4

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done.

I expect that this is a well-solved problem, but I lack the terminology to find a solution after several hours of searching:

I have a java program (stored in a jar file) that I'd like to observe (reverse engineer?) it while it runs. I see a lot of decompilation support for java - this isn't what I'm interested in at all, so please refrain from explaining how to do this. A major problem I'm having in my search is running into these kinds of answer.

Ideally, I'd:

  1. Start the program and find the PID.
  2. Attach a debugger to the JVM somehow (this is what I don't know how to do, and lack the language to search for, apparently)
  3. Use the debugger to set breakpoints, read/write arbitrary memory of the JVM, see the JVM's registers and stack.
  4. Use a simple, open-source command-line tool to do this, like Radare2 or GDB.

I expect to be reading java bytecode (the instruction set for the JVM), not java source, while I do this.

I am used to using Radare2 and GDB for native code (crackmes, CTF stuff, microcorruption). I also see that they both technically support Java, but I'm having a hard time figuring out how to do this, exactly.

I need help with 2 things: what software to use and how to attach the program to the process. Bonus points if I can use radare!

To be clear, the Java in question is running on a linux PC, not on an Android phone or anything like that.

I also read about JDB, but it seems like the code needs to be compiled with debug flags, and this is not possible for my situation -- it also doesn't seem like what I'm looking for.

  • 2
    This isn't a lightweight solution but would you consider adding the jar to an IDE like IntelliJ and use the debugger from there? I tested it out on a small app and it worked just fine. – Col-E Aug 6 '19 at 2:12
2

You can use jdb to attach to a running program without having compiled it with debug flags.

on my machine with jdb located at /usr/local/jdk/jdk1.8.0_202/bin/jdb and pid of my running java process = 14476

sudo /usr/local/jdk/jdk1.8.0_202/bin/jdb -connect sun.jvm.hotspot.jdi.SAPIDAttachingConnector:pid=14476

However if you did not compile your program with debugging information it is going to make debugging much harder i think.

see this reference for more info.

EDIT: i also found i can view variable values of a running process easily with jvisualvm wich is a tool that comes with oracles jdk.

1) start jvisualvm from the command line. It is located in your jdk bin folder.

/usr/local/jdk/jdk1.8.0_202/bin/jvisualvm

2) on the right side of the screen you can see the running java processes on your machine. You can then perform a heap dump (right click on process) and view the values of the variables of the classes your interested in.

heapdump

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.