Decapsulation: Breaking Java Strong Encapsulation

// Implementing makeLookup() in a way that allows this is the goal
Lookup lookup = makeLookup();
String foo = "foo"; // a String which is supposed to be immutable
// Use Lookup to grab the private `value` field of the String.
MethodHandle methodHandle = lookup.findGetter(String.class, "value", byte[].class);
byte[] value = (byte[]) methodHandle.invokeExact(foo);
value[0] = 'm'; // Mutate the String
System.out.println(foo); // prints "moo"

Lookup makeLookup() throws Exception {
  Lookup lookup = MethodHandles.lookup();
  Field allowedModes = Lookup.class.getDeclaredField("allowedModes");
  allowedModes.setAccessible(true);
  allowedModes.set(lookup, -1); // -1 is Lookup.TRUSTED
  return lookup;
}

static final Lookup IMPL_LOOKUP = new Lookup(Object.class, null, TRUSTED);

Field implLookup = Lookup.class.getDeclaredField("IMPL_LOOKUP");
implLookup.setAccessible(true);
return (Lookup) implLookup.get(null);

static Unsafe getUnsafe() throws ReflectiveOperationException {
  Field f = Unsafe.class.getDeclaredField("theUnsafe");
  f.setAccessible(true);
  return (Unsafe) f.get(null);
}

Lookup makeLookup() throws ReflectiveOperationException {
  Unsafe unsafe = getUnsafe();
  Field field = Lookup.class.getDeclaredField("IMPL_LOOKUP");
  Object staticFieldBase = unsafe.staticFieldBase(field);
  long offset = unsafe.staticFieldOffset(field);
  return (Lookup) unsafe.getObject(staticFieldBase, offset);
}

#include <jni.h>

JNIEXPORT void JNICALL Java_decapsulation_UseJNI_setAllowedModes(
    JNIEnv *env, jclass cls, jobject lookup) {
  jclass lookupClass = (*env)->GetObjectClass(env, lookup);
  jfieldID fieldId = (*env)->GetFieldID(env, lookupClass, "allowedModes", "I");
  (*env)->SetIntField(env, lookup, fieldId, -1);
}

package decapsulation;
class UseJNI {
  static {
    String libFile = System.getProperty("os.name").startsWith("Windows")
        ? "usejni.dll" : "usejni.so";
    System.load(new File(libFile).getAbsolutePath());
  }

  private static native void setAllowedModes(Object lookup);

  Lookup makeLookup() {
    Lookup lookup = MethodHandles.lookup();
    setAllowedModes(lookup);
    return lookup;
  }
}

Path agentLoader = Files.createTempFile("JavaAgentLoader", ".java");
Files.writeString(agentLoader,
    "public class JavaAgentLoader {" +
        "  public static void main(String[] args) throws Exception {" +
        "    com.sun.tools.attach.VirtualMachine.attach(args[0]).loadAgent(args[1]);" +
        "  }" +
        "}");
agentLoader.toFile().deleteOnExit();
new ProcessBuilder()
    .command(System.getProperty("java.home") + "/bin/java",
        agentLoader.toString(),
        Long.toString(ProcessHandle.current().pid()),
        "our-agent.jar")
    .start()
    .waitFor();

class Agent {
  public static void agentmain(String arg, Instrumentation instrumentation) {
    // module where our other code lives too
    Module unnamedModule = Agent.class.getModule();
    var extraOpens = Map.of("java.lang.invoke", Set.of(unnamedModule));
    instrumentation.redefineModule(Lookup.class.getModule(),
        Set.of(), Map.of(), extraOpens, Set.of(), Map.of());
  }
}

Field implLookup = Lookup.class.getDeclaredField("IMPL_LOOKUP");
implLookup.setAccessible(true);
return (Lookup) implLookup.get(null);

void setAllowedModes() {
    JavaVM *vm;
    JNI_GetCreatedJavaVMs(&vm, 1, NULL);
    JNIEnv *env;
    (*vm)->GetEnv(vm, (void **)&env, JNI_VERSION_1_8);

