KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #ai-agents #developer-tools #codex #claude-code #mcp #rust #deepseek-harness #typescript #ai-agent #cli

bytecode-scanner

★ 17 Open GitHub ↗

A Java bytecode scanner that looks for uses of particular APIs.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# bytecode-scanner
This program scans Java bytecode for instances of APIs. For example, specifying `java/io/PrintStream`, will scan the given classfile for calls to constructors and methods of that class, also providing the line number in the sourcefile of where this call takes place. An example application of this is to scan Java programs for malicious intent such as issuing file operations or opening network connections.

## Example
Given the sourcefile as Test.java and the compiled classfile Test.class:
```java
import java.util.*;

public class Test {
  public static void main(String[] args) {
    ArrayList<Integer> list = new ArrayList<>(Arrays.asList(1, 2, 3));
    System.out.println("Hello world!");
  }
}
```

Find instances of APIs using the `-s` (scan) flag, which is a comma-separated list of packages:
```
> ./bytecode-scanner -s "java.io.PrintStream,java.util.ArrayList" Test.class
Found the following API calls in Test.class:
	java/io/PrintStream.println in method main on line 4
	java/util/ArrayList.<init> in method main on line 3
```

Get a full dump of the constant pool using `-c` (constant-pool):
```
> ./bytecode-scanner -c Test.class
#1 = MethodRef    #11:#20                               -> java/lang/Object."<init>":()V
#2 = Class        #21                                   -> java/util/ArrayList
#3 = Class        #22                                   -> java/lang/Integer
#4 = MethodRef    #3:#23                                -> java/lang/Integer.valueOf:(I)Ljava/lang/Integer;
#5 = MethodRef    #24:#25                               -> java/util/Arrays.asList:([Ljava/lang/Object;)Ljava/util/List;
#6 = MethodRef    #2:#26                                -> java/util/ArrayList."<init>":(Ljava/util/Collection;)V
#7 = FieldRef     #27:#28                               -> java/lang/System.out:Ljava/io/PrintStream;
#8 = String       #29                                   -> 哈 哈!
#9 = MethodRef    #30:#31                               -> java/io/PrintStream.println:(Ljava/lang/String;)V
#10 = Class       #32                                   -> ReadmeTest
#11 = Class       #33                                   -> java/lang/Object
#12 = Utf8        <init>
#13 = Utf8        ()V
#14 = Utf8        Code
#15 = Utf8        LineNumberTable
#16 = Utf8        main
#17 = Utf8        ([Ljava/lang/String;)V
#18 = Utf8        SourceFile
#19 = Utf8        ReadmeTest.java
#20 = NameAndType #12:#13                               -> "<init>":()V
#21 = Utf8        java/util/ArrayList
#22 = Utf8        java/lang/Integer
#23 = NameAndType #34:#35                               -> valueOf:(I)Ljava/lang/Integer;
#24 = Class       #36                                   -> java/util/Arrays
#25 = NameAndType #37:#38                               -> asList:([Ljava/lang/Object;)Ljava/util/List;
#26 = NameAndType #12:#39                               -> "<init>":(Ljava/util/Collection;)V
#27 = Class       #40                                   -> java/lang/System
#28 = NameAndType #41:#42                               -> out:Ljava/io/PrintStream;
#29 = Utf8        哈 哈!
#30 = Class       #43                                   -> java/io/PrintStream
#31 = NameAndType #44:#45                               -> println:(Ljava/lang/String;)V
#32 = Utf8        ReadmeTest
#33 = Utf8        java/lang/Object
#34 = Utf8        valueOf
#35 = Utf8        (I)Ljava/lang/Integer;
#36 = Utf8        java/util/Arrays
#37 = Utf8        asList
#38 = Utf8        ([Ljava/lang/Object;)Ljava/util/List;
#39 = Utf8        (Ljava/util/Collection;)V
#40 = Utf8        java/lang/System
#41 = Utf8        out
#42 = Utf8        Ljava/io/PrintStream;
#43 = Utf8        java/io/PrintStream
#44 = Utf8        println
#45 = Utf8        (Ljava/lang/String;)V
```

## Limitations
A few current limitations with this program are:
 * Skips annotation information.
 * Not very complete API-wise.
 * It may be possible to get around this using Reflection.

## License
MIT

## Author
Anthony Calandra

bytecode-scanner

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README