0: daemon task 31389 enter
jvas-v1.0.0: try to establish necessary JVM environments
jvas-v1.0.0: be loaded successfully
JVMTI Capabilities{
can_tag_objects=1;
can_generate_field_modification_events=0;
can_generate_field_access_events=0;
can_get_bytecodes=1;
can_get_synthetic_attribute=1;
can_get_owned_monitor_info=0;
can_get_current_contended_monitor=0;
can_get_monitor_info=1;
can_pop_frame=0;
can_redefine_classes=1;
can_signal_thread=1;
can_get_source_file_name=1;
can_get_line_numbers=1;
can_get_source_debug_extension=0;
can_access_local_variables=0;
can_maintain_original_method_order=0;
can_generate_single_step_events=0;
can_generate_exception_events=0;
can_generate_frame_pop_events=0;
can_generate_breakpoint_events=0;
can_suspend=1;
can_redefine_any_class=1;
can_get_current_thread_cpu_time=1;
can_get_thread_cpu_time=1;
can_generate_method_entry_events=0;
can_generate_method_exit_events=0;
can_generate_all_class_hook_events=1;
can_generate_compiled_method_load_events=1;
can_generate_monitor_events=1;
can_generate_vm_object_alloc_events=1;
can_generate_native_method_bind_events=1;
can_generate_garbage_collection_events=1;
can_generate_object_free_events=1;
can_force_early_return=0;
can_get_owned_monitor_stack_depth_info=0;
can_get_constant_pool=1;
can_set_native_method_prefix=1;
can_retransform_classes=1;
can_retransform_any_class=1;
can_generate_resource_exhaustion_heap_events=1;
can_generate_resource_exhaustion_threads_events=1;
}
jvas-v1.0.0: The JVM phase is "Live" now
jvas-v1.0.0: add class loader search if possible
System Property: java.vm.compressedOopsMode = 32-bit
System Property: sun.java.launcher = SUN_STANDARD
System Property: sun.java.command = autoVerify.war
System Property: java.vm.vendor = Red Hat, Inc.
System Property: java.vm.specification.version = 11
System Property: java.vm.specification.vendor = Oracle Corporation
System Property: java.vm.info = mixed mode, sharing
System Property: jdk.boot.class.path.append =
System Property: java.class.path = autoVerify.war
System Property: java.home = /usr/lib/jvm/java-11-openjdk-11.0.15.0.9-2.el7_9.x86_64
System Property: java.library.path = /usr/lib/jvm/java-11-openjdk-11.0.15.0.9-2.el7_9.x86_64/lib/server:/usr/lib/jvm/java-11-openjdk-11.0.15.0.9-2.el7_9.x86_64/lib:/usr/lib/jvm/java-11-openjdk-11.0.15.0.9-2.el7_9.x86_64/../lib::/usr/local/lib:/usr/lib/jvm/jre-11-openjdk/lib/server/:/usr/java/packages/lib:/usr/lib64:/lib64:/lib:/usr/lib
System Property: sun.boot.library.path = /usr/lib/jvm/java-11-openjdk-11.0.15.0.9-2.el7_9.x86_64/lib
System Property: jdk.debug = release
System Property: java.vm.name = OpenJDK 64-Bit Server VM
System Property: java.vm.version = 11.0.15+9-LTS
System Property: java.vm.specification.name = Java Virtual Machine Specification
jvas-v1.0.0: try to refer to or load necessary JAVA classes which serves for sentry
jvas-v1.0.0: failed to locate the class "jsentry/sabi"
Exception in thread "Thread-9" java.lang.NoClassDefFoundError: jsentry/sabi
Caused by: java.lang.ClassNotFoundException: jsentry.sabi
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:581)
at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
jvas-v1.0.0: succeed to define class 0x7f422c3e6f90 of "jsentry/sabi.class"
jvas-v1.0.0: failed to locate the class "jsentry/jvas_swi$jvas_init"
Exception in thread "Thread-9" java.lang.NoClassDefFoundError: jsentry/jvas_swi$jvas_init
Caused by: java.lang.ClassNotFoundException: jsentry.jvas_swi$jvas_init
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:581)
at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
jvas-v1.0.0: succeed to define class 0x7f422c3e6f98 of "jsentry/jvas_swi$jvas_init.class"
jvas-v1.0.0: failed to locate the class "jsentry/jvas_swi"
Exception in thread "Thread-9" java.lang.NoClassDefFoundError: jsentry/jvas_swi
Caused by: java.lang.ClassNotFoundException: jsentry.jvas_swi
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:581)
at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
jvas-v1.0.0: succeed to define class 0x7f422c3e6fa0 of "jsentry/jvas_swi.class"
begin(JLjava/lang/String;Ljava/lang/String;)I => 0x7f422cf15b18
end()V => 0x7f422cf15b20
setmode(I)I => 0x7f422cf15b28
getstatus()J => 0x7f422cf15b30
jvas-v1.0.0: succeed to self checking in the class "jsentry/jvas_swi"
XML document correct, conf/tc//TransformClasses.xml
jvas-v1.0.0: succeed to load 1 definitions of class-transformation
jvas-v1.0.0: succeed to setup JVM events handlers
jvas-v1.0.0: JVAS_SWI_SetMode OK
jvas-v1.0.0: succeed to enable sentry automatically