    // Get the Lookup from `System.getProperties().get("decapsulation.lookup")`.
    jclass systemClass = (*env)->FindClass(env, "java/lang/System");
    jmethodID getPropsMid = (*env)->GetStaticMethodID(env, systemClass,
        "getProperties", "()Ljava/util/Properties;");
    jobject props = (*env)->CallStaticObjectMethod(env, systemClass, getPropsMid);
    jclass propsClass = (*env)->GetObjectClass(env, props);
    jmethodID getMid = (*env)->GetMethodID(env, propsClass,
    "get", "(Ljava/lang/Object;)Ljava/lang/Object;");
    jstring keyStr = (*env)->NewStringUTF(env, "decapsulation.lookup");
    jobject lookup = (*env)->CallObjectMethod(env, props, getMid, keyStr);

    jclass lookupClass = (*env)->GetObjectClass(env, lookup);
    jfieldID allowedModesId = (*env)->GetFieldID(env, lookupClass, "allowedModes", "I");
    (*env)->SetIntField(env, lookup, allowedModesId, -1);
}

Lookup lookup = MethodHandles.lookup();
System.getProperties().put("decapsulation.lookup", lookup);
Path lib = Path.of(System.getProperty("os.name").startsWith("Windows")
    ? "ffmlibrary.dll" : "ffmlibrary.so");
try (Arena arena = Arena.ofConfined()) {
  SymbolLookup symbols = SymbolLookup.libraryLookup(lib, arena);
  MethodHandle setAllowedModes = Linker.nativeLinker().downcallHandle(
      symbols.findOrThrow("setAllowedModes"),
      FunctionDescriptor.ofVoid());
  setAllowedModes.invoke();
}

public static void helloWorld() throws Exception {
  Class<?> ioClass = Class.forName("java.lang.IO");
  Method println = ioClass.getMethod("println", Object.class);
  println.invoke(null, "Hello world");
}

// Class<?> ioClass = Class.forName("java.lang.IO");
Class<?> clazz = Class.forName("java.lang.Class");
Method classForName = clazz.getMethod("forName", Class.forName("java.lang.String"));
Object ioClass = classForName.invoke(null, "java.lang.IO");

// Method println = ioClass.getMethod("println", Object.class);
Method getMethod = clazz.getMethod("getMethod", String.class, Class[].class);
Object println = getMethod.invoke(ioClass, "println", new Class[]{Object.class});

// println.invoke(null, "Hello world");
Class<?> methodClass = Class.forName("java.lang.reflect.Method");
Method invoke = methodClass.getMethod("invoke", Object.class, Object[].class);
invoke.invoke(println, null, new Object[]{"Hello world"});

Linker linker = Linker.nativeLinker();
try (Arena arena = Arena.ofConfined()) {
  Path libjvmPath = System.getProperty("os.name").startsWith("Windows")
      ? Path.of(System.getProperty("java.home"), "bin", "server", "jvm.dll")
      : Path.of(System.getProperty("java.home"), "lib", "server", "libjvm.so");
  SymbolLookup jvmSymbols = SymbolLookup.libraryLookup(libjvmPath, arena);

JavaVM *vm;
JNI_GetCreatedJavaVMs(&vm, 1, NULL);

MethodHandle getCreatedVMs = linker.downcallHandle(
    jvmSymbols.findOrThrow("JNI_GetCreatedJavaVMs"),
    FunctionDescriptor.of(JAVA_INT, ADDRESS, JAVA_INT, ADDRESS));
MemorySegment vmBuf = arena.allocate(ADDRESS);
getCreatedVMs.invoke(vmBuf, 1, MemorySegment.NULL);
MemorySegment vm = vmBuf.get(ADDRESS, 0).reinterpret(Long.MAX_VALUE);

JNIEnv *env;
(*vm)->GetEnv(vm, (void **)&env, JNI_VERSION_1_8);

typedef const struct JNIInvokeInterface_ *JavaVM;

struct JNIInvokeInterface_ {
    void *reserved0;
    void *reserved1;
    void *reserved2;
    jint (JNICALL *DestroyJavaVM)(JavaVM *vm);
    jint (JNICALL *AttachCurrentThread)(JavaVM *vm, void **penv, void *args);
    jint (JNICALL *DetachCurrentThread)(JavaVM *vm);
    jint (JNICALL *GetEnv)(JavaVM *vm, void **penv, jint version);
    jint (JNICALL *AttachCurrentThreadAsDaemon)(JavaVM *vm, void **penv, void *args);
};

