t-artistik / javasnoop Goto Github PK

What steps will reproduce the problem?
1. Start Java process and attach & snoop it
2. Add new hook & click on browse, to select a class for hooking
3. Check the option "Only show classes with main() methods"


What is the expected output? What do you see instead?
Program crashes with the message 
[3] Starting JavaSnoop...
Could not load keymap: java.util.MissingResourceException: Can't find bundle 
for base name oracle.javatools.editor.keys.DefaultKeymapping, locale de_DE
[4] Turning Java security back on for safe browsing

What version of the product are you using? On what operating system?
Linux hostname 3.1.10-1.16-desktop #1 SMP PREEMPT Wed Jun 27 05:21:40 UTC 2012 
(d016078) x86_64 x86_64 x86_64 GNU/Linux

Please provide any additional information below.
It is Linux OS with German as System language.

What steps will reproduce the problem?
1. Add new hook
2. Toggle "Print parameters"

What is the expected output? What do you see instead?

I got an error : Failure establishing hooks: javassist.CannotCompileException: 
[source error] no such class: com$aspect.snoop.agent.SnoopAgent

What version of the product are you using? On what operating system?
JavaSnoop-1.1-RC2 on Elementary OS Luna

Any ideas ?
Thanks a lot !

What steps will reproduce the problem?
1. Launch JavaSnoop and load this page: 
http://bright-shadows.net/challenges/applet3/index.php
2. Load the plugin
3. Add a hook to the decrypt method and try to activate any "On execution" 
checkboxes

What is the expected output? What do you see instead?
A very large exception error appears in an alert box. The error text is:
Failure sending agent new rules: Couldnt send agent rules: Java.io.IOException: 
bad magic number: 3c21444f

What version of the product are you using? On what operating system?
Latest version at Windows 7 x86

Right now, when a new application is started through JavaSnoop, there is no way 
to save the parameters for easy loading later. This "profile" should be capable 
of being easily saved/loaded from the "Start new process" screen.

If the target app has an application-modal main window, the JavaSnoop window 
can't be selected.

Possible solution: loop through all JFrame/JDialogs on successful attach and 
make them un-modal. Should be optional configured through checkbox.

Launching javasnoop under windows 7 x64, java 1.6.0_37

launching from the startup.bat script.

the "existing processes" list is empty.  There are no other
complaints apparent.

I succeeded in building and running from the netbeans project and sources, same 
results.

What steps will reproduce the problem?
1. Snoop on an application that uses proxy classes for something. Spring 
Remoting comes to mind
2. Try to hook an interface that is implemented by a proxy class
3. Try to remote browse the proxy class

What is the expected output? What do you see instead?
Expected output: Rainbows, unicorns, and JavaSnoop magically being able to hook 
a proxy interface so I can tamper with Spring Remoting in JavaSnoop.
See: error message (attached) when trying to hook the interface or nothing when 
browsing.

What version of the product are you using? On what operating system?
FINAL 1.0 on WinXP SP3 VM

Please provide any additional information below.
I'll buy you a six pack of Mike's Hard if you get this going.

What steps will reproduce the problem?
1. Attach to proccess
2. Hook to a method that has an byte[][] parameter
3. Check the tamper input parameters

What is the expected output? What do you see instead?
No error or exceptions. A compile exception.

What version of the product are you using? On what operating system?
1.1 RC2; Windows xp sp3; Java 6.41u;

Please provide any additional information below.

JavaSnoop 1.0 RC4, Win7 x86, JDK 1.6.0_21 (32-bit), starting using startup.bat.

What steps will reproduce the problem?
1. Launch jEdit
2. Launch JavaSnoop, attach to jedit.jar process
3. Add function hook on 
org.gjt.sp.jedit.search.SearchAndReplace.setSearchString (or any function)
4. Enable [x] Print parameters and [x] ...to console options for hook
5. Trigger function by running a search in jEdit. Observe [SNOOP ERROR] as 
below.

This seems to happen regardless of what I try to use JavaSnoop on (tried 
applets too).

