-Some Java programs use [reflection](https://www.oracle.com/technical-resources/articles/java/javareflection.html) to hide their code by loading and executing classes dynamically. To tackle this, you could [dump them from memory](https://github.com/hengyunabc/dumpclass), or edit `rt.jar` and place a hook on various reflection methods. But sometimes authors will go a step further - they will unload classes after they have executed, preventing them from being dumped. And other times, crazy people will even use the native methods directly, bypassing any bytecode-level hooks.
0 commit comments