// (*vm)->
MemorySegment invokeInterface = vm.get(ADDRESS, 0).reinterpret(Long.MAX_VALUE);
// GetEnv(vm, (void **)&env, JNI_VERSION_1_8);
MethodHandle getEnv = linker.downcallHandle(
    invokeInterface.getAtIndex(ADDRESS, 6),
    FunctionDescriptor.of(JAVA_INT, ADDRESS, ADDRESS, JAVA_INT));
MemorySegment envBuf = arena.allocate(ADDRESS);
getEnv.invoke(vm, envBuf, 0x00010008 /* JNI_VERSION_1_8 */);
MemorySegment env = envBuf.get(ADDRESS, 0).reinterpret(Long.MAX_VALUE);

MemorySegment nativeInterface = env.get(ADDRESS, 0).reinterpret(Long.MAX_VALUE);

MethodHandle newGlobalRef = linker.downcallHandle(
    nativeInterface.getAtIndex(ADDRESS, 21),
    FunctionDescriptor.of(ADDRESS, ADDRESS, ADDRESS));

// jclass systemClass = (*env)->FindClass(env, "java/lang/System");
MethodHandle findClass = linker.downcallHandle(
    nativeInterface.getAtIndex(ADDRESS, 6),
    FunctionDescriptor.of(ADDRESS, ADDRESS, ADDRESS));
MemorySegment systemClass = (MemorySegment) newGlobalRef.invoke(env,
    (MemorySegment) findClass.invoke(env, arena.allocateFrom("java/lang/System")));

// jclass lookupClass = (*env)->GetObjectClass(env, lookup);
MemorySegment lookupClass = (MemorySegment) newGlobalRef.invoke(env,
    (MemorySegment) getObjectClass.invoke(env, lookupRef));

// jfieldID allowedModesId = (*env)->GetFieldID(env, lookupClass, "allowedModes", "I");
MethodHandle getFieldID = linker.downcallHandle(
    nativeInterface.getAtIndex(ADDRESS, 94),
    FunctionDescriptor.of(ADDRESS, ADDRESS, ADDRESS, ADDRESS, ADDRESS));
MemorySegment allowedModesId = (MemorySegment) getFieldID.invoke(env, lookupClass,
    arena.allocateFrom("allowedModes"),
    arena.allocateFrom("I"));

// (*env)->SetIntField(env, lookup, allowedModesId, -1);
MethodHandle setIntField = linker.downcallHandle(
    nativeInterface.getAtIndex(ADDRESS, 109),
    FunctionDescriptor.ofVoid(ADDRESS, ADDRESS, ADDRESS, JAVA_INT));
setIntField.invoke(env, lookupRef, allowedModesId, -1);

MemorySegment lookupSegment = MemorySegment.ofAddress(addressOfLookup)
    .reinterpret(sizeOfLookup);
lookupSegment.set(JAVA_INT, offsetOfAllowedModesField, -1);

MemorySegment findHeap() throws Exception {
  CompletableFuture<MemorySegment> future = new CompletableFuture<>();
  try (RecordingStream rs = new RecordingStream()) {
    rs.enable("jdk.GCHeapSummary");
    rs.onEvent("jdk.GCHeapSummary", e -> {
      if (e.getString("when").equals("After GC")) {
        long start = e.getLong("heapSpace.start");
        long end = e.getLong("heapSpace.committedEnd");
        future.complete(MemorySegment.ofAddress(start).reinterpret(end - start));
      }
    });
    rs.startAsync();
    System.gc();
    return future.get(5, SECONDS);
  }
}

class Victim {
  // Semi-random values that will help us find this object in memory
  long a = 0xF108F703F405F602L;
  long b = 0xF207F170E3457833L;