---

[SNOOP ERROR] Encountered exception during PrintParameters communication: 
com.aspect.snoop.agent.AgentCommunicationException: Couldn't tell home base to 
print parameters: null
java.lang.NullPointerException
    at com.aspect.snoop.ui.JavaSnoopView.printParameters(JavaSnoopView.java:2012)
    at com.aspect.snoop.agent.SnoopServerThread.processCommand(SnoopServerThread.java:104)
    at com.aspect.snoop.agent.AbstractServerThread.run(AbstractServerThread.java:82)

    at com.aspect.snoop.agent.AgentToSnoopClient.printParameters(AgentToSnoopClient.java:307)
    at org.gjt.sp.jedit.search.SearchAndReplace.setSearchString(SearchAndReplace.java)
    at org.gjt.sp.jedit.search.SearchDialog.save(SearchDialog.java:816)
    at org.gjt.sp.jedit.search.SearchDialog.ok(SearchDialog.java:206)
    at org.gjt.sp.jedit.search.SearchDialog$ButtonActionHandler.actionPerformed(SearchDialog.java:1030)
    at javax.swing.AbstractButton.fireActionPerformed(Unknown Source)
    at javax.swing.AbstractButton$Handler.actionPerformed(Unknown Source)
    at javax.swing.DefaultButtonModel.fireActionPerformed(Unknown Source)
    at javax.swing.DefaultButtonModel.setPressed(Unknown Source)
    at javax.swing.plaf.basic.BasicButtonListener.mouseReleased(Unknown Source)
    at java.awt.Component.processMouseEvent(Unknown Source)
    at javax.swing.JComponent.processMouseEvent(Unknown Source)
    at java.awt.Component.processEvent(Unknown Source)
    at java.awt.Container.processEvent(Unknown Source)
    at java.awt.Component.dispatchEventImpl(Unknown Source)
    at java.awt.Container.dispatchEventImpl(Unknown Source)
    at java.awt.Component.dispatchEvent(Unknown Source)
    at java.awt.LightweightDispatcher.retargetMouseEvent(Unknown Source)
    at java.awt.LightweightDispatcher.processMouseEvent(Unknown Source)
    at java.awt.LightweightDispatcher.dispatchEvent(Unknown Source)
    at java.awt.Container.dispatchEventImpl(Unknown Source)
    at java.awt.Window.dispatchEventImpl(Unknown Source)
    at java.awt.Component.dispatchEvent(Unknown Source)
    at java.awt.EventQueue.dispatchEvent(Unknown Source)
    at java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source)
    at java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)
    at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
    at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
    at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
    at java.awt.EventDispatchThread.run(Unknown Source)

What is the expected output? What do you see instead?
It would be awesome to somehow hook everything automatically and dump 
somewhere. Being on the slow bus, I have no idea what functions or methods I 
want to hook initially. If I could somehow dump everything from point A to B 
and then offline search, JavaSnoop would make me that much more happy. It makes 
me happy as is. I'm just a bit sullen at the moment and javasnoop would help me 
get out of my rut.

What version of the product are you using? On what operating system?
1.0 FINAL, WinXP SP3

Please provide any additional information below.
I still love Arshan even if he doesn't want to implement this.

What steps will reproduce the problem?
1. When the Edit Method Parameters window pops up and I want to edit the 
parameters, I can't see the edit button because the window is too small which 
means I can't edit the parameters. Maximize is not an option in the window menu 
although this is inconsistent. Sometimes it shows minimize, restore, size, and 
other times just close. 

What is the expected output? What do you see instead?
One time I was able to maximize and see the edit button. But I can't make it 
appear again.

What version of the product are you using? On what operating system?

Version 1.0 on XP Pro SP3 with jdk1.6.0_14

See screenshot

What steps will reproduce the problem?
1. Start JBoss AS7
2. Try to attach JavaSnoop
3. Note the HeadlessException, lack of any constructive action from JavaSnoop

What is the expected output? What do you see instead?
JBoss produces a stacktrace that includes a "HeadlessException' and JavaSnoop 
produces no UI.  

What version of the product are you using? On what operating system?
JavaSnoop 1.1RC2 on Ubuntu

Please provide any additional information below.
I also ran JavaSnoop against JBossESB/SOA-P, using 1.0Final.  This also had 
trouble, but at least let me attach/set a hook, etc.

I want JSP/web interface for javasnoop so that i can snoop my application using 
internet explorer for remote production box.

