SRL Archive - Research & Development Lounge

Wizzup, I promised Ray to do some research based on hooking certain Java Virtual Machine APIs.
I am convinced you can intercept java calls such as System.out.println:

String a = "hai"; System.out.println(a);

Or ofc any other function, will do this tomorrow – after ACO hehe.
Not sure if its really that interesting to RS Bots, but who knows ^_^

greetings, skier_

look into java.util.instrument. it allows you to intercept class binary data at the time it is used to define a class (look into class loading to understand this). if you intercepted java.io.PrintStream (which System.out is an instance of), you could add some sort of check in the bytecode for println() like:

if (this == System.out) {
    Hub.notify(Hook.SYSTEM_OUT_PRINTLN);
}

where Hub is some class of yours with a method notify() which takes an instance of the enum Hook. there are also possibilities in hooking at the native level through JVMTI, although you should be warned the JVM has been shown to run slowly through this method. if you do take the JVMTI route, look into these functions:
http://download.oracle.com/javase/1.5.0/docs/guide/jvmti/jvmti.html#eventManagement

I was going to try another method, obviously in C :)
Doing this kinda stuff in Java (ie: Processing tons of Function Calls) would be extremely slow in Java, I think.
So Gonna use Java Native Interface & some Hooking.
Besides that – im pretty sure RS or sth else would nigger on you when trying to use some kind of Java Callback/Hook :p

no, they don't

Still more fun to do it in C :D

Just want to let you guys know im having success with Hooking Java Native API :)
Gonna do other stuff now, so gonna continue later on this project :)

[3360] java_Hooked_JNI_CreateJavaVM:89 -> ...
[3360] Hooked_NewStringUTF:29 -> str: AES/CBC/PKCS5Padding
[3360] Hooked_FindClass:35 -> class: javax/crypto/Cipher
[3360] Hooked_FindClass:35 -> class: java/lang/String
[3360] Hooked_GetMethodID:42 -> <init> ! ()V -> 47117080

Etc etc.. im not sure about Ray, but I hope Wizzup? haz seen Java Function Signatures before (ie: "<init>").
So.. this can be used to log stuff like.. classes used in Java though code made by 3rd party, which is highly likely to be obfuscated, will be harder to log.. But one could easily log api's such as encryption etc :)

Greetings, skier_

^ F**k Java.

;) Always good to have new members, especially contributing and intelligent ones.

What are you trying to achieve btw?

From: skier_
Just want to let you guys know im having success with Hooking Java Native API :)
Gonna do other stuff now, so gonna continue later on this project :)

[3360] java_Hooked_JNI_CreateJavaVM:89 -> ...
[3360] Hooked_NewStringUTF:29 -> str: AES/CBC/PKCS5Padding
[3360] Hooked_FindClass:35 -> class: javax/crypto/Cipher
[3360] Hooked_FindClass:35 -> class: java/lang/String
[3360] Hooked_GetMethodID:42 -> <init> ! ()V -> 47117080

Etc etc.. im not sure about Ray, but I hope Wizzup? haz seen Java Function Signatures before (ie: "<init>").
So.. this can be used to log stuff like.. classes used in Java though code made by 3rd party, which is highly likely to be obfuscated, will be harder to log.. But one could easily log api's such as encryption etc :)

Greetings, skier_

I'm afraid you're re-inventing the wheel here…

I'm not really into Java or reflection here, but afaik none of this is necessary. :x Why not just deob the client/look through bytecode, as we already do?

Because he wants to hook java, not RS……

^ This looks interesting. Glad to see someone learning how to make the wheel go round.

~RM

Having some good progress :)
Atm i capture all allocated objects :) even have a simple filter which will get the packets i want.
Now going to write a simple parser for the arguments (variabele based on signature), but thats not rly that hard :)

After that and some more h4x I will be able to actually inject packets (or in this case: objects) into the event queue's, for simulating key strokes :)
(Obviously there are a million other ways you could do this in win32, ie: keybd_event(), SendMessage(), but its fun to do it this way :))

If anyone got some nice ideas; feel free to tell me :)
Oh and all keyboard-related shit also applies to the Mouse and/or other Graphical shit.

Greetings, skier_

Sounds nice!

ProTip (from a self proclaimed pro): There are two ways of doing this efficiently.

1) Modify the JVM — takes a lot of work, not worth it, hardly useful for anything but playing around
2) Load custom / modified classes at the init of a JVM (I did this in SMART if you want to see it in action: http://bland.no-ip.org/repos/public-smart check the src/ClassLoader.cpp and src/Smart.cpp files)

Option #2 is very feasible and proven to work quite nicely. That being said, there are definitely other ways to do this, but they will most likely require tons more work with little/no benefits. I, however, am quite interested in what you had to say about hooking created objects. Not sure how useful it will be, but it sounds cool. You should pop into IRC sometime.

Edit: @i luffs yeww — you completely missed the point of what he's doing. he's exploring another way of harvesting information. while it might be reinventing a wheel, he (excuse the pun) is putting a new spin on it. it could very well turn out to be promising as no one afaik has taken this route yet.

I see that now. Thanks.

From: Sir R. Magician
Because he wants to hook java, not RS……

^ This looks interesting. Glad to see someone learning how to make the wheel go round.

~RM

Excuse the language of a stoner…..

I believe his aim is not to hook RS, just to find different ways of hooking java.