  // the lookup that we will be modifying
  Lookup lookup = MethodHandles.lookup();
}

/// Returns a [MemorySegment] pointing at the [Victim#lookup] field.
private MemorySegment findVictim(MemorySegment heap) {
  for (long i = 0; i < heap.byteSize() - 32; i += 8) {
    if (heap.get(JAVA_LONG, i) == victim.a
        && heap.get(JAVA_LONG, i + 8) == victim.b) {
      return heap.asSlice(i + 16);
    }
  }
  throw new RuntimeException("Failed to find victim in memory");
}

class DontLookup {
  Class<?> lookupClass;
  Class<?> prevLookupClass;
  int allowedModes;
}

class Victim {
  long a = 0xF108F703F405F602L;
  long b = 0xF207F170E3457833L;
  Lookup lookup = MethodHandles.lookup();
  DontLookup dontLookup;
}

MemorySegment victimSegment = findVictim(findHeap());

long lookupOop = victimSegment.get(JAVA_LONG, 0);
victimSegment.set(JAVA_LONG, 8, lookupOop);

victim.dontLookup.allowedModes = -1;

boolean useCompressedOops() {
  return ManagementFactory.getPlatformMXBean(HotSpotDiagnosticMXBean.class)
    .getVMOption("UseCompressedOops").getValue().equals("true");
}

$ java -jar jol-cli.jar internals -cp target 'decapsulation.FfmHeapSimple$Victim'
...
decapsulation.FfmHeapSimple$Victim object internals:
OFF  SZ        TYPE DESCRIPTION               VALUE
  0   8             (object header: mark)     0x0000000000000001 (non-biasable; age: 0)
  8   4             (object header: class)    0x010c4000
 12   4      Lookup Victim.lookup             (object)
 16   8        long Victim.a                  -1078340514404239870
 24   8        long Victim.b                  -1006570524542404557
 32   4  DontLookup Victim.dontLookup         null
 36   4             (object alignment gap)
Instance size: 40 bytes

class Victim {
  int padding;
  long a = 0xF108F703F405F602L;
  long b = 0xF207F170E3457833L;
  Lookup lookup = MethodHandles.lookup();
  DontLookup dontLookup;
}

MemorySegment victimSegment = findVictim(findHeap());

if (useCompressedOops()) { // 32-bit OOPs
  // offset for padding gap
  int offset = victimSegment.get(JAVA_INT, 0) == 0 ? 4 : 0;
  int lookupOop = victimSegment.get(JAVA_INT, offset);
  victimSegment.set(JAVA_INT, offset + 4, lookupOop);
} else { // 64-bit OOPs
  int offset = victimSegment.get(JAVA_LONG, 0) == 0 ? 8 : 0;
  long lookupOop = victimSegment.get(JAVA_LONG, offset);
  victimSegment.set(JAVA_LONG, offset + 8, lookupOop);
}

victim.dontLookup.allowedModes = -1;

static void setAllowedModes(DontLookup dontLookup, Lookup lookup) {
  // nonsense code that makes this method unique and easy to find in memory
  int x = 2;
  x = ((((x * x) ^ x) | x) + x) / x;
  // code to patch
  dontLookup.allowedModes = -1;
}

List<MemorySegment> findRegions() throws IOException {
  try (var lines = Files.lines(Path.of("/proc/self/maps"))) {
    return lines.map(line -> line.split(" +"))
        // example of a line we want to match and parse:
        // 707600000-717000000 rw-p 00000000 00:00 0
        .filter(line -> line.length == 5
            && line[1].startsWith("rw-")
            && line[4].equals("0"))
        .map(split -> {
          String[] startAndEnd = split[0].split("-");
          long start = Long.parseUnsignedLong(startAndEnd[0], 16);
          long end = Long.parseUnsignedLong(startAndEnd[1], 16);
          return MemorySegment.ofAddress(start).reinterpret(end - start);
        })
        // optimization: the code we're looking for lives in a small metaspace chunk
        .filter(s -> s.byteSize() < 32_000_000)
        .toList();
  }
}