What steps will reproduce the problem?
1. Press button "Attach & Snoop Process..."
2. Choose Java process in the list
3. Press button "Use this as session (and attach)"

What is the expected output? What do you see instead?
Status "SNOOPING". JavaSnoop error: "Could not initialize agent: Agent JAR
                                 loaded but agent failed to initialize"    

What version of the product are you using? On what operating system?
JavaSnoop 1.0.  Windows XP SP3; linux CENTOS 2.6.18-194.3.1.el5

Please provide any additional information below.
Windows Java Arguments process attached:
PID: 9128
Main class: 
Main arguments: null
JVM arguments:
-Xms24m -Xmx1024m -Dnetbeans.logger.console=true -ea -Djdk.home=C:\Archivos de 
programa\Java\jdk1.6.0_23 -splash:C:\Documents and Settings\xxx\Datos de 
programa\.expertlotto\5.0_beta\var\cache\splash.png -Dnetbeans.home=C:\Archivos 
de programa\Expert Lotto 5 BETA\platform -Dnetbeans.user=C:\Documents and 
Settings\xxx\Datos de programa\.expertlotto\5.0_beta 
-XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=C:\Documents and 
Settings\xxx\Datos de programa\.expertlotto\5.0_beta\var\log\heapdump.hprof 
-Dnetbeans.system_http_proxy=10.12.20.149:80 
-Dnetbeans.system_http_non_proxy_hosts=127.0.0.1 
-Dsun.awt.keepWorkingSetOnMinimize=true -Dnetbeans.dirs=C:\Archivos de 
programa\Expert Lotto 5 BETA\expertlotto
VM version: 19.0-b06


Linux Java Arguments process attached:
PID: 2515
Main class: org.netbeans.Main
Main arguments: --userdir /root/.expertlotto/5.0_beta --branding expertlotto
JVM arguments: -Djdk.home=/usr/lib/jvm/java-1.6.0-openjdk.x86_64 
-Dnetbeans.dirs=/usr/local/expertlotto/bin/../expertlotto: 
-Dnetbeans.home=/usr/local/expertlotto/platform -Xms24m -Xmx1024m 
-Dnetbeans.logger.console=true -ea -XX:+HeapDumpOnOutOfMemoryError 
-XX:HeapDumpPath=/root/.expertlotto/5.0_beta/var/log/heapdump.hprof
VM version: 14.0-b16

What steps will reproduce the problem?
1. Attach to a process and hook a function you can force to execute
2. select the "print stack trace" and "to console" checkboxes
3. execute the related function
4. no stack trace has printed
5. select the "Print Parameters" checkbox
6. execute the same function
7. parameters and stack trace are printed.


What version of the product are you using? On what operating system?
Javasnoop 1.0, Windows XP SP3

Please provide any additional information below.

What steps will reproduce the problem?
1.Installed Java snoop and JDK 1.7
2. After that i set environment variables as with JDK
3. When i tried to open with Existing process getting an error "Virtual machine 
doesn't support attaching:No providers installed

What is the expected output? What do you see instead?
The target should be attached with the JavaSnoop process


What version of the product are you using? On what operating system?
XP

Please provide any additional information below.

What steps will reproduce the problem?
1. I launch my .jar APP
2. During attaching process i have message "Targeted virtual machines does not 
support attaching : Unable to open socket file: target process not responding 
or HotSpot VM not loaded"

What version of the product are you using? On what operating system?

I'm on Linux Kali, i have configure Kali for use JDK 1.8.05 (x86). I have 
configure my JAVA_HOME & PATH

I use latest version of Javasnoop.


Please provide any additional information below.

I launch Javasnoop in with root account.

I have test every possibility but i don't have found a Issue. 

CAn you help me please ? Thanks you !! 

Sorry for my english i'm french !

What is the expected output? What do you see instead?
It would be nice to dump return values instead of just tampering them. 
Parameters can be dumped. Whatcha got against return values? :-)

What version of the product are you using? On what operating system?
1.0 FINAL, WinXP SP3

Please provide any additional information below.
Arshan, you're my hero.

On a Windows 7 64-bit/Sun 1.6.0_u24 the Dump Source Code action is failing for 
a local application.

Reproduction steps:
1. Attach to an app with Maven-style jar names
2. Dump Source
3. Exceptions appear

What steps will reproduce the problem?
1. Snoop on an application that loads resources required for something
2. Wait for java.lang.NullPointerException

What is the expected output? What do you see instead?
When JavaSnoop instruments a class it magically pulls in all the resources for 
that class. It currently doesn't do this at the moment.


