Java Debugging Internals @yardenlaif 

2 Who Am I? • Software Engineer at Rookout • Java, Go, Ruby • C#, Python, JavaScript, C++ • Amateur sewist 

The Objective: Dynamic Snapshots ● Dynamically add/remove snapshots on lines of code ● Capture local variables ● Capture stack trace 3 

The Objective: Dynamic Snapshots ● Dynamically add/remove snapshots on lines of code ● Capture local variables ● Capture stack trace 4 Breakpoints? 

The Objective: Dynamic Snapshots ● Dynamically add/remove snapshots ● Capture local variables ● Capture stack trace 5 Breakpoints? breakpoints on lines of code 

Production Grade Breakpoints ● Minimum performance impact ● Debug more than one instance at a time ● Multiple people debugging the same instance 6 

jdb -attach 8000 java -agentlib:jdwp= transport=dt_socket,server=y, suspend=n,address=*:8000 myApp JDB - The Java Debugger 7 JVM MyApp Debugger CLI 

JPDA - Java Platform Debugging Architecture The Java Platform Debugger Architecture (JPDA) consists of three interfaces designed for use by debuggers in development environments for desktop systems. - Oracle Documentation 8 

JPDA - Java Platform Debugging Architecture ● JDI - Java Debug Interface ● JDWP - Java Debug Wire Protocol ● JVMTI - Java Virtual Machine Tool Interface 9 

JDI - Java Debug Interface ● High level Java API ● Inspect & Control ● Connect remotely 10 

JDI - Simple Debugger Flow ● Launch and connect ○ Get VirtualMachine instance ○ Request to get events (breakpoint, watchpoint, threadStop, threadStart…) ● When class is prepared, add a breakpoint ● When breakpoint is hit, print variables 11 

Using JDI ● No availability during collection ● Zero control or visibility ● Easy to make mistakes ● Single instance debugging 12 

JPDA - Java Platform Debugging Architecture ● JDI - Java Debug Interface ● JDWP - Java Debug Wire Protocol ● JVMTI - Java Virtual Machine Tool Interface 13 

JDWP - Java Debug Wire Protocol ● A protocol ● Used for communication between a debugger and the JVM which it debugs 14 JVM MyApp Debugger CLI JDWP 

Using JDWP ● No availability during collection ● Zero control or visibility ● Easy to make mistakes ● Single instance debugging ● Managing multiple clients and connecting to multiple servers 15 

JVMTI - Java Virtual Machine Tool Interface ● Native programming interface ● Interacts directly with the JVM ● Inspect & Control 16 

JPDA - Java Platform Debugging Architecture ● JDI - Java Debug Interface ● JDWP - Java Debug Wire Protocol ● JVMTI - Java Virtual Machine Tool Interface 17 

JVMTI - Get Stack Trace /* Get Stack Trace */ err = (*jvmti)->GetStackTrace(jvmti, thr, 0, 5, &frames, &count); if (err != JVMTI_ERROR_NONE) { printf("(GetThreadInfo) Error expected: %d, got: %d\n", JVMTI_ERROR_NONE, err); describe(err); printf("\n"); } printf("Number of records filled: %d\n", count); if (err == JVMTI_ERROR_NONE && count >=1) { char *methodName; methodName = "yet_to_call()"; char *declaringClassName; jclass declaring_class; int i=0; printf("Exception Stack Trace\n"); printf("=====================\n"); printf("Stack Trace Depth: %d\n", count); for ( i=0; i < count; i++) { err = (*jvmti)->GetMethodName(jvmti, frames[i].method, &methodName, NULL, NULL); if (err == JVMTI_ERROR_NONE) { err = (*jvmti)->GetMethodDeclaringClass(jvmti, frames[i].method, &declaring_class); err = (*jvmti)->GetClassSignature(jvmti, declaring_class, &declaringClassName, NULL); if (err == JVMTI_ERROR_NONE) { printf("at method %s() in class %s\n", methodName, declaringClassName); } } } } 18 *A lot of code* 

Java - Get Stack Trace Thread.currentThread().getStackTrace() 19 

Using JVMTI ● Incredibly Complex ● Native vulnerabilities ● Not portable ● Bugs are catastrophic 20 

21 Newer? Simpler? Full control? In-process? Unbreakable? 

Java Agents 22 

Java Agents 23 JVM MyApp Java Agent java.lang.Instrument API 

Sample Program 24 1| public class HelloWorld { 2| public static void main(String[] args) { 3| while(true) { 4| System.out.println("Hello, World!"); 5| } 6| } 7| } 

Sample Program 25 ● Build HelloWorld to JAR ● Run: java -jar HelloWorld.jar ● Output: Hello, World! Hello, World! ... 

Java Agent - Premain 26 public class JavaAgent { public static void premain(String agentArgs, Instrumentation instrumentation) throws Exception { System.out.println("Hello, JavaSummit!"); } } 

Java Agent - Premain 27 public class JavaAgent { public static void premain(String agentArgs, Instrumentation instrumentation) throws Exception { System.out.println("Hello, JavaSummit!"); } } 

Java Agent - Premain 28 public class JavaAgent { public static void premain(String agentArgs, Instrumentation instrumentation) throws Exception { System.out.println("Hello, JavaSummit!"); } } 

Java Agent - Premain 29 public class JavaAgent { public static void premain(String agentArgs, Instrumentation instrumentation) throws Exception { System.out.println("Hello, JavaSummit!"); } } 

Java Agent - Premain 30 ● Build JavaAgent to JAR ● Run with java agent: java -javaagent:JavaAgent.jar -jar HelloWorld.jar ● Output: Hello, JavaSummit! Hello, World! ... 