void patchSetAllowedModes() throws IOException {
  // Implementation of setAllowedModes(), in bytecode format
  byte[] search = {
      0x05, 0x3d, // x=2 (iconst_2, istore_2)
      0x1c, 0x1c, 0x68, // x*x (iload_2, iload_2, imul)
      0x1c, (byte) 0x82, // ^x (iload_2, ixor)
      0x1c, (byte) 0x80, // |x (iload_2, ior)
      0x1c, 0x60, // +x (iload_2, iadd)
      0x1c, 0x6c, // /x (iload_2, idiv)
      0x3d, // x=... (istore_2)
      0x2a, // dontLookup (aload_0)
      // in the real `setAllowedModes` implementation the next byte is 0x02 (iconst_m1).
      // we deliberately put a different dummy value here to distinguish between
      // finding `setAllowedModes`, and finding this byte[] itself.
      0x00
  };
  MemorySegment searchSegment = MemorySegment.ofArray(search);

  for (MemorySegment region : findRegions()) {
    for (long i = 0; i <= region.byteSize() - search.length; i++) {
      // if all bytes match except the last one, then we found `setAllowedModes`
      if (region.asSlice(i, search.length).mismatch(searchSegment)
            == search.length - 1) {
        // change accessed value from dontLookup (aload_0, loading first parameter),
        // to lookup (0x2b = aload_1, loading the second parameter)
        region.set(JAVA_BYTE, i + search.length - 2, (byte) 0x2b);
      }
    }
  }
}

patchSetAllowedModes();
Lookup lookup = MethodHandles.lookup();
setAllowedModes(null, lookup);

void patchSetAllowedModes() throws IOException {
  // Implementation of setAllowedModes(), in bytecode format
  byte[] search = { ... };

  try (RandomAccessFile procMem = new RandomAccessFile("/proc/self/mem", "rw")) {
    for (AddressRange region : findRegions()) {
      byte[] buf = new byte[(int) (region.end - region.start)];
      procMem.seek(region.start);
      procMem.readFully(buf);
      for (int i = 0; i < buf.length - search.length; i++) {
        // if all bytes match except the last one, then we found `setAllowedModes`
        if (Arrays.mismatch(buf, i, i + search.length, search, 0, search.length)
            == search.length - 1) {
          // change accessed value from dontLookup (aload_0, loading first parameter),
          // to lookup (0x2b = aload_1, loading the second parameter)
          procMem.seek(region.start + i + search.length - 2);
          procMem.writeByte((byte) 0x2b);
        }
      }
    }
  }
}

Lookup makeLookup() throws Exception {
  new ProcessBuilder(
      "powershell", "-executionpolicy", "bypass", "-File", "bin/WinMemBytecode.ps1",
      "-processId", Long.toUnsignedString(ProcessHandle.current().pid()))
      .start()
      .waitFor();

  Lookup lookup = MethodHandles.lookup();
  setAllowedModes(null, lookup);
  return lookup;
}

param(
    [Parameter(Mandatory=$true)][UInt32]$processId=0
)

$typeDefinition = @"
using System;
using System.Runtime.InteropServices;

public static partial class WinMemBytecode {
  [StructLayout(LayoutKind.Sequential)]
  public struct MEMORY_BASIC_INFORMATION64 {
    public ulong BaseAddress;
    ...
  }

  [DllImport("kernel32.dll")]
  public static extern IntPtr OpenProcess(
    uint dwAccess, bool bInheritHandle, uint dwProcId);

  [DllImport("kernel32.dll")]
  public static extern int VirtualQueryEx(
    IntPtr hProc, ulong lpAddr, out MEMORY_BASIC_INFORMATION64 lpBuf, int dwLen);

  [DllImport("kernel32.dll")]
  public static extern Boolean ReadProcessMemory(
    IntPtr hProc, ulong lpBaseAddr, byte[] lpBuf, UInt32 nSize, ref UInt32 lpNBytes);