_____ __ ___ _____ _____
__/|_/ ___/____ ___ _____/ /________ ______ ___ / / | / / | / ___/
| /\__ \/ __ \/ _ \/ ___/ __/ ___/ / / / __ `__ \ __ / /| | / / /| | \__ \
/_ __|___/ / /_/ / __/ /__/ /_/ / / /_/ / / / / / / / /_/ / | |/ / ___ |___/ /
|/ /____/ .___/\___/\___/\__/_/ \__,_/_/ /_/ /_/ \____/ |___/_/ |_/____/
/_/
>>> jvas-v1.0.0 Created by CXX <<<
jvas-v1.0.0: begin to re-transforming
==================== In Thread jvas_init ====================
jvas_swi: try to load "/usr/local/lib/libSentry.so"
jvas-v1.0.0: JNI_OnLoad, agent reference count is 1
jvas_jni_test: 65536, jvas_swi initiation complete finished with 10000
jvas_swi: initiation finished
jvas_tc_retransform_classes: can not find the class "com/example/demo/Print"
jvas-v1.0.0: enter into daemon loop
jvas-v1.0.0: sentry_library_initiate(4, 0x7f42365c0010)
jvas_ehr_ClassFileLoadHook: (nil), 0x7f41bc000958, com/example/demo/Print, 0x7f41bc000960, 716, 0x7f4198000dc0, 0x7f41e44c09e0, 0x7f41e44c09f0
jvas_tc_transform: succeed to transform the class file "com/example/demo/Print", with the stub "jsentry/__Print", new class file size=2238
9999
1661159051068 9986
8888
9999
1661159056069 9986
8888
jvas daemon, 31389, 0x7f418f5c9f7a, 0
9999
1661159057069 9986
8888
jvas_ehr_ClassFileLoadHook: (nil), 0x7f41bc00c7f8, org/apache/catalina/webresources/Cache$EvictionOrder, 0x7f41bc00c800, 1375, 0x7f41bc6b6e70, 0x7f4214187570, 0x7f4214187580
jvas_ehr_ClassFileLoadHook: (nil), 0x7f41bc00c7f8, org/apache/tomcat/PeriodicEventListener, 0x7f41bc00c800, 171, 0x7f41bc38d2a0, 0x7f42141875a0, 0x7f42141875b0
9999
1661159058069 9986
8888
9999
1661159059069 9986
8888
jvas daemon, 31389, 0x7f418f5c9f7a, 0

源码流程

提取运行环境识别组成 :

- 当前设备: /etc/machine-id
- 当前设备机器号: /sys/class/dmi/id/product_uuid  [需要root]
- 部分云产品id: /var/lib/cloud/data/instance-id [私有云可能不存在]
- 当前网卡的mac地址集