Java Agent - ClassFileTransformer 31 JVM Compiler Code Bytecode 

Java Agent - ClassFileTransformer 32 JVM 32 | … 33 | new Item() 34 | … Class Loader Get Item class bytecode Return Item class bytecode 

Java Agent - ClassFileTransformer 33 JVM 32 | … 33 | new Item() 34 | … Class Loader Get Item class bytecode Return Item class bytecode Class File Transformer Return transformed Item class bytecode 

Java Agent - ClassFileTransformer 34 public class JavaAgent { public static void premain(String agentArgs, Instrumentation instrumentation) throws Exception { System.out.println("Hello, JavaSummit!"); } } ● void addTransformer(ClassFileTransformer transformer); 

Java Agent - ClassFileTransformer 35 public class DebugTransformer implements ClassFileTransformer { @Override public byte[] transform(ClassLoader classLoader, String className, Class classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) { 

Java Agent - ClassFileTransformer 36 public class DebugTransformer implements ClassFileTransformer { @Override public byte[] transform(ClassLoader classLoader, String className, Class classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) { 

Java Agent - ClassFileTransformer 37 public class DebugTransformer implements ClassFileTransformer { @Override public byte[] transform(ClassLoader classLoader, String className, Class classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) { 

Open Source Bytecode Manipulation Tools BCEL ASM 38 

Bytecode Abstraction 39 ● AbstractInsnNode ○ JumpInsnNode ○ MethodInsnNode ○ VarInsnNode ● InsnList instructions 

Bytecode Manipulation 40 byte[] addPrintCall(byte[] classfileBuffer) { // Add call to System.out.println("Transformed!") // Return transformed bytecode } 

Java Agent - ClassFileTransformer 41 public class DebugTransformer implements ClassFileTransformer { @Override public byte[] transform(ClassLoader classLoader, String className, Class classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) { if (className.contains("HelloWorld")) { return addPrintCall(classfileBuffer); } return classfileBuffer; } } 

Java Agent - ClassFileTransformer 42 public class DebugTransformer implements ClassFileTransformer { @Override public byte[] transform(ClassLoader classLoader, String className, Class classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) { if (className.contains("HelloWorld")) { return addPrintCall(classfileBuffer); } return classfileBuffer; } } 

Java Agent - Premain 43 public class JavaAgent { public static void premain(String agentArgs, Instrumentation instrumentation) throws Exception { DebugTransformer transformer = new DebugTransformer(); instrumentation.addTransformer(transformer); } } 

Java Agent - Premain 44 public class JavaAgent { public static void premain(String agentArgs, Instrumentation instrumentation) throws Exception { DebugTransformer transformer = new DebugTransformer(); instrumentation.addTransformer(transformer); } } 

Java Agent - Premain 45 ● Build JavaAgent to JAR ● Run with java agent: java -javaagent:JavaAgent.jar -jar HelloWorld.jar ● Output: Transformed! Hello, World! Hello, World! ... 

Dynamic Snapshots! 

The Method: Inject a Hook ● Inject a hook that will execute a specific function on the line of the snapshot 47 11: System.out.println(“Hello world!”); 12: return; Breakpoint() 

Profiling Interpreter C2 C1 Profiling Profiling Interpreter C2 C1 Profiling JVM Execution Engine 48 

The Method: Inject a Hook ● Pass all local variables to function 49 11: System.out.println(“Hello world!”); 12: return; Breakpoint(locals) 

Add Breakpoint 50 public void Breakpoint(Object[] locals) { System.out.println("Breakpoint hit!"); for (Object local : locals) { System.out.println(local); } } 

Add Breakpoint 51 byte[] addBreakpoint(byte[] classfileBuffer, int lineno) { // Find where to insert Breakpoint call // Push local variables onto stack // Insert call to Breakpoint // Return transformed bytecode } 

Add Breakpoint 52 byte[] addBreakpoint(byte[] classfileBuffer, int lineno) { // Find where to insert Breakpoint call // Push local variables onto stack // Insert call to Breakpoint // Return transformed bytecode } 

Add Breakpoint 53 byte[] addBreakpoint(byte[] classfileBuffer, int lineno) { // Find where to insert Breakpoint call // Push local variables onto stack // Insert call to Breakpoint // Return transformed bytecode } 

Add Breakpoint 54 byte[] addBreakpoint(byte[] classfileBuffer, int lineno) { // Find where to insert Breakpoint call // Push local variables onto stack // Insert call to Breakpoint // Return transformed bytecode } 

Add Breakpoint 55 byte[] addBreakpoint(byte[] classfileBuffer, int lineno) { // Find where to insert Breakpoint call // Push local variables onto stack // Insert call to Breakpoint // Return transformed bytecode } 

Sample Program 56 1| public class HelloWorld { 2| public static void main(String[] args) { 3| while(true) { 4| System.out.println("Hello, World!"); 5| } 6| } 7| } 

Java Agent - ClassFileTransformer 57 public class DebugTransformer implements ClassFileTransformer { @Override public byte[] transform(ClassLoader classLoader, String className, Class classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) { if (className.contains("HelloWorld")) { return addBreakpoint(classfileBuffer, 4); } return classfileBuffer; } } 

Java Agent - Premain 58 ● Build JavaAgent to JAR ● Run with java agent: java -javaagent:JavaAgent.jar -jar HelloWorld.jar ● Output: Breakpoint hit! [Ljava.lang.Object;@3d075dc0 Hello, World! ... 

59 What if the class has already been loaded? 

Magic Instrumentation 60 void redefineClasses(ClassDefinition... definitions) void retransformClasses(Class... classes) 

Putting it all together 61 ● Transform on demand ● Add call to breakpoint function ● Access locals as objects 

62 Putting it all together 

Thank You @yardenlaif rookout.com