How to verify Java Bytecode before injecting into the JVM?

Question

I'm trying to verify "on the fly" generated bytecode!

I already had several attempts, one attempt was to compile my classes in runtime with the eclipse compiler another was to compile from memory as mentioned here:

Compile From Memory

First results looked okay but I'm still not a 100% sure if the verification process is truly valid according to the JAVA 6 guidelines and security measurements as well to normal OOP Models.

Any better way on how to verify bytecode?

how is this related to [assembly]? I guess you meant [java-bytecode-asm], right? — Stefan Paul Noack, Mar 29 '12 at 13:43
What do you mean by "verify"? Do you mean for instance type-check? — aioobe, Mar 29 '12 at 13:45
I never used the assembly tag, dont know why this was there... — Evils, Mar 29 '12 at 20:45
Why I mean with verify is that I need to secure that there are no schematic problems like wrong inheritance and stuff, so I just need to secure that my bytecode does not break with java 6 rules — Evils, Mar 29 '12 at 21:02

score 1 · Accepted Answer · answered Mar 29 '12 at 13:42

1

If you load the generated bytecode using a standard class loader, the bytecode verifier of the JVM will verify (make sure it type checks, never falls of the "edge" of a method and so on) the bytecode for you.

answered Mar 29 '12 at 13:42

aioobe

413,195
112
811
826

okay, it works. But is there a way to get better exceptions/error reports? Or to get information why verification failed? – Evils Apr 01 '12 at 20:12
Not that I know of. Despite a lot of bytecode hacking I've never found a good way to debug such type of problems. – aioobe Apr 01 '12 at 20:33
1

@Evils The JVM doesn't provide helpful error messages for verification failure. You're only options are to either recompile the JVM or use a different tool. I've actually written one myself but there are probably other tools out there that could help as well. – Antimony Oct 27 '12 at 04:09

score 0 · Answer 2 · answered Apr 09 '16 at 01:46

0

You can use the class verifier provided by the ASM toolkit. That does not require actually loading the classes by the JVM, and gives you more detailed verification error reports.

answered Apr 09 '16 at 01:46

mjanicek

81
1
4

While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - [From Review](http://stackoverflow.com/review/late-answers/11950712) – Raju Apr 09 '16 at 02:06

How to verify Java Bytecode before injecting into the JVM?

2 Answers2