>>>>> "Martin" == Martin Schlienger <m.schlienger@xxxxxxxxx> writes: Martin> Current behavior acts like this, macro-algorithm: [..] Martin> Class loadClass(String className){ Martin> if (bootstrap) { Martin> c= VMClassLoader.loadClass(className); Martin> Basically all we have done is add a step at Martin> bootstrap. Normally all classes to perform a Martin> RemoteClassLoader.loadClass() can be loaded with the first Martin> step VMClassLoader.loadClass(). In the end we want to have Martin> only these classes in the local core API and the rest of the Martin> API distant. Yup. I'd suggest that instead of thinking of the solution in terms of writing a class loader, think about it in terms of writing some code that simply returns a byte[] that is the class contents. Then call this downloading code from VMClassLoader.loadClass. How you implement the downloading is up to you, but it turns out to be pretty simple to re-use URLClassLoader for this... just treat the .class file at the URL as a resource, not a class, and don't use the loadClass family of calls on your delegate URLClassLoader at all. Martin> We have done some basic tests and this seemed to work. However, when Martin> trying with a more complete program, it appears that it throws Martin> IllegalAccessException making me think that some security is added Martin> when using the defineClass() on core API. For this sort of a thing more details are needed. At least a full stack trace. But if you follow the above this may be moot. Tom