What version of the product are you using? On what operating system?
1 FINAL on WinXP SP3

Please provide any additional information below.

Here's the method pseudo-code:

XXXXX method:
foo = new ImageIcon(Some.class.getResource("/path/to/some.png"));
bar(foo.getImage());

ImageIcon isn't happy with the null from class.getResources it seems. The jar 
does contain the some.png resource at the correct path. JavaSnoop doesn't seem 
to load the resource correctly.

Here's a partial stack trace:

java.lang.NullPointerException
    at javax.swing.ImageIcon.<init>(ImageIcon.java:167)
    at XXXXX method
    at java.lang.Class.forName(Class.java:247)
    at com.aspect.snoop.ui.hook.FunctionSearchView.populateResults(FunctionSearchView.java:265)
    at com.aspect.snoop.ui.hook.FunctionSearchView.txtMethodKeyTyped(FunctionSearchView.java:229)
    at com.aspect.snoop.ui.hook.FunctionSearchView.access$100(FunctionSearchView.java:34)
    at com.aspect.snoop.ui.hook.FunctionSearchView$2.keyTyped(FunctionSearchView.java:120)
    at java.awt.Component.processKeyEvent(Component.java:6222)
[...]

What steps will reproduce the problem?

1. Attach to a process which loads classes with a custom class loader at 
runtime (remote via network)

2. Open "Class Management -> Browse Remote Classes" and see all classes (even 
the ones loaded at runtime later on) <-- expected behaviour

3. Open "Add New Hook -> Browse" and see only that classes which have been 
within the inital JAR file but NOT the classes loaded during runtime <-- 
discrepany to classes listed in step 2.

What is the expected output? What do you see instead?

Get the same list of classes, both within the "class management" and the 
"browse window for hooking". Currently it's not possible to select classes and 
hook functions which was added thru class loading at runtime.

Possible solution?

Maybe ui.JavaSnoopView.showChooseClassForm() should also perform a 
GetRemoteClasses()-Request to SnoopAgent (as 
JavaSnoopView.browseRemoteClasses() does)?

The process "C:\Program Files (x86)\jEdit 4.3.2\jEdit.jar" shows up in the 
Attach & Snoop window as Main Class "C:\Program" with Main Arguments "Files 
(x86)\jEdit 4.3.2\jEdit.jar"

Hello Arshan,

I just wanted to submit you an improvement I made about JavaSnoop.

With the current version, you can only insert custom script before and after a 
hook. According to the Javassist documentation (and tests), the inserted code 
with insertBefore() or insertAfter() can not access local variables neither 
modify the current hooked method implementation, we can't really instrument 
hooks as we'd like to: we can't nuke routines that perform checks (like a 
Certificate Pinning routine) returning void.

As a consequence, I currently replaced the insertAfter() custom script panel by 
a panel where you can insert custom code that'll be executed IN PLACE of the 
hooked one, using the Javassist setBody() function.

You can find the different patchs here:
* 
https://github.com/maaaaz/misc_hookons_avec_javasnoop/commit/d00e4d04da0dffcefab
596b060a42b579dc5617b#diff-7f0dc9d8a99cbc4231ce262b1fa80ac5

* 
https://github.com/maaaaz/misc_hookons_avec_javasnoop/commit/d00e4d04da0dffcefab
596b060a42b579dc5617b#diff-2feae6f1b47318dec42bdb9b569a4160


It would be great if you manage to integrate this improvement in the next 
JavaSnoop version, for instance adding a third custom script panel in order to 
keep the insertAfter() one.

By the way, you code "MonitoredVmUtil.isKernelVM(mvm)" in 
ChooseProcessView.java does not compile anymore (oracle jdk or openjdk). I just 
commented it : 
https://github.com/maaaaz/misc_hookons_avec_javasnoop/commit/d00e4d04da0dffcefab
596b060a42b579dc5617b#diff-ac3063cd13567bb52d4f27ff747e23eb

Cheers.

There is no %Java_Home% by default in the Environment Variables, and the 
registry reader of "startup.bat" cannot find the registry value (on win xp sp3, 
jdk1.6). Moreover, if there is an space on the path, you cannot use this batch 
file. For example, as there is several spaces in "Documents and settings" 
folder, it cannot disable/enable Java security.

I changed batch file and attached it here. Now, it is working properly.

