location of bytecode in memory
I don't know if this is the right place to ask my question (tell me if it's not)
I'd like to know how I could figure out WHERE the bytecode of an executing java program is actually stored in memory...
Hint: I'm running Linux Redhat 7.1 kernel 2.4.3-12 on an Intel x686 platform.
Thanks
Val
[331 byte] By [
valox] at [2007-9-26 11:15:10]

When Java code executes, the bytecode is soon converted into native code. Therefore, the bytecode of a currently executing Java program is not necessarily in memory!Maybe you could explain what it is you're actually trying to do, and we could help you...
ok, we are developing an application for group communication which is meant to be secure. We use cryptography. For demo purposes, I'd like to dig into the memory to retrieve a cryptographic key, i.e. do what a hacker would be likely to do.
So basically, what I need is just to know how I should proceed to retrieve that key in memory.
Thanks
valox at 2007-7-2 0:16:30 >

So, the key is part of some Java code, and you've encrypted the bytecode of the class and you have a custom classloader that decrypts the class's bytecode?
So the key isn't part of code, it's part of data. If the key is in use, it will be in memory somewhere. I suppose you could "capture" all of memory while the key is known to be in use, and assume that an n-byte key consumes n consecutive bytes of memory. If the key is stored in a primitive array in Java code, I would think this would be the case. If you have 256 MB of memory, you'll then have more than 256 million possible keys, but that's less than the 2^8n possible keys if the key is considered secure.
A byte array is just another object on the java heap. All (!) you'd have to do is look through all objects on the heap for byte arrays of the appropriate size. There may well not be very many... Trouble is, in order to do this you'd have to get very friendly with your JVM and how it managed its heap.
>...which is computed at runtime, or am I missing something ? I step through the byte code to the point where the key is retrieved. If the key is encrypted by some code means I step past the point where it is decode. Then I retrieve the key.