7

In native code on windows functions can be hooked by replacing their prologue with a JMP instruction.

Is there a way to do something similar with an application written in java? In the end I want to record all data sent to/from a javax.net.ssl.SSLSocket.

I can't modify the jar file or the jre on disk, because it will bail if the hashes don't match up, but I can hook any function from native code during runtime.

I have a working solution right now, but it's very messy and not that flexible. I'm hooking JNI_CreateJavaVM and inserting -Djavax.net.debug=all into the arguments passed to it. This causes all data sent over the socket to be written to disk, and then I'm hooking WriteFile to intercept that data before it gets written to disk.

I found something that looked close to what I want, the -javaagent parameter, but by the time my agent is loaded all of the java standard library is loaded so I don't see a way to hook it using an agent.

  • In the specific case of a network socket, wouldn't wireshark be a better alternative to messing with the java classes? Or, if you can't make wireshark decrypt the traffic because you don't have access to the server's private key, something like mitmproxy (mitmproxy.org) or fiddler (telerik.com/fiddler)? – Guntram Blohm supports Monica Jun 12 '14 at 11:42
  • 1
    Have you considered building the JVM from source and adding instrumentation to the JVM itself? – Antimony Jun 12 '14 at 14:51
6

edit: This question overlaps with Dynamic java instrumentation?

Jeong Wook Oh did a presentation at Blackhat 2012 were he explained how to trace Java programs by modifying the bytecode to call hook methods, see the "Automation" section of the paper. There is no source or tool available as far as I know.

There is also a tool called Javasnoop that is available, I did not test it. It uses the "Attach API" to monitor API calls. This method seems cleaner for what you want to do.

| improve this answer | |
  • From the sound of it, bytecode modification is unlikely to work here due to the application checking hashes of itself. – Antimony Jun 12 '14 at 14:51
  • Regarding the duplication, IMO it depends on whether you consider tracing and instrumentation the same as hooking. Hooking to me means inserting some piece of code which could also change the parameters, output of the function and affect program state. There's certainly some overlap but the intent, possibly acceptable runtime overhead and the requirements on the level of user interaction may be very different. – Peter Andersson Jun 19 '14 at 16:17
  • You're right, duplicate wasn't the right term, I mean't it as "make sure to check this question too for answers". I reworded it to "this question overlaps with". – ekse Jun 19 '14 at 17:36
1

I've used javasnoop on jobs before. It will work but the gui sucks a big one. Use AspectJ, there's a learning curve for that too but it's absolutely the correct solution for you.

| improve this answer | |
  • Do you have a reference of how to use AspectJ for hooking/instrumentation? – ekse Jun 19 '14 at 17:34
  • That's all it does. The official documentation. – offbyseveral Jun 19 '14 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.