Java virtual machine runtime data obfuscation
A heap dump of a running application is obtained. For each object of one or more objects in the heap dump, the object may be obfuscated based on its class loader. A class loader of a class of the object is identified. A determination is made as to whether the class loader is of an application-specific class loader type. In response to determining that the class loader is of the application-specific class loader type, the object is obfuscated. The class loader is of an application-specific class loader type if is an application class loader or a custom class loader.
1 . A method, comprising:
obtaining a heap dump of a running application, wherein the heap dump is a snapshot of at least a portion of a heap at a particular point in time, and wherein the heap represents runtime data of the running application; and
for each object of one or more objects in the heap dump, wherein the each object includes data values stored in fields of the each object:
identifying a class loader of a class of the each object based on class loader information in the heap dump;
determining whether the class loader is of an application-specific class loader type;
in response to determining that the class loader is of the application-specific class loader type, obfuscating the each object; and
in response to determining that the class loader is not of the application-specific class loader type, obfuscating the each object in response to a determination that the each object is referenced by another object whose class loader is of the application-specific class loader type.
2 . The method of claim 1 , wherein determining whether the class loader is of the application-specific class loader type comprises:
determining that the class loader is an application class loader.
3 . The method of claim 1 , wherein determining whether the class loader is of the application-specific class loader type comprises:
determining that the class loader is a custom class loader.
4 . The method of claim 1 , wherein obfuscating the each object comprises:
obfuscating a data value of a field of the each object based on a data type of the field.
5 . The method of claim 1 , wherein the each object includes a field of type String and having an original value, and wherein obfuscating the each object comprises:
obtaining an obfuscated field by replacing each byte of the field with a pre-defined character such that the obfuscated field has a same length as a length of the original value.
6 . The method of claim 1 , wherein the each object includes a field of type Map, and wherein obfuscating the each object comprises:
hashing each key and each value of the field.
7 . The method of claim 1 , wherein obfuscating the each object comprises:
setting a field of type Date to a random long value having a same length as an original time value of the field.
8 . The method of claim 1 , wherein obfuscating the each object comprises:
traversing all non-static fields of the each object and obfuscating the non-static fields based on corresponding data types.
9 . The method of claim 1 , wherein obfuscating the each object comprises:
for a field of a primitive data type, setting the field to a predefined value; and
for a field of a wrapper data type, setting a value of the field to a different predefined value.
10 . A system, comprising:
one or more memories; and
one or more processors, the one or more processors configured to execute instructions stored in the one or more memories to:
obtain a heap dump of a running application, wherein the heap dump is a snapshot of at least a portion of a heap at a particular point in time, and wherein the heap represents runtime data of the running application; and
for each object of one or more objects in the heap dump, wherein the each object includes data values stored in fields of the each object:
identify a class loader of a class of the each object based on class loader information in the heap dump;
determine whether the class loader is of an application-specific class loader type;
in response to determining that the class loader is of the application-specific class loader type, obfuscate the each object; and
in response to determining that the class loader is not of the application-specific class loader type, obfuscate the each object in response to a determination that the each object is referenced by another object whose class loader is of the application-specific class loader type.
11 . The system of claim 10 , wherein the class loader is determined to be an application class loader.
12 . The system of claim 10 , wherein the class loader is determined to be a custom class loader.
13 . The system of claim 10 , wherein to obfuscate the each object comprises to:
delegating obfuscating a data value of a field of the each object based on a data type of the field.
14 . The system of claim 10 , wherein the each object includes a field of type String and having an original value, and wherein to obfuscate the each object comprises:
setting the field to a random string having a same length as a length of the original value.
15 . The system of claim 10 , wherein the each object includes a field of type Map, and wherein to obfuscate the each object comprises to:
set a key of the field to a hashed value of the key; and
set a value of the field to hash value of the value.
16 . A non-transitory computer readable medium storing instructions operable to cause one or more processors to perform operations comprising:
obtaining a heap dump of a running application, wherein the heap dump is a snapshot of at least a portion of a heap at a particular point in time, and wherein the heap represents runtime data of the running application; and
for each object of one or more objects in the heap dump, wherein the each object includes data values stored in fields of the each object:
identifying a class loader of a class of the each object based on class loader information in the heap dump;
determining whether the class loader is of an application-specific class loader type;
in response to determining that the class loader is of the application-specific class loader type, obfuscating the each object; and
in response to determining that the class loader is not of the application-specific class loader type, obfuscating the each object in response to a determination that the each object is referenced by another object whose class loader is of the application-specific class loader type.
17 . The non-transitory computer readable medium of claim 16 , wherein
determining whether the class loader is of the application-specific class loader type comprises:
determining that the class loader is an application class loader or a custom class loader.
18 . The non-transitory computer readable medium of claim 16 , wherein a data value of a field of the each object is obfuscated based on a data type of the field.
19 . The non-transitory computer readable medium of claim 16 , wherein the each object includes a field of type String and having an original value, and wherein obfuscating the each object comprises:
setting the field to a random string that has a same length as a length of the original value.
20 . The non-transitory computer readable medium of claim 16 , wherein the each object includes a field of type Map, and wherein obfuscating the each object comprises:
obfuscating a key and a value of the fields by setting the key and the value to respective hashed values.