java 检查 .class 文件中的内容

check content in .class files

提问by James Raitsev

Suppose one learned that certain developer hardcoded a bunch of usernames and passwords into application, which made it into Production. Oh-oh ..!

假设有人了解到某个开发人员将一堆用户名和密码硬编码到应用程序中，从而使其进入生产环境。哦哦..！

You know both username and password - is there a way to scan the bytecode and identify whether in fact username, password was hardcoded?

您知道用户名和密码 - 有没有办法扫描字节码并确定用户名和密码实际上是否是硬编码的？

回答by Stephen C

A simple way to see what String literals are used in a ".class" file is to use the javaputility in your JDK installation to dump the file using the "-v" option. Then grepfor text that looks like <String "...">where ...is the String you are looking for.

查看“.class”文件中使用的字符串文字的一种简单方法是使用javapJDK 安装中的实用程序使用“-v”选项转储文件。然后grep对于看起来像您正在寻找的字符串<String "...">在哪里的文本...。

UPDATE

更新

The latest documentation for javapis here, but the old version looks nicer IMO.

有关最新文档javap是在这里，但老版看起来更好IMO。

回答by Nirmit Shah

You can use java decompilers to decompile your class (and to check whether the class contains hardcoded username/passwords) Have a look at:

您可以使用 java 反编译器来反编译您的类（并检查该类是否包含硬编码的用户名/密码）看看：

• JD-GUI
• JAD

• 图形界面
• JAD

回答by Richard J. Ross III

Have you looked into JD-GUI? You can see there if that has been hardcoded into any of the class files.

你看过JD-GUI吗？您可以在那里查看是否已将其硬编码到任何类文件中。

回答by Balaji Boggaram Ramanarayan

May be helpful for others in future. (From How can I open Java .class files in a human-readable way?)

将来可能对其他人有帮助。（来自如何以人类可读的方式打开 Java .class 文件？）

Usage: javap <options> <classes>...

where options include:
   -c                        Disassemble the code
   -classpath <pathlist>     Specify where to find user class files
   -extdirs <dirs>           Override location of installed extensions
   -help                     Print this usage message
   -J<flag>                  Pass <flag> directly to the runtime system
   -l                        Print line number and local variable tables
   -public                   Show only public classes and members
   -protected                Show protected/public classes and members
   -package                  Show package/protected/public classes
                             and members (default)
   -private                  Show all classes and members
   -s                        Print internal type signatures
   -bootclasspath <pathlist> Override location of class files loaded
                             by the bootstrap class loader
   -verbose                  Print stack size, number of locals and args for methods
                             If verifying, print reasons for failure