Java debuggers like those in IntelliJ IDEA support powerful features such as evaluating arbitrary expressions at breakpoints. This capability—modifying behavior of a running JVM without restarting—relies on several advanced JVM technologies working in concert.

The core mechanism involves dynamically altering bytecode of already-loaded classes. Libraries like ASM enable fine-grained manipulation of class files by generating or transforming raw bytecode. ASM uses a visitor pattern: ClassReader parses existing bytecode, a custom ClassVisitor modifies method or field structures, and ClassWriter emits the transformed bytecode.

However, modifying bytecode alone isn't sufficient. The JVM must be instructed to reload the changed class. This is where the java.lang.instrument package comes in. By implementing a ClassFileTransformer, developers can intercept class loading and substitute modified bytecode. For runtime modification (post-initialization), the Instrumentation.retransformClasses() method triggers redefinition of loaded classes.

To inject this instrumentation logic into a running JVM, Java agents are used. Agent are packaged JARs with a manifest specifying an Agent-Class containing either premain() (for startup-time attachment) or agentmain() (for runtime attachment). The latter enables attaching to an already-runing process via the JVM Attach API, accessible through com.sun.tools.attach.VirtualMachine from tools.jar.

The entire debugging stack—such as JDWP (Java Debug Wire Protocol)—builds atop these foundations. Debug commands from an IDE travel through JDI (Java Debug Interface), are serialized via JDWP, and ultimately executed using JVM TI (JVM Tool Interface), which provides low-level hooks into the virtual machine.

A minimal example illustrates this flow:

// Target class to modify
public class TransformTarget {
    public static void main(String[] args) throws Exception {
        while (true) {
            Thread.sleep(3000);
            printMessage();
        }
    }

    public static void printMessage() {
        System.out.println("hello");
    }
}

An agent attaches at runtime and replaces the method body:

public class RewriteAgent {
    public static void agentmain(String agentArgs, Instrumentation inst) {
        inst.addTransformer(new MessageRewriter(), true);
        try {
            inst.retransformClasses(TransformTarget.class);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

class MessageRewriter implements ClassFileTransformer {
    public byte[] transform(ClassLoader loader, String className, 
                            Class<?> clazz, ProtectionDomain domain, 
                            byte[] buffer) {
        if (!"TransformTarget".equals(className.replace('/', '.')))
            return null;

        ClassReader reader = new ClassReader(buffer);
        ClassWriter writer = new ClassWriter(ClassWriter.COMPUTE_FRAMES);
        reader.accept(new ClassVisitor(Opcodes.ASM9, writer) {
            @Override
            public MethodVisitor visitMethod(int access, String name, 
                                             String desc, String sig, 
                                             String[] exceptions) {
                if ("printMessage".equals(name)) {
                    MethodVisitor mv = super.visitMethod(access, name, desc, sig, exceptions);
                    mv.visitCode();
                    mv.visitFieldInsn(GETSTATIC, "java/lang/System", "out", "Ljava/io/PrintStream;");
                    mv.visitLdcInsn("bytecode replaced!");
                    mv.visitMethodInsn(INVOKEVIRTUAL, "java/io/PrintStream", "println", "(Ljava/lang/String;)V", false);
                    mv.visitInsn(RETURN);
                    mv.visitMaxs(2, 0);
                    mv.visitEnd();
                    return null; // skip original method body
                }
                return super.visitMethod(access, name, desc, sig, exceptions);
            }
        }, ClassReader.SKIP_DEBUG);
        return writer.toByteArray();
    }
}

Finally, an external process attaches the agent:

public class AgentAttacher {
    public static void main(String[] args) throws Exception {
        VirtualMachine vm = VirtualMachine.attach("12345"); // PID of target JVM
        vm.loadAgent("/path/to/agent.jar");
        vm.detach();
    }
}

This combination of ASM for bytecode engineering, instrument for class redefinition, and JVM attach mechanisms enables dynamic code modification—powering not only debuggers but also profiling, monitoring, and AOP tools in the Java ecosystem.