Automated generation of object-graph and call-tree documentation
- Dominant language
- Java
- Stars
- 9.1k
- Forks
- 1.9k
- PR merge metrics
- No merged PRs in 30d
Description
To facilitate easier studying of these types of vulnerabilities the tool scaffolding should be able to instrument itself to generate ASCII diagrams of payload object-graphs (similar to [this](https://gist.github.com/frohoff/24af7913611f8406eaf3#deserialized-object-graph-approximate)) and deserialization code execution call-trees (similar to [this](https://gist.github.com/frohoff/24af7913611f8406eaf3#deserialization-call-tree-approximate)) to understand the mechanics of each gadget chain better. Simply providing a list of gadget classes could be useful, and a more sophisticated implementation could embed and/or link to code/methods executed during deserialization.
Optionally allow such documentation to be printed to the console as verbose-mode help text when using the CLI interface.
`PrintUtil` from #16 is probably a good start for object graph inspection
Instrumentation stuff:
- https://github.com/antonarhipov/attach-and-transform-with-mbeans
- https://gist.github.com/nickman/6494990
- http://stackoverflow.com/questions/18567552/how-to-retransform-a-class-at-runtime
- https://github.com/google/allocation-instrumenter
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.