Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Instrument to Remove: Using Java agents for fun...

Instrument to Remove: Using Java agents for fun and profit

Have you ever written a Java agent? This talk will give you an introduction into writing small custom Java agents to create profilers or help with dead code removal, and how to write basic byte-code instrumentations.

I'll present you with all the techniques to write a Java agent and javassist based instrumentation code to find unused classes and dependencies in your project. Knowing which classes and dependencies are not used in your application can save you from considering the bugs and problems in these dependencies and classes if you remove them, helping to guard against supply chain attacks.

Java agents and instrumentation of a few lines of code can save you a lot of effort and implementing them is great fun :)

Johannes Bechberger

October 17, 2023
Tweet

More Decks by Johannes Bechberger

Other Decks in Programming

Transcript

  1. <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-validation</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-thymeleaf</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId>

    <artifactId>spring-boot-starter-test</artifactId> <scope>test</scope> </dependency> <!-- Databases - Uses H2 by default --> <dependency> <groupId>com.h2database</groupId> <artifactId>h2</artifactId> <scope>runtime</scope> </dependency> <dependency> <groupId>com.mysql</groupId> <artifactId>mysql-connector-j</artifactId> <scope>runtime</scope> </dependency>
  2. Software systems have a natural tendency to grow in size

    and complexity over time. A part of this growth comes with new features or bug fixes, while another part is due to useless code that accumulates over time. The problem of safely debloating real-world applications remains a long- standing software engineering endeavor today. — Soto-Valero et. al “ Source: https://arxiv.org/pdf/2008.08401.pdf
  3. So let’s write our own * as a proof of

    concept for a blog post *
  4. When are static initializers called “ • T is a

    class and an instance of A is created. • A static method declared by A is invoked. • A static field declared by A is assigned. • A static field declared by A is used and the field is not a constant variable – JLS SE17 §12.4.2. Detailed Initialization Procedure
  5. Static initializers in interfaces interface I { static { Store.getInstance().processClassUsage("I");

    } public void method(); } Forbidden in Java Allowed in Byte code
  6. Classes found in byte code Recorded classes Bloat classes Dynamically

    generated classes (e.g. for lambdas) Remove
  7. class UnusedClass { static { LOG.error("Class UnusedClass is used "

    + "which is not allowed"); } private int field; public void method() {...} }
  8. Structure JVM with Agent Instrumenter Used Classes Instrumenter JVM Instr.

    JAR Used Classes Reduced JAR JAR with Error Messages JAR Due to Spring classloader magic
  9. package java.lang; public final class String implements ... { static

    { Store.getInstance().processClassUsage("java.lang.String"); } @Stable private final byte[] value; ... public String() {...} ... }
  10. Class Loader Hierarchies platform app bootstrap X Y class reference

    delegates to searches in runtime.jar https://mostlynerdless.de/blog/2023/06/02/class-loader-hierarchies/
  11. Normally public static void main(String[] args) { ... } public

    static void main(String args[]) { ... } void main() { ... }
  12. Main Class public static void agentmain(String agentArgs) { ... }

    JVM start later attach attach public static void premain(String agentArgs) { ... }
  13. Main Class public static void agentmain(String agentArgs, Instrumentation inst) {

    ... } public static void premain(String agentArgs, Instrumentation inst) { ... }
  14. Main Class public class Main { public static void premain(String

    agentArgs, Instrumentation inst) { AgentOptions options = new AgentOptions(agentArgs); ... inst.appendToBootstrapClassLoaderSearch( new JarFile(getExtractedJARPath().toFile())); ... inst.addTransformer(new ClassTransformer(options), true); } ... } Instrumentation.retransformClasses
  15. ClassTransformer extends ClassFileTransformer “ An agent registers an implementation of

    this interface using the addTransformer method so that the transformer’s transform method is invoked when classes are loaded, redefined, or retransformed – ClassFileTransformer Documentation
  16. ClassTransformer#transform byte[] transform( ClassLoader loader, String className, Class<?> klass, ProtectionDomain

    domain, byte[] classfileBuffer) throws IllegalClassFormatException { ... }
  17. ClassTransformer#transform private void transform(String className, CtClass cc) { String cn

    = formatClassName(className); Store.getInstance() .processClassLoad(cn,cc.getClassFile().getInterfaces()); cc.makeClassInitializer() .insertBefore( String.format("me.bechberger.runtime.Store.getInstance()" + ".processClassUsage(\"%s\");", cn)); } ?
  18. With Spring-PetClinic Class org.apache.tomcat.util.net.SocketBufferHandler is used which is not allowed

    Class org.apache.tomcat.util.net.SocketBufferHandler$1 is used which is not allowed Class org.apache.tomcat.util.net.NioChannel is used which is not allowed Class org.apache.tomcat.util.net.NioChannel$1 is used which is not allowed ... java -javaagent:./target/dead-code.jar=output=classes.txt \ -jar petclinic.jar u ch.qos.logback.classic.encoder.PatternLayoutEncoder l ch.qos.logback.classic.joran.JoranConfigurator u ch.qos.logback.classic.jul.JULHelper u ch.qos.logback.classic.jul.LevelChangePropagator ...