鸣谢
首先先感谢大佬的文章提供的绕过激活思路。
思路分析
开局上图，又到了大伙怒闻悲见的激活环节 
有没有一种可能，我们能hook这个窗口，在他打开之前就立马关闭，那我们就能愉悦的使用(白嫖)了
包有的，上面鸣谢的大佬都用javassist实现了，但是使用javassist还需要替换原来的jar包，属实有点麻烦，作为懒狗，我想能不能用大伙喜欢用的bytebuddy来实现，所以就有了这篇文章
前期操作
使用arthas的ognl '@java.awt.Window@getWindows()'获取窗口信息，找到窗口类名com.intellij.openapi.ui.impl.DialogWrapperPeerImpl，接下来需要找到它所在的jar包做后续分析
继续用sc -d com.intellij.openapi.ui.impl.DialogWrapperPeerImpl$MyDialog显示类的详细信息，包括类加载器、类加载的时间、类的字节码、源代码位置等详细信息。
这里用classloader -l 2ac1fdc4查看类加载器的详细信息
捏麻麻滴，太多信息了，果断让兄弟分析一下
而你，我的兄弟，你才是真正的英雄。不过你还不能休息，赶快把目录树给他，让他再烧脑一下
好的，相信兄弟，接下来JADX，启动！
JADX分析
一顿反编译终于找到你的位置了，藏在app-client里
快给我康康！
public void dispose() {
LOG.assertTrue(EventQueue.isDispatchThread(), "Access is allowed from event dispatch thread only");
for (Runnable runnable : this.myDisposeActions) {
runnable.run();
}
this.myDisposeActions.clear();
Runnable disposer = () -> {
Disposer.dispose(this.myDialog);
this.myProject = null;
SwingUtilities.invokeLater(() -> {
if (this.myDialog.getRootPane() != null) {
this.myDialog.remove(this.myDialog.getRootPane());
}
});
};
EdtInvocationManager.invokeLaterIfNeeded(disposer);
}
好兄弟说它是释放资源的，其实名字就能看出来，那就靠他实现关闭窗口的操作了
代码实现
package org.example;
import net.bytebuddy.agent.builder.AgentBuilder;
import net.bytebuddy.asm.Advice;
import net.bytebuddy.matcher.ElementMatchers;
import java.lang.instrument.Instrumentation;
import java.lang.reflect.Method;
public class MyAgent {
public static void premain(String agentArgs, Instrumentation inst) throws Exception {
System.out.println("premain");
AgentBuilder agentBuilder = new AgentBuilder.Default()
.with(AgentBuilder.RedefinitionStrategy.RETRANSFORMATION)
.with(AgentBuilder.InitializationStrategy.NoOp.INSTANCE)
.with(AgentBuilder.TypeStrategy.Default.REDEFINE)
.ignore(ElementMatchers.nameStartsWith("net.bytebuddy."));
// .with(new MyAgentListener());
// Eat Window
agentBuilder.type(ElementMatchers.named("com.intellij.openapi.ui.impl.DialogWrapperPeerImpl"))
.transform((builder, typeDescription, classLoader, module, protectionDomain) -> builder
.visit(Advice.to(EatWindowAdvice.class)
.on((ElementMatchers.named("setTitle"))
.and(ElementMatchers.takesArgument(0, String.class)))))
.installOn(inst);
}
public static class EatWindowAdvice {
@Advice.OnMethodEnter
public static void intercept(@Advice.This Object thisObject, @Advice.Argument(0) String title)
throws ClassNotFoundException {
System.out.println("Window is about to open ==> title is: " + title);
if (title.contains("许可证") || title.contains("Licenses")) {
System.out.println("Eat! Eat! Eat!");
try {
thisObject.getClass().getMethod("dispose").invoke(thisObject);
} catch (Exception e) {
e.printStackTrace();
}
}
}
}
}
康康效果
什么，你根本没吃掉，dispose()为什么会调用不了呢，再回去看看JADX，看到了这个东西
/* JADX INFO: Access modifiers changed from: protected */，那我们再来改改代码
package org.example;
import net.bytebuddy.agent.builder.AgentBuilder;
import net.bytebuddy.asm.Advice;
import net.bytebuddy.matcher.ElementMatchers;
import java.lang.instrument.Instrumentation;
import java.lang.reflect.Method;
public class MyAgent {
public static void premain(String agentArgs, Instrumentation inst) throws Exception {
System.out.println("premain");
AgentBuilder agentBuilder = new AgentBuilder.Default()
.with(AgentBuilder.RedefinitionStrategy.RETRANSFORMATION)
.with(AgentBuilder.InitializationStrategy.NoOp.INSTANCE)
.with(AgentBuilder.TypeStrategy.Default.REDEFINE)
.ignore(ElementMatchers.nameStartsWith("net.bytebuddy."));
// .with(new MyAgentListener());
// Eat Window
agentBuilder.type(ElementMatchers.named("com.intellij.openapi.ui.impl.DialogWrapperPeerImpl"))
.transform((builder, typeDescription, classLoader, module, protectionDomain) -> builder
.visit(Advice.to(EatWindowAdvice.class)
.on((ElementMatchers.named("setTitle"))
.and(ElementMatchers.takesArgument(0, String.class)))))
.installOn(inst);
}
public static class EatWindowAdvice {
@Advice.OnMethodEnter
public static void intercept(@Advice.This Object thisObject, @Advice.Argument(0) String title)
throws ClassNotFoundException {
System.out.println("Window is about to open ==> title is: " + title);
if (title.contains("许可证") || title.contains("Licenses")) {
System.out.println("Eat! Eat! Eat!");
try {
// thisObject.getClass().getMethod("dispose").invoke(thisObject);
Method disposeMethod = thisObject.getClass().getDeclaredMethod("dispose");
disposeMethod.setAccessible(true);
disposeMethod.invoke(thisObject);
} catch (Exception e) {
e.printStackTrace();
}
}
}
}
}
再来康康效果
达到预期效果，完美，又成功水了一帖
小菜鸡一枚，还是得多像大佬们学习学习