searching contents of .class file within jar (for strings)

wakeboarder3780 · 02-16-2009, 11:08 AM

This may sound a bit odd, but at work we are having some difficulty figuring out what code is the culprit of printing to stdout. Our console is flooded with info lets say it's this:

System.out Tag read -> myTag
System.out Tag name -> myName

I want to be able to search in every jar, in every class file (they may be binary, but the strings will still be readable) to see if "Tag read" is in the .class file. For instance if it werent for jars I could do this:

find -iname "*.class" -print0 | xargs -0 -n1 grep Tag\ read

I don't know how to handle this when they are also jar'd up in an archive.

find . -iname "*.jar" -print0 | xargs -0 -n1 ??what goes here??

It would be nice if I didn't actually have to extract files, but if I could specify a tmp location to extract to, so it doesn't muddy up the repository directories that would also be acceptable.

jan61 · 02-16-2009, 01:50 PM

Moin,

if you only want to know first, in which files the string appears, you can use the following sample (works only with GNU find!):

Code:

find . -iname '*.jar' -printf "unzip -c %p | grep -q 'Tag read' && echo %p\n" | sh

The find prints a command line like this: unzip -c /path/to/something.jar | grep -q 'Tag read' && echo /path/to/something.jar for each found file. This command is piped to a shell. The -c option of unzip prints the content to stdout, this output is piped to the grep. It's -q option suppresses the normal output and returns immediately with exit code zero, if a line matches.

Jan

EDIT: If you want to know, in which class within the archive the string appears, try this:

Code:

find . -iname '*.jar' -print | while read jar; do
  echo "$jar:"
  unzip -qq -l $jar | sed 's/.* //' | while read cls; do
    unzip -c $jar $cls | grep -q 'Tag read' && echo "   "$cls
  done
done

wakeboarder3780 · 02-17-2009, 07:42 AM

wow I really wish I knew more about how this line worked because it works flawlessly and is disgustingly fast. It looks like you are printing a custom command out to the shell (sh). I understand everything except the %p. What command does %p belong to? Is it a built in shell variable? I realize its whatever is found by the find command.. but I'm very confused as to how it's ever stored there.

Also, does 'sh' always default to whatever shell is currently in use?

wakeboarder3780 · 02-17-2009, 07:52 AM

Well I found out where the %p lives, I should have read the manual harder before jumping on here. (I thought typing '/%p' while in the man page would jump to it, but I guess not)

For anyone else reading this:
%p is part of the -printf option within the find command. It will be resolved to the name of the file.

Furthermore 'sh' is actually the command for the gnu bourne again shell, and here I thought it was 'bash'. Apparently you can run either?

jan61 · 02-17-2009, 01:49 PM

Moin,

Quote:

Originally Posted by wakeboarder3780

Furthermore 'sh' is actually the command for the gnu bourne again shell, and here I thought it was 'bash'. Apparently you can run either?

on many systems sh is a link to bash:

Code:

jan@jack:~/tmp> ls -li `which bash`
40908 -rwxr-xr-x  1 root root 447256 2004-04-24 20:57 /bin/bash
jan@jack:~/tmp> ls -li `which sh`
40812 lrwxrwxrwx  1 root root 4 2004-04-28 22:19 /bin/sh -> bash

For the commands used in this case it doesn't matter, to which shell you are piping the output - there are no bash specific commands.

Jan