JDK 17: --illegal-access=permit removed

[ryanmkurtz]

There are some known issues with Ghidra and JDK 17, which is scheduled to be released on 09/14/2021.

This issue is to address the OpenJDK 64-Bit Server VM warning: Ignoring option --illegal-access=permit; support was removed in 17.0 warning you get when launching Ghidra with JDK 17.

The following table outlines how each illegal access can occur within Ghidra. The bold entries are relevant to the Ghidra client application:

Source	Target	Scenario
net.sf.cglib.core	java.base/java.lang	Importing new binary into Ghidra (Raw Binary becomes only choice)
org.apache.felix.framework	java.base/java.net	Closing CodeBrowser
com.google.gson.internal	java.base/java.util	google/gson#1875
ghidra.framework.GhidraApplicationConfiguration	java.desktop/sun.awt.X11	Setting application title on Linux
ghidra.docking.util.painting.GRepaintManager	java.desktop/sun.awt.image	Running in "Inverted Colors" mode
ghidra.net.ApplicationKeyManagerUtils	java.base/sun.security.x509	Connecting to shared project using PKI
ghidra.net.ApplicationKeyManagerUtils	java.base/sun.security.util	Connecting to shared project using PKI
ghidra.server.RepositoryManager	java.rmi/sun.rmi.transport.tcp	Server RMI
ghidra.net.ApplicationKeyManagerUtils	java.base/sun.security.provider	Server tests
ghidra.util.task.CachingSwingWorkerTest	java.desktop/sun.swing	Swing tests
ghidra.app.util.headless.MyHeadlessGraphicsEnvironment	java.desktop/sun.java2d	Headless tests

Solution:
Add the following JVM arguments to launch.properties and Ghidra.launch:

VMARGS=--add-opens java.base/java.lang=ALL-UNNAMED
VMARGS=--add-opens java.base/java.util=ALL-UNNAMED
VMARGS=--add-opens java.base/java.net=ALL-UNNAMED
VMARGS=--add-opens java.desktop/sun.awt.image=ALL-UNNAMED
VMARGS=--add-opens java.base/sun.security.x509=ALL-UNNAMED
VMARGS=--add-opens java.base/sun.security.util=ALL-UNNAMED
VMARGS_LINUX=--add-opens java.desktop/sun.awt.X11=ALL-UNNAMED

An equivalent solution will have to be implemented for tests and the server, which do not currently use launch.properties. That will be handled in a different ticket.

If this is not fixed, several jars that perform illegal reflective accesses will not function properly, as we saw with JDK 16 in #2879, #2888, #2904, #2999, and #3030.

[homes410]

Below are lines that appended to launch.properties for ghidra 9.2.4 working in windows 10 - eclipse-temurin-java17-beta.

VMARGS=--add-opens=java.base/java.util=ALL-UNNAMED
VMARGS=--add-opens=java.base/java.lang=ALL-UNNAMED
VMARGS=--add-opens=java.base/java.net=ALL-UNNAMED
VMARGS=--add-opens=java.base/sun.nio.ch=ALL-UNNAMED
VMARGS=--add-opens=java.desktop/java.awt.event=ALL-UNNAMED
VMARGS=--add-opens=java.desktop/sun.awt.image=ALL-UNNAMED
VMARGS=--add-opens=java.desktop/java.awt=ALL-UNNAMED
VMARGS=--add-opens=java.desktop/sun.awt=ALL-UNNAMED
VMARGS=--add-opens=java.desktop/sun.swing=ALL-UNNAMED
VMARGS=--add-opens=java.desktop/javax.swing=ALL-UNNAMED
VMARGS=--add-opens=java.desktop/javax.swing.text.html=ALL-UNNAMED
VMARGS=--add-opens=java.desktop/javax.swing.plaf.basic=ALL-UNNAMED
VMARGS=--add-opens=java.desktop/sun.java2d=ALL-UNNAMED
VMARGS=--add-opens=java.desktop/sun.awt.windows=ALL-UNNAMED
VMARGS=--add-opens=java.desktop/sun.font=ALL-UNNAMED
VMARGS=--add-opens=java.base/sun.net.www.protocol.file=ALL-UNNAMED
VMARGS=--add-opens=java.base/sun.net.www.protocol.ftp=ALL-UNNAMED
VMARGS=--add-opens=java.base/sun.net.www.protocol.http=ALL-UNNAMED
VMARGS=--add-opens=java.base/sun.net.www.protocol.https=ALL-UNNAMED
VMARGS=--add-opens=java.base/sun.net.www.protocol.jar=ALL-UNNAMED
VMARGS=--add-opens=java.base/sun.net.www.protocol.jmod=ALL-UNNAMED
VMARGS=--add-opens=java.base/sun.net.www.protocol.mailto=ALL-UNNAMED
VMARGS=--add-opens=java.base/sun.net.www.protocol.jrt=ALL-UNNAMED
VMARGS=--add-opens=java.base/jdk.internal.loader=ALL-UNNAMED
VMARGS=--add-opens=java.base/java.security=ALL-UNNAMED

[ryanmkurtz]

Did you find that you needed every entry there?

[homes410]

Did you find that you needed every entry there?

No, These are borrowed lines required to intelijidea working in 17. and It made ghidra working in 17 too.

[xiaoyinl]

@ryanmkurtz I saw there's a related issue in gson: google/gson#1875. The workaround is to add --add-opens java.base/java.util=ALL-UNNAMED. Since some extensions use gson, do we need to add this argument to launch.properties too?

[ryanmkurtz]

Yep, we'll need to add that one. Thanks for letting me know!

[Wall-AF]

On Windows 10 with JDK 16.0.1, I'm still getting the following warning:
WARNING: package sun.awt.X11 not in java.desktop

[ryanmkurtz]

We need an --add-opens for that package on Linux so the application title gets set correctly, but unfortunately when you reference that package on Windows you get that new warning. It's not a problem in a build because we support platform-specific JVM arguments in launch.properties, but when running from Eclipse, they are all just put directly in the run configuration where we can't do it by platform. I do most of my development on Windows so I will be motivated to get rid of it somehow, but for now it's normal to see it.

[dtshepherd]

Was there a separate issue tracking fixing this for Ghidra Server? For now, I just hacked it in with a giant environment variable with _JAVA_OPTIONS, but that's not ideal. Does the server support a properties file somewhere?

[ryanmkurtz]

See #3406

[XVilka]

You probably want to unpin the issue now, after it was fixed.

[ryanmkurtz]

The main point of pinning it was to try to prevent duplicate tickets from being generated. Now that Java 17 is out, that is more likely than before. Hopefully people will see it pinned and see the fix is to upgrade to 10.0.3.