導讀：
用ASM寫的Hello World。在網上搜索ASM有關的文章，最後居然又找回Matrix。。汗

ASM2.0位元組碼框架介紹
http://www.matrix.org.cn/resource/article/2006-02-20/ASM+Bytecode+Framework_44220.html

package my; import java.lang.reflect.Method; import org.objectweb.asm.ClassWriter; import org.objectweb.asm.MethodVisitor; import org.objectweb.asm.Opcodes; public class Hello { @SuppressWarnings("unchecked") public static void main(String[] args) throws Exception { ClassWriter cw = new ClassWriter(ClassWriter.COMPUTE_MAXS); // 類訪問開始：必須 cw.visit(Opcodes.V1_5, Opcodes.ACC_PUBLIC, "my/Foo", null, "java/lang/Object", null); // 至少提供一個建構函式 MethodVisitor mv = cw.visitMethod(Opcodes.ACC_PUBLIC, "", "()V", null, null); // 程式碼開始：必須 mv.visitCode(); mv.visitVarInsn(Opcodes.ALOAD, 0); mv.visitMethodInsn(Opcodes.INVOKESPECIAL, "java/lang/Object", "", "()V"); mv.visitInsn(Opcodes.RETURN); // 計算棧和區域性變數最大空間：必須 mv.visitMaxs(0, 0); // 程式碼結束：必須 mv.visitEnd(); mv = cw.visitMethod(Opcodes.ACC_PUBLIC | Opcodes.ACC_STATIC, "main", "([Ljava/lang/String;)V", null, null); mv.visitCode(); mv.visitFieldInsn(Opcodes.GETSTATIC, "java/lang/System", "out", "Ljava/io/PrintStream;"); mv.visitLdcInsn("Hello World!"); mv.visitMethodInsn(Opcodes.INVOKEVIRTUAL, "java/io/PrintStream", "println", "(Ljava/lang/String;)V"); mv.visitInsn(Opcodes.RETURN); mv.visitMaxs(0, 0); mv.visitEnd(); // 類結束：必須 cw.visitEnd(); final byte[] bs = cw.toByteArray(); Class clazz = new ClassLoader() { protected Class findClass(String name) throws ClassNotFoundException { return defineClass(name, bs, 0, bs.length); } }.loadClass("my.Foo"); Method method = clazz.getMethod("main", new Class[] { String[].class }); // 陣列引數的方法，反射呼叫方式看起來比較古怪 method.invoke(null, (Object) new String[0]); for (int i = 0; i < bs.length; i++) System.out.printf("%d:/t%02X/t%c/n", i, bs[i], (char) bs[i]); // OutputStream out = new FileOutputStream("d:/my/Foo.class"); // out.write(bs); // out.close(); } }

藉助ASM寫了一個Aqua Data Studio 6.0的破解：

做法很簡單：
1、找到判斷license的方法，修改程式碼使總返回true
2、將1個license執行緒kill掉。

將jar拷到安裝目錄，修改datastudio.bat檔案的最後一行為：
java -javaagent:ads.crack.jar -cp "./lib/ads.jar;%ADS_PATH%" com.aquafold.datastudio.DataStudio

由於論壇不支援jar檔案上傳，將副檔名改為ads.crack.jar即可。

有時候，如果想要得到程式中某個Class的所有例項，也可以用asm修改程式碼得到：

package my; import java.io.FileOutputStream; import java.io.OutputStream; import java.lang.reflect.Field; import java.net.URL; import java.util.List; import org.objectweb.asm.ClassAdapter; import org.objectweb.asm.ClassReader; import org.objectweb.asm.ClassVisitor; import org.objectweb.asm.ClassWriter; import org.objectweb.asm.MethodAdapter; import org.objectweb.asm.MethodVisitor; import org.objectweb.asm.Opcodes; public class HelloModifyASM { public static void main(String[] args) throws Exception { URL url = HelloModifyASM.class.getResource("Foo.class"); ClassWriter cw = new ClassWriter(ClassWriter.COMPUTE_MAXS); ClassVisitor cv = new ClassAdapter(cw) { public void visit(int version, int access, String name, String signature, String superName, String[] interfaces) { super.visit(version, access, name, signature, superName, interfaces); // 新增欄位：public static List _my_instances; super.visitField(Opcodes.ACC_PUBLIC | Opcodes.ACC_STATIC, "_my_instances", "Ljava/util/List;", null, null); // 新增靜態的初始化塊 MethodVisitor mv = super.visitMethod(Opcodes.ACC_STATIC, "", "()V", null,null); mv.visitCode(); mv.visitTypeInsn(Opcodes.NEW, "java/util/ArrayList"); mv.visitInsn(Opcodes.DUP); mv.visitMethodInsn(Opcodes.INVOKESPECIAL, "java/util/ArrayList", "", "()V"); mv.visitFieldInsn(Opcodes.PUTSTATIC, "my/Foo", "_my_instances", "Ljava/util/List;"); mv.visitInsn(Opcodes.RETURN); mv.visitMaxs(0, 0); mv.visitEnd(); } public MethodVisitor visitMethod(int access, String name, String desc, String signature, String[] exceptions) { MethodVisitor mv = super.visitMethod(access, name, desc, signature, exceptions); // 修改無參的建構函式： if (!"".equals(name) || !"()V".equals(desc)) return mv; return new MethodAdapter(mv) { public void visitInsn(int opcode) { if (opcode == Opcodes.RETURN) { visitFieldInsn(Opcodes.GETSTATIC, "my/Foo", "_my_instances", "Ljava/util/List;"); visitVarInsn(Opcodes.ALOAD, 0); visitMethodInsn(Opcodes.INVOKEINTERFACE, "java/util/List", "add", "(Ljava/lang/Object;)Z"); } super.visitInsn(opcode); } }; } }; ClassReader cr = new ClassReader(url.openStream()); cr.accept(cv, ClassReader.SKIP_DEBUG); final byte[] bs = cw.toByteArray(); OutputStream out = new FileOutputStream("d:/my/Foo.class"); out.write(bs); out.close(); Class clazz = new ClassLoader(null) { public Class findClass(String name) throws ClassNotFoundException { if (!"my.Foo".equals(name)) return ClassLoader.getSystemClassLoader().loadClass(name); return defineClass(name, bs, 0, bs.length); } }.loadClass("my.Foo"); clazz.newInstance(); clazz.newInstance(); Field field = clazz.getField("_my_instances"); List instances = (List) field.get(null); System.out.println(instances.size()); for (Object obj : instances) { System.out.println(obj); } } }

問題：如果原始類有、或者沒有靜態初始化塊，處理方法就是不同的。
想了一下，也許可以在visitMethod方法中設定標誌，再在visitEnd方法中進行補充處理（針對沒有的情況）。
另外，如果有多個建構函式，怎樣保證插入的程式碼不會重複執行呢？
甚至，想要在原始碼中插入語句，插入位置的尋找也比較費盡，（需要找到不同的RETURN語句的位元組碼）