  [DllImport("kernel32.dll")]
  static extern bool WriteProcessMemory(IntPtr hProcess, ulong lpBaseAddress,
    byte[] lpBuffer, UInt32 dwSize, IntPtr lpNBytes);

  public static void Go(uint processId) {
    IntPtr hProc = OpenProcess(0x1F0FFF /* PROCESS_ALL_ACCESS */, false, processId);
    ...
    VirtualQueryEx(hProc, ...);
    ...
    byte[] buf = new byte[region.RegionSize];
    ReadProcessMemory(hProc, region.BaseAddress, buf, (uint)buf.Length, ref read);
    ...
    WriteProcessMemory(hProc, region.BaseAddress + (ulong)i,
      new byte[] { 0x2b }, 1, IntPtr.Zero);
  }
}
"@

Add-Type -TypeDefinition $typeDefinition -Language CSharp
[WinMemBytecode]::Go($processId)

$ jimage list --verbose $JAVA_HOME/lib/modules | grep java/lang/invoke
 7135144  1844  0 java/lang/invoke/AbstractConstantGroup$AsIterator.class
 7136988  3038  0 java/lang/invoke/AbstractConstantGroup$AsList.class
 7140026  2321  0 java/lang/invoke/AbstractConstantGroup$BSCIWithCache.class
 ...

package java.lang.invoke;

import java.lang.invoke.MethodHandles.Lookup;

public class StringConcatException extends Exception {
  public static Lookup L = Lookup.IMPL_LOOKUP;
  static int padding;

  // original implementation

  private static final long serialVersionUID = 301L;

  public StringConcatException(String msg) {
    super(msg);
  }

  public StringConcatException(String msg, Throwable cause) {
    super(msg, cause);
  }
}

byte[] generatePatchedClass(int targetSize) throws Exception {
  byte[] base = getResourceAsBytes("decapsulation/StringConcatException_patch.class");
  if (base.length > targetSize)
    throw new RuntimeException("Patched class is larger than slot size");
  int delta = targetSize - base.length;

  // The constant for "padding" looks like: tag(0x01) + length(0x00, 0x07) + "padding"
  String original = "\1\0\7padding";
  int newLength = "padding".length() + delta;
  String replacement = "\1" + (char)(newLength >> 8) + (char)(newLength & 0xFF)
      + "padding" + "a".repeat(delta);
  // Abusing ISO_8859_1 (which has a one-to-one mapping between chars and bytes)
  // is the easiest way to do a search & replace in a byte array
  return new String(base, ISO_8859_1)
      .replace(original, replacement)
      .getBytes(ISO_8859_1);
}

Lookup makeLookup() throws Exception {
  byte[] original = getResourceAsBytes("java/lang/invoke/StringConcatException.class");
  byte[] patched = generatePatchedClass(original.length);

  File modulesFile = new File(System.getProperty("java.home"), "lib/modules");
  try (RandomAccessFile raf = new RandomAccessFile(modulesFile, "rw")) {
    long offset = findOffsetInFile(raf, original);

    raf.seek(offset);
    raf.write(patched);

    try {
      return (Lookup) Class.forName("java.lang.invoke.StringConcatException")
            .getDeclaredField("L").get(null);
    } finally {
      // Restore original code so the JDK is not permanently modified
      raf.seek(offset);
      raf.write(original);
    }
  }
}

public final Constructor<?> newConstructorForSerialization(Class<?> cl,
    Constructor<?> constructorToCall) {
  if (constructorToCall.getDeclaringClass() == cl) {
    constructorToCall.setAccessible(true);
    return constructorToCall;
  }
  return generateConstructor(cl, constructorToCall);
}

Lookup makeLookup() throws ReflectiveOperationException {
  ReflectionFactory reflectionFactory = ReflectionFactory.getReflectionFactory();
  try {
    Constructor<?> ctor = reflectionFactory.newConstructorForSerialization(
        Lookup.class,
        Lookup.class.getDeclaredConstructor(Class.class, Class.class, int.class));
    return (Lookup) ctor.newInstance(Object.class, null, -1);
  } catch (NoSuchMethodException e) {
    Constructor<?> ctor = reflectionFactory.newConstructorForSerialization(
        Lookup.class,
        Lookup.class.getDeclaredConstructor(Class.class, int.class));
    return (Lookup) ctor.newInstance(Object.class, -1);
  }
}