JVM Inspector - x64dbg Plugin

The most advanced JVM debugging plugin for x64dbg. Makes x64dbg fully JVM-aware when debugging Java applications. No JVMTI, no Attach API - pure cross-process memory reading via HotSpot VMStructs.

Features

Core Analysis

• Class Browser with package tree, field enumeration, and real-time class scanning
• Bytecode Decompiler (built-in + CFR integration) with syntax highlighting
• CodeCache Viewer - all JIT-compiled methods with C1/C2 levels, native code sizes
• Object Inspector - inspect Java object fields with type-aware value display
• Thread Stack Walker - Java thread enumeration with states and call stacks
• Constant Pool Resolver - read CP entries through ConstantPoolCache (rewritten bytecodes)

Reverse Engineering

• Native Obfuscator Analyzer - detect native stubs, map DLLs, find string pools
• Method Hook Detector - find bytecode overwrites, JVMTI breakpoints, entry point detours
• JNI Function Tracer - trace RegisterNatives, FindClass, CallVoidMethod via function table
• Interpreter Dispatch Table - dump all 256 opcode handlers with addresses
• Class Hierarchy Viewer - inheritance tree with subclasses
• Vtable Inspector - virtual method dispatch table
• InvokeDynamic Analyzer - lambda/invokedynamic callsite analysis
• Annotation Scanner - find classes with specific annotations

Hacking Toolkit

• Java Breakpoints - jvm.bp java/lang/String.equals sets bp on Java method entry
• Method Patcher - jvm.patch class.method return_true patches bytecodes in memory
• Field Freezer - freeze object field values (like Cheat Engine)
• Field Watch - realtime field monitor with auto-refresh every 200ms
• Memory Pattern Scanner - AOB scan with wildcard support across Java heap
• String Scanner - search ConstantPool strings across all loaded classes
• Method Profiler - top hottest methods sorted by JIT compilation order

Minecraft Specific

• Mojang Mappings - load ProGuard mappings, auto-deobfuscate all names
• Entity Scanner - find Entity instances in heap
• Packet Logger - trace network handler method calls
• Auto-Remap Labels - x64dbg labels with deobfuscated names

Export & Utility

• Class Dumper - dump single class or ALL classes to .class files
• Dump All to ZIP - export all loaded classes as .zip archive
• Export CSV - native method mapping table export
• Config Persistence - CFR path, mappings, classpath saved between sessions
• CFR Integration - production-grade decompilation from memory dumps

Commands

Command	Description
jvm.classes [filter]	List loaded classes
jvm.methods <class>	Show methods of a class
jvm.threads	List Java threads
jvm.codecache	CodeCache summary
jvm.version	JVM version + all cached offsets
jvm.inspect [addr]	Identify JVM object at address
jvm.annotate	Annotate current nmethod in disassembly
jvm.bp <class.method>	Set breakpoint on Java method
jvm.patch <class.method> <action>	Patch method (return_true/false/null/void)
jvm.hooks [filter]	Detect hooked methods
jvm.strings <text>	Search strings in ConstantPools
jvm.watch <addr> <field>	Hardware watchpoint on field
jvm.loaders	Show ClassLoader tree
jvm.profile [filter]	Method hotness profiler
jvm.search <pattern>	Global method name search
jvm.flags [filter]	Dump VM integer constants
jvm.mappings <path>	Load Mojang ProGuard mappings
jvm.cfr <path>	Set CFR decompiler jar path
jvm.classpath <path>	Set jar classpath for CFR
jvm.dump <class>	Dump class to .class file
jvm.dumpall [path]	Dump all classes to ZIP
jvm.relabel	Re-seed labels with mapped names
jvm.cpedit <class> <idx> <val>	Edit ConstantPool entry
jvm.refresh	Force rescan JVM structures

GUI Tabs

Main Tabs (x64dbg tab bar)

• JVM Classes - Class browser + 21 analysis subtabs
• JVM CodeCache - Compiled methods table
• JVM Objects - Object field inspector + freeze
• JVM Native - Native obfuscator analysis
• JVM Watch - Realtime field monitor

Right Panel Subtabs (in JVM Classes)

Decompiler, Hooks, Strings, Search, Natives, Trace, Heap, Threads, GC, Locks, Deopts, Packets, NativeObf, JNI Trace, Hierarchy, Vtable, Sizes, Dispatch, Annotations, InvDyn, AOB Scan

How It Works

The plugin reads JVM internals through VMStructs - a set of exported symbols (gHotSpotVMStructs, gHotSpotVMTypes, gHotSpotVMIntConstants) that HotSpot JVM provides for serviceability tools. This gives us field offsets for all internal JVM structures without needing JVMTI or the Attach API.

No agent injection. No JVMTI. No Attach API. Pure memory read.

Key structures parsed:

• ClassLoaderDataGraph -> ClassLoaderData -> InstanceKlass -> Method -> ConstMethod
• ConstantPool -> ConstantPoolCache -> ResolvedMethodEntry / ResolvedFieldEntry
• nmethod -> ScopeDesc, OopMaps, code sections
• ThreadsSMRSupport -> ThreadsList -> JavaThread[]

Build

Requirements

• Windows 10/11
• Visual Studio 2022+ (MSVC)
• CMake 3.20+
• Qt5 (via vcpkg: vcpkg install qt5-base:x64-windows)
• x64dbg Plugin SDK

Build Steps

# Install Qt5
vcpkg install qt5-base:x64-windows

# Build
mkdir build && cd build
cmake .. -G "NMake Makefiles" -DCMAKE_BUILD_TYPE=Release -DCMAKE_TOOLCHAIN_FILE=path/to/vcpkg/scripts/buildsystems/vcpkg.cmake
nmake

# Deploy
copy Release\jvm-inspector.dp64 "path\to\x64dbg\x64\plugins\"

Note on Qt5 ABI

The plugin links against import libraries generated from x64dbg's own Qt5 DLLs (in deps/qt5libs/). This ensures ABI compatibility with x64dbg's bundled Qt 5.x regardless of vcpkg's Qt version.

Quick Start

1. Copy jvm-inspector.dp64 to x64dbg plugins folder
2. Attach to a Java process (java.exe, javaw.exe, or any JVM-based app)
3. The plugin auto-detects jvm.dll and parses VMStructs
4. Click Refresh in JVM Classes tab
5. Browse classes, methods, fields with full decompilation

For Minecraft

jvm.mappings C:\path\to\client.txt
jvm.cfr C:\path\to\cfr.jar

Then click any class - deobfuscated names + CFR decompilation.

Supported JVM Versions

• OpenJDK 17+ (tested on JDK 21)
• Any HotSpot-based JVM with VMStructs exports
• Both compressed and non-compressed oops

License

MIT

Author

Share - github.com/Share-devn Blog - t.me/dev000n