This is not strictly 'reverse engineering', it's mostly related to dynamic instrumentation.
So, in the same fashion as
strace which allows you to see syscalls made by a process, or
ftrace to see function calls, is there anything similar for Java?
What I am interested in is having a
.jar file that is run in a javaVM.
Is there any way to instrument or trace all the Java API calls the application code makes ?
That is, without any static analysis of the contents of the
.jar or without any editing of the contents of
.jar (e.g. to add hooks). Ideally, a solution equivalent to
strace or e.g. a manipulated javaVM
The same applies on Android - Is there a way to trace all Android framework API calls (or other essentially DalvikVM functions) an application makes without any editing at all of the APK file? All other editing of the environment/system is fine.
In my ideal world, the analyst would get the following output, while running an UNEDITED application (
timestamp1: java.security.SecureRandom.getSeed() called. Arguments: (Number) timestamp2: javax.security.cert.X509Certificate.checkValidity() called. Arguments: (null) ... timestamp3: java.sql.Connection.prepareStatement() called. Arguments: ("SELECT * FROM X WHERE Y = W")