Dynamic java instrumentation?

Question

This is not strictly 'reverse engineering', it's mostly related to dynamic instrumentation.

So, in the same fashion as strace which allows you to see syscalls made by a process, or ftrace to see function calls, is there anything similar for Java?

What I am interested in is having a .jar file that is run in a javaVM.

Is there any way to instrument or trace all the Java API calls the application code makes ?

That is, without any static analysis of the contents of the .jar or without any editing of the contents of .jar (e.g. to add hooks). Ideally, a solution equivalent to strace or e.g. a manipulated javaVM

The same applies on Android - Is there a way to trace all Android framework API calls (or other essentially DalvikVM functions) an application makes without any editing at all of the APK file? All other editing of the environment/system is fine.

In my ideal world, the analyst would get the following output, while running an UNEDITED application (.jar or .apk):

timestamp1: java.security.SecureRandom.getSeed() called. Arguments: (Number) 
timestamp2: javax.security.cert.X509Certificate.checkValidity() called. Arguments: (null)
...
timestamp3: java.sql.Connection.prepareStatement() called. Arguments: ("SELECT * FROM X WHERE Y = W")

Answer 1

Oracle Java Virtual Machine

Tracing the execution of a Java program can be done through the Java Platform Debugger Architecture (JPDA). This framework allow you to get a full control of an execution within the JVM (without having to modify the original code). See this tutorial for a more in depth view of this framework.

If you want to implement it by yourself, you should use the MethodEntryRequest interface and intercept any method call.

But, if you are lazy (just like me), you'd better use already existing projects such as InTrace (see also the Related Projects' page of the InTrace project).

Android Java Dalvik Virtual Machine

Tracing an Android Java program can be done through the Dalvik Debug Monitor Server (DDMS) and the full Android debug framework.

There exist already some tools to trace the execution of programs such as Traceview and dmtracedump tools. And, finally, a few tips about the Dalvik JVM.

Answer 2

You can instrument Java by using an agent, that will manipulate the bytecode of the loaded file (using Asm is recommented for bytecode manipulation).

You might want to use Eclipse's Bytecode Outline plugin to debug execution.

This is a good tutorial on the topic.

Answer 3

AspectJ can be used to do this on the JVM, via load-time weaving. It's built on Asm but there's more abstraction (no bytecode). Tracing method calls is fairly straight-forward: first define a filter to match "pointcuts" you're interested in, then specify the actions you want to perform ("advice").

The syntax is a bit awkward though:

package aspects;

import java.util.logging.Level;
import java.util.logging.Logger;

import org.aspectj.lang.Signature;

aspect Trace{
    pointcut traceMethods() : (execution(* *(..))&& !cflow(within(Trace)));

    before(): traceMethods(){
        Signature sig = thisJoinPointStaticPart.getSignature();
        String line =""+ thisJoinPointStaticPart.getSourceLocation().getLine();
        String sourceName = thisJoinPointStaticPart.getSourceLocation().getWithinType().getCanonicalName();
        Logger.getLogger("Tracing").log(
                Level.INFO, 
                "Call from "
                    +  sourceName
                    +" line " +
                    line
                    +" to " +sig.getDeclaringTypeName() + "." + sig.getName()
        );
    }

}

Compile with: ajc -outxml -outjar aspects.jar Trace.java.

To run FooClass with the weaver, run:

java -javaagent:aspectjweaver.jar -cp aspects.jar:${target_jar_name} FooClass