Our great sponsors
-
JDK10
Discontinued Java version 1.1 + JDK 1.0 and very early Java applets, developed 1995 to 1996. [Moved to: https://github.com/ufuu/Java-JDK10]
-
-
WorkOS
The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.
-
Graal
GraalVM compiles Java applications into native executables that start instantly, scale fast, and use fewer compute resources 🚀
I came across this post [1] in which the author discovers an undocumented feature in the JVM.
"Although the first stable release of Java used bytecode version 45.3, the JVM will actually accept classfiles with versions starting at 45.0. Furthermore, there’s an undocumented feature in the JVM where it parses Code attributes slightly differently when the version is 45.0 - 45.2.
In a normal classfile, the stack, locals, and code length fields of the Code attribute have lengths of 2, 2, and 4 bytes respectively, but in a pre-45.3 classfile, the JVM expects them to be 1, 1, and 2 bytes instead. Normally, this means that a pre-45.3 classfile produced by ASM will just crash when run on the JVM because the JVM encounters garbage data while parsing and rejects it.
However, if you are very careful, it is possible to construct a classfile that is valid when parsed with the 2,2,4 widths, and also valid when parsed with 1,1,2, but parses as different code in each case. This means that it is possible to craft a classfile that executes one piece of code when run on the actual JVM and displays a completely different set of fake code when viewed with reverse engineering tools"
TL;DR JVM contained an undocumented feature in the JVM where it parses Code attributes slightly differently when the version is 45.0 - 45.2. The stack, locals, and code length typically has 2,2,4 bytes rspectively; in pre-45.3 classfiles, the JVM expects them to be 1,1,2 bytes instead.
[1] https://blog.polybdenum.com/2021/05/05/how-i-hacked-google-a...
[2] https://github.com/openjdk/jdk/commit/eedc99c9ab2647f0233e48...
An even earlier release is here: https://github.com/Marcono1234/HotJava-1.0-alpha/tree/master...
Yes, and it's available on GitHub now!
Here's the heap implementation, for example: https://github.com/openjdk/jdk/blob/master/src/hotspot/share...
The GraalVM is a Java implementation of the Java compiler and VM and it's also on GitHub: https://github.com/oracle/graal