blocks|key|676360|text|如果你不能控制环境，那么我很抱歉--你真的被卡住了。是的，您可以通过某种cmdline嗅探来查找微不足道的JVMTI代理，但这是您最不需要担心的。考虑一下java/lang/Classloader.fineClass()被直接破坏的情况。如果你拥有这个盒子，这很容易做到-只需在rt.jar中替换.class文件即可。事实上，在JVMTI出现之前，这是分析器和监视工具检测Java代码的典型方式。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|676361|回到JVMTI+--+"Late+attach“特性还允许动态加载JVMTI代理。当您第一次扫描时，这可能不会发生。|676362|底线-如果有人可以更改磁盘上JRE的字节，他们就可以做任何他们想做的事情。这符合道德吗，不是吗？他们会被抓到吗？有可能，但你永远不会赢得这场战争。|676363|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

If you don't control the environment, then I'm sorry - you're really stuck. Yes, you could look for trivial JVMTI agents via some sort of cmdline sniffing, but that's the least of your worries. Think about java/lang/Classloader.defineClass() being compromised directly. That's easy to do if you own the box - just replace the .class file in rt.jar. In fact, until JVMTI came around, that was a typical way that profilers and monitoring tools instrumented Java code.

Going back to JVMTI - the "Late attach" feature also allows for JVMTI agents to be loaded on the fly. That might not have happened when you scanned the first time around.

Bottom line - if someone can change the bytes of the JRE on disk, they can do anything they want. Is it ethical, no? Can they get caught? Possibly, but you'll never win the war.

blocks|key|3948168|text|看起来我可以在一些自定义JNI本机代码中使用检查的组合。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3948169|1.)cmd线路嗅探以搜索座席。2.)确保cmd-line参数-XX:%2BDisableAttachMechanism存在。(这将防止用户连接到我正在运行的虚拟机)|3948170|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

It looks like I can go with a combination of checks inside some custom JNI native code.

1.) cmd line sniffing to search for agents.
2.) Ensure that the cmd-line parameter -XX:+DisableAttachMechanism exists. (this will prevent people from attaching to my running VM)

blocks|key|2588674|text|我记得我曾经做过一个几乎是静默的Java+Agent。我想你最好找个端口扫描器或者其他什么东西。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2588675|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I remember I once made almost a silent Java Agent. I guess you better look for port scanners or something around that.

blocks|key|2596703|text|Java+2安全性，jars签名等，提供了对加载到应用程序中的内容的一定程度的控制。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2596704|然而，最终，如果一个恶意的人可以访问一台机器，这样他们就可以写入磁盘，那么在所有的可能性中，他们都有足够的能力进行破坏，而不需要求助于聪明的Java黑客。|2596705|反过来，在任何语言中，您可以做些什么来检测特洛伊木马程序？|2596706|对您关心的机器进行仔细的访问控制不是微不足道的，但如果您认真对待此类问题，则是必不可少的。安全专家可能看起来很偏执，但这通常意味着他们真正了解风险。|2596707|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

Java 2 security, signing of jars etc, gives some level of control over what gets loaded into your application.

However in the end if a malicious person has access to a machine such that they can write to disk then in all probability they have plenty of capacity to do harm without resorting to clever Java hacks.

Turn this round, in any language what can you do to detect Trojans? 

Careful access control to the machines you care about is non-trivial but essential if you are serious about such issues. Security specialists may seem paranoid, but that often means that they really understand the risks.

blocks|key|676321|text|如果你不能控制平台，你就不能控制平台上的软件。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|676322|即使您可以关闭您列出的所有检查途径，Java也是开放源代码的。他们可以只获取源代码，并通过内置的必要更改重新编译它。|676323|此外，请记住，虽然这是你的代码，但它是他们的机器。他们有权检查你的代码，以验证在他们的机器上运行它是否做了他们期望它做的事情，并且没有执行他们可能认为不需要的“额外”操作。过去，可信度较低的公司会扫描不相关的文件，将敏感信息复制回其家庭服务器等。|676324|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

If you can't control the platform, you can't control the software upon it.

Even if you could shut down all the avenues of inspection you've listed, Java is open source. They could just take the source code and recompile it with the necessary changes built-in.

Also, try to remember that while it is your code, it's their machine. They have a right to inspect your code to verify that running it on their machine does what they expect it to do, and doesn't perform "extra" actions which they might find undesirable. Less trustworthy companies in the past have scanned for non-relevant files, copied sensitive information back to their home servers, etc.

blocks|key|3948031|text|我会查看命令行，看看是否有任何"-agent“参数。所有分析器、调试器和其他代码修改器都使用它进行自省。您还可以检查bootclasspath上是否有不寻常的jar，因为这些jar也可能带来威胁(但请注意，您还必须交付自定义的JVM，因为一些软件，如Quicktime，会将自身添加到所有运行的java应用程序的bootclasspath中...(当我看到那个的时候，我简直不敢相信我的眼睛…)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3948032|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I would look at the command line and see, if there are any "-agent" parameters. All profilers, debuggers and other code modificators use this for introspection. You could also check for unusual jars on the bootclasspath, since those might also provide a threat (but be aware that you then also must deliver a custom JVM, since some software like Quicktime adds itself to the bootclasspath of ALL java apps running... (I couldn't belive my eyes when I saw that...))

blocks|key|684882|text|基本上，这是一场失败的战斗。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|684883|让我们来看看Sun+JDK中的visualvm是如何工作的，以及它如何附加到正在运行的进程并重新定义它喜欢的任何东西。很难用可移植的方式检测到这一点，除非你能做到，否则你最好放弃这种方法。|684884|问题是，你想要避免什么呢？|684885|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

Basically this is a loosing battle. 

Have a look at how visualvm in the Sun JDK works and how it can attach to a running process and redefine whatever it pleases. It is extremely hard to detect that in a portable way, and unless you can do so, you might as well give up on this approach. 

The question is, what is it you want to avoid?

How does one secure the Java environment when running on a machine you don't control? What is to stop someone from creating a java agent or native JVMTI agent and dumping bytecode or re-writing classes to bypass licensing and/or other security checks? Is there any way to detect if any agents are running from Java code? From JNI? From a JVMTI agent?

How to detect Java agents, JVMTI, etc

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

当在不受控制的机器上运行时，如何保护Java环境？怎样才能阻止某人创建java代理或原生JVMTI代理，并转储字节码或重写类以绕过许可和/或其他安全检查？有没有办法检测是否有代理正在从Java代码运行？从JNI？从JVMTI代理？

问如何检测Java代理、JVMTI等
EN

回答 7

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何检测Java代理、JVMTI等EN

回答 7

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何检测Java代理、JVMTI等
EN