Good luck

What steps will reproduce the problem?
1. open javasnoop
2. try to resize window

Expected: window can be resized to show all widgets in application
Actual: resizing is not possible, some widgets not reachable

What version of the product are you using? On what operating system?
version 1.0 on Linux (Ubuntu 10.10)

What steps will reproduce the problem?
1. When I try attaching javasnoop to a JNLP run Java Web Start application it 
gives an error that states Targeted Virtual Machine does not support attaching  
2. Here are the arguments
PID: 7920
Main class: com.sun.javaws.Main
Main arguments: C:\\Documents and Settings\\msatam\\Application 
Data\\Sun\\Java\\Deployment\\cache\\6.0\\19\\5d393513-362aab53
JVM arguments: -Xmx512m -Djnlp.packEnabled=true -Dsun.java2d.d3d=false 
-Xbootclasspath/a:C:\\Program Files\\Java\\jre6\\lib\javaws.jar;C:\\Program 
Files\\Java\\jre6\\lib\deploy.jar;C:\\Program Files\\Java\\jre6\\lib\plugin.jar 
-Djnlpx.vmargs=-Xmx512m -Djnlp.packEnabled=true -Dsun.java2d.d3d=false 
-Djnlpx.jvm=C:\Program Files\Java\jre6\bin\javaw.exe -Djnlpx.splashport=45049 
-Djnlpx.home=C:\\Program Files\\Java\\jre6\\bin -Djnlpx.remove=false 
-Djnlpx.offline=false -Djnlpx.relaunch=true -Djnlpx.heapsize=-1,536870912 
-Djava.security.policy=file:C:\\Program 
Files\\Java\\jre6\\lib\security\javaws.policy -DtrustProxy=true -Xverify:remote 
-Dsun.awt.warmup=true
VM version: 19.1-b02

3.

What is the expected output? What do you see instead?
The target should be attached with the JavaSnoop process

What version of the product are you using? On what operating system?
XP/SP3 

Please provide any additional information below.

What steps will reproduce the problem?
1. Start JavaSnoop
2. Look at js.log file

What is the expected output? What do you see instead?

Expect: [2010-01-21 09:55:23] SwingWorker-pool-3-thread-1 ERROR 
agent.AgentJarCreator - Warning - could not delete working directory!

See: SwingWorker-pool-3-thread-1 ERROR agent.AgentJarCreator - Warning - could 
not delete working directory!

What version of the product are you using? On what operating system?

FINAL on WinXP SP3

Please provide any additional information below.

Arshan is still my hero :-) :-) :-) :-)

What steps will reproduce the problem?
1. While snooping, click on Add New Hook
2. Click on Browse
3. This will popup the "Choose a class" window.

What is the expected output? What do you see instead?
Some type of navigation widgets, such as a scrollbar or a window resize when 
there are numerous results. No love. Just a small window. Very small. Very, 
very small.

What version of the product are you using? On what operating system?
FINAL!! WinXP SP3

Please provide any additional information below.
I love Arshan.

What steps will reproduce the problem?
1. put the JavaSnoop folder in s folder containing a white space
2.
3.

What is the expected output? What do you see instead?
JavaSnoop is unable to attach to a virtual machine due to the fact the 
the appropriate .zip file could not be build or read. 

What version of the product are you using? On what operating system?
Linux - Ubuntu 64 bit

Please provide any additional information below.

What steps will reproduce the problem?
1. Attach to any Java Program
2. Hook any method with parameters
3. Check "Tamper with parameters" and write a simple 
System.out.println(ParameterName); 


What is the expected output? What do you see instead?
The expected output is the value of the parameter. Insted of that, the 
following message is shown:

Failure establishing hooks: javassist.CannotCompileException [source error] no 
such class: ParameterName

What version of the product are you using? On what operating system?
I tested it with JavaSnoop 1.0 Final and 1.1 RC1 on Windows XP SP3

Please provide any additional information below.
All the other options as Print Parameters, Tamper with Parameters and Pause 
Program works fine.

What steps will reproduce the problem?
1. run javasnoop on Linux in a testing environment


What is the expected output? What do you see instead?

Javasnoop will fail to create, load and store the agents javasnoop.jar 

What version of the product are you using? On what operating system?

Linux - ubuntu 64bit

Please provide any additional information below.

The CLASSPATH separator character is platform dependent...