Attach to already running JVM

Yes you can.

1) Inject a DLL in the process hosting the JVM (eg, java.exe, or javaw.exe, or iexplore.exe). A common injection technique is to use SetWindowsHookEx

2) In the DLL, get the module handle of the jvm.dll using GetModuleHandle

3) Get the address of the JNI_GetCreatedJavaVMs function, using GetProcAddress

4) Call the function and, if successfull, attach your thread to the first JVM found, using the AttachCurrentThread function pointer from the JavaVM struture.

5) Done.

Usefull link: The Invocation API

Leave a Comment