How yashr-cmd/doom-the-titans-__-jvmti-agent works
DTT is a pure-C JVMTI agent that protects selected DOOM The Titans classes from in-process tampering. It initializes inside the JVM, observes protected-class loading and redefinition, and uses both a class-load hook and a periodic live-bytecode watchdog; detected changes are restored from cached known-good bytes where possible, with repeat offenses reflected to the hostile thread. A separate vanilla-class guard injects checks that call the Java helper. The README documents the scope and fail-safe behavior; unsampled module internals are represented only where their interfaces or documented roles support the relationship.
Main entry points: dtt_agent.c Native agent · dtt_callbacks.c JVMTI callbacks · dtt_watchdog.c Bytecode watchdog · dtt_vanilla_guard.c Vanilla guard injection
Components 15
Agent lifecycle
- Native agent
dtt_native_agent/src/dtt_agent.c
Detection and repair
- JVMTI callbacks
dtt_native_agent/src/dtt_callbacks.c - Protected-class policy
dtt_native_agent/src/dtt_protected.c - Bytecode watchdog
dtt_native_agent/src/dtt_watchdog.c - Baseline cache
dtt_native_agent/src/dtt_cache.c - Thread response
dtt_native_agent/src/dtt_threads.c
Vanilla guards
- Vanilla guard injection
dtt_native_agent/src/dtt_vanilla_guard.c - Classfile patcher
dtt_native_agent/src/dtt_classfile.c - Java protection helper
dtt_native_agent/java/runtime/PreatorGodHelper.java
Runtime support
- Java reporting bridge
dtt_native_agent/src/dtt_bridge.c - Java native bridge
dtt_native_agent/java/runtime/NativeIntegrityBridge.java - Transform authorization
dtt_native_agent/src/dtt_auth.c - Logging
dtt_native_agent/src/dtt_log.c - Platform support
dtt_native_agent/include/dtt_platform.h
Other components
- JVM
Connections 19
- JVM → Native agent: loads agent
README.md - Native agent → JVMTI callbacks: registers callbacks
dtt_native_agent/src/dtt_agent.c - Native agent → Bytecode watchdog: starts watchdog
- JVMTI callbacks → Protected-class policy: checks classes
dtt_native_agent/src/dtt_callbacks.c - JVMTI callbacks → Vanilla guard injection: intercepts classes
dtt_native_agent/src/dtt_callbacks.c - JVMTI callbacks → Thread response: handles offenses
dtt_native_agent/src/dtt_callbacks.c - JVMTI callbacks → Baseline cache: restores baseline
dtt_native_agent/src/dtt_callbacks.c - Bytecode watchdog → Baseline cache: checks baseline
dtt_native_agent/src/dtt_watchdog.c - Bytecode watchdog → Protected-class policy: scans protected classes
dtt_native_agent/src/dtt_watchdog.c - Vanilla guard injection → Classfile patcher: patches bytecode
dtt_native_agent/src/dtt_vanilla_guard.c - Vanilla guard injection → Java protection helper: injects helper calls
- Native agent → Java reporting bridge: reports incidents
README.md - Java reporting bridge → Java native bridge: calls native bridge
dtt_native_agent/src/dtt_bridge.c - JVMTI callbacks → Transform authorization: checks authorization
dtt_native_agent/src/dtt_callbacks.c - Native agent → Thread response: initializes tracking
dtt_native_agent/src/dtt_agent.c - Native agent → Baseline cache: initializes cache
dtt_native_agent/src/dtt_agent.c - JVMTI callbacks → Logging: logs events
dtt_native_agent/src/dtt_callbacks.c - Native agent → Platform support: selects platform support
dtt_native_agent/src/dtt_agent.c - Bytecode watchdog → Logging: logs detections
dtt_native_agent/src/dtt_watchdog.c