8

In native code on windows functions can be hooked by replacing their prologue with a JMP instruction.

Is there a way to do something similar with an application written in java? In the end I want to record all data sent to/from a javax.net.ssl.SSLSocket.

I can't modify the jar file or the jre on disk, because it will bail if the hashes don't match up, but I can hook any function from native code during runtime.

I have a working solution right now, but it's very messy and not that flexible. I'm hooking JNI_CreateJavaVM and inserting -Djavax.net.debug=all into the arguments passed to it. This causes all data sent over the socket to be written to disk, and then I'm hooking WriteFile to intercept that data before it gets written to disk.

I found something that looked close to what I want, the -javaagent parameter, but by the time my agent is loaded all of the java standard library is loaded so I don't see a way to hook it using an agent.

Improve this question
2
  • In the specific case of a network socket, wouldn't wireshark be a better alternative to messing with the java classes? Or, if you can't make wireshark decrypt the traffic because you don't have access to the server's private key, something like mitmproxy (mitmproxy.org) or fiddler (telerik.com/fiddler)?
    – Guntram Blohm
    Jun 12, 2014 at 11:42
  • 1
    Have you considered building the JVM from source and adding instrumentation to the JVM itself?
    – Antimony
    Jun 12, 2014 at 14:51

2 Answers 2

Reset to default
6

edit: This question overlaps with Dynamic java instrumentation?

Jeong Wook Oh did a presentation at Blackhat 2012 were he explained how to trace Java programs by modifying the bytecode to call hook methods, see the "Automation" section of the paper. There is no source or tool available as far as I know.

There is also a tool called Javasnoop that is available, I did not test it. It uses the "Attach API" to monitor API calls. This method seems cleaner for what you want to do.

Improve this answer
3
  • From the sound of it, bytecode modification is unlikely to work here due to the application checking hashes of itself.
    – Antimony
    Jun 12, 2014 at 14:51
  • Regarding the duplication, IMO it depends on whether you consider tracing and instrumentation the same as hooking. Hooking to me means inserting some piece of code which could also change the parameters, output of the function and affect program state. There's certainly some overlap but the intent, possibly acceptable runtime overhead and the requirements on the level of user interaction may be very different.
    – Peter Andersson
    Jun 19, 2014 at 16:17
  • You're right, duplicate wasn't the right term, I mean't it as "make sure to check this question too for answers". I reworded it to "this question overlaps with".
    – ekse
    Jun 19, 2014 at 17:36
1

I've used javasnoop on jobs before. Use AspectJ, there's a learning curve for that too but it's absolutely the correct solution for you.

Improve this answer
2
  • Do you have a reference of how to use AspectJ for hooking/instrumentation?
    – ekse
    Jun 19, 2014 at 17:34
  • That's all it does. The official documentation.
    – offbyseveral
    Jun 19, 2014 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.