@RolesAllowed 在jboss6.0中不起作用

2010-10-22 09:00:59 184 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

Android应用加固脱壳实战：从爱加密原理到Frida内存Dump与修复在移动应用安全领域，代码加固与动态加载是保护核心逻辑的关键技术。其原理在于通过修改应用启动流程，将原始DEX加密隐藏，并注入包含解密逻辑的壳DEX，实现运行时动态加载。这项技术的核心价值在于防止应用被逆向分析、二次打包或恶意篡改，广泛应用于金融、游戏等高安全要求场景。对于安全研究、漏洞挖掘或历史版本审计，掌握脱壳技能至关重要。本文聚焦于**爱加密**等主流加固方案，深入探讨如何利用**Frida**框架在内存中精准捕获解密后的DEX数据，并解决脱壳后常见的签名校验等运行问题，提供一套从原理到实践的完整攻防思阅读详情

package com.jaas;
public interface SecurityAccess {
public String AdminUserMethod();
public String DepartmentUserMethod();
public String AnonymousUserMethod();
}

package com.jaas;

import javax.annotation.security.PermitAll;
import javax.annotation.security.RolesAllowed;
import javax.ejb.Remote;
import javax.ejb.Stateless;

@Stateless
@Remote ({SecurityAccess.class})

public class SecurityAccessBean implements SecurityAccess{

@RolesAllowed({"AdminUser","DepartmentUser"})
public String AdminUserMethod() {
return "管理员角色访问AdminUserMethod()方法";
}
@RolesAllowed({"DepartmentUser"})
public String DepartmentUserMethod() {
return "事业部门角色的用户访问DepartmentUserMethod()方法";
}
@PermitAll
public String AnonymousUserMethod() {
return "任何角色的用户都可以访问AnonymousUserMethod()方法";
}
}
//jboss.xml
<?xml version="1.0" encoding="UTF-8"?>
<jboss>
<security-domain>other</security-domain>
<unauthenticated-principal>AnonymousUser</unauthenticated-principal>
</jboss>
//roles.properties
lisi=AdminUser,DepartmentUser
wangwu=DepartmentUser

//users.properties
lisi=123456
wangwu=123456
//jsp页面
<%@ page contentType="text/html; charset=GBK"%>
<%@ page import="com.jaas.SecurityAccess,
javax.naming.*,
org.jboss.security.*,
java.util.*"%>
<%
Properties props = new Properties();
props.setProperty("java.naming.factory.initial",
"org.jnp.interfaces.NamingContextFactory");
props.setProperty("java.naming.provider.url", "localhost:1099");
props.setProperty("java.naming.factory.url.pkgs", "org.jboss.naming");
InitialContext ctx = new InitialContext(props);
String user = request.getParameter("user");
String pwd = request.getParameter("pwd");
if (user!=null && !"".equals(user.trim())){
SecurityAssociation.setPrincipal(new SimplePrincipal(user.trim()));
SecurityAssociation.setCredential(pwd.trim().toCharArray());
}
SecurityAccess securityaccess = (SecurityAccess)
ctx.lookup("SecurityAccessBean/remote");
try{
out.println("调用结果:"+
securityaccess.AdminUserMethod()+ " ");
}catch(Exception e){
out.println(user+ "没有权限访问AdminUserMethod方法 ");
}
out.println("========================== ");
try{
out.println("调用结果:"+
securityaccess.DepartmentUserMethod()+ " ");
}catch(Exception e){
out.println(user+ "没有权限访问DepartmentUserMethod方法 ");
}
out.println("========================== ");
try{
out.println("调用结果:"+
securityaccess.AnonymousUserMethod()+ " ");
}catch(Exception e){
out.println(user+ "没有权限访问AnonymousUserMethod方法 ");
}
SecurityAssociation.clear();
%>

为什么@RolesAllowed({"AdminUser","DepartmentUser"}) 不起作用？

...全文