From: Sir R. Magician
Excuse the language of a stoner…..

I believe his aim is not to hook RS, just to find different ways of hooking java.

you can't really aim to say that runescape is nowhere in his mind while doing his research? pointless topic to argue over but your statement was far fetched.

Unless you were simply stating that his research involved hooking the jni, which in that case would be redundant in addition to all the posts skier_ has left us.

BenLand100: Thanks for your addition, will check out your sources in a moment. Though im going for Option #1 as i have a bunch of libraries (read: my own framework) which allows to easily (trust me Easily, ill show u once i get in the said irc channel) do this :)
That being said, whats the channel? Always nice to join a new one.. though been doing that alot lately xD

And yes, "Hooking creating objects" is basically hooking the api's:
NewObject(), NewObjectA(), NewObjectV() and AllocObject() from the Java Native Interface Environment API.

Oh and runescape is the reason i started this research. Obviously it wont be the only "purpose" of this project, as it can be easily modified into doing anything else :)

Greetings, skier_

#srl on rizon.

And this is looking nice so far.

Well, sadly I don't think this is going to be as cool as I thought it was, mostly because it IS how I thought it was before considering it as an option. (was that sentence confusing enough?)

From what I've discovered via testing is that the ONLY things you can "intercept" are those that cross the boundary from native <-> java in either direction, e.g. key/mouse events, System.out.println stuff, limited visual information, and other IO operations. This limitation is due to the inner working of the JVM not relying on the function pointer array in the JNIEnv object, and the JVM reusing the JNIEnv object for multiple instances in the same thread. If you wanted to spoof/block events, or intercept packet information, this might be helpful, but gives you no incite as to what's going on inside java, and thus is rather useless in terms of what we need to accomplish, as anything this can do can be done easier once you have a framework that can do what we really need done, i.e. harvesting information from the client.

ANYWAY if you're interested (since skier_ was remarkably closed source with me when we were talking…? not really sure why, but whatever) i'm going to attach my testbed which hooks/intercepts all JNI calls (you'll need to uncomment/recompile to see any debug from it) and runs a main method in a Main class in the ./classes directory (which you can feel free to modify, I only did enough to deduce exactly what I was intercepting).

Granted, this is a nice find, and I am VERY surprised the JVM is written this way, its just not exceptionally useful information.

From: skier_
Just want to let you guys know im having success with Hooking Java Native API :)
Gonna do other stuff now, so gonna continue later on this project :)

[3360] java_Hooked_JNI_CreateJavaVM:89 -> ...
[3360] Hooked_NewStringUTF:29 -> str: AES/CBC/PKCS5Padding
[3360] Hooked_FindClass:35 -> class: javax/crypto/Cipher
[3360] Hooked_FindClass:35 -> class: java/lang/String
[3360] Hooked_GetMethodID:42 -> <init> ! ()V -> 47117080

Etc etc.. im not sure about Ray, but I hope Wizzup? haz seen Java Function Signatures before (ie: "<init>").
So.. this can be used to log stuff like.. classes used in Java though code made by 3rd party, which is highly likely to be obfuscated, will be harder to log.. But one could easily log api's such as encryption etc :)

Greetings, skier_

congratulations, you've managed to hook some of the JNI. it really is simple, however, when you look at the JNIEnv pointer as a pointer to a function table:
http://www.moparisthebest.com/smf/index.php/topic,397198.msg2949117.html#msg2949117
reminded me a bit of SSDT patching. regardless, JNI functions are only called by native code that utilizes JNI. you cannot look into the JVM's behavior through JNI hooks; for that, you should look into JVMTI. also, <init> is the name of the method; to clarify, it is the internal method name used for class constructors. signatures, or as the JVM calls them, descriptors, specify the type of members. e.g.

String name;

the descriptor of the above field would be Ljava/lang/String; while

Date produceSomeDateSomehow(long what, String is, boolean this) {
    ...
}

has a descriptor of (JLjava/lang/String;Z)Ljava/util/Date;

From: skier_
Having some good progress :)
Atm i capture all allocated objects :) even have a simple filter which will get the packets i want.
Now going to write a simple parser for the arguments (variabele based on signature), but thats not rly that hard :)

After that and some more h4x I will be able to actually inject packets (or in this case: objects) into the event queue's, for simulating key strokes :)
(Obviously there are a million other ways you could do this in win32, ie: keybd_event(), SendMessage(), but its fun to do it this way :))

If anyone got some nice ideas; feel free to tell me :)
Oh and all keyboard-related shit also applies to the Mouse and/or other Graphical shit.

Greetings, skier_

you can't use a JNI hook to intercept VM-wide object creation, only object creation through JNI. again, look into JVMTI.

From: lordsaturn
you can't really aim to say that runescape is nowhere in his mind while doing his research? pointless topic to argue over but your statement was far fetched.

Unless you were simply stating that his research involved hooking the jni, which in that case would be redundant in addition to all the posts skier_ has left us.

his interests are actually specific only to java, not runescape.

From: super_
his interests are actually specific only to java, not runescape.

i was trying to say that if his research is successful some part of it could be used for RS.

edit: he implied earlier that it was his motivation for this project

From: super_
..
his interests are actually specific only to java, not runescape.

From: skier_
..
Oh and runescape is the reason i started this research
..

The message you have entered is too short. Please lengthen your message to at least 3 characters.

if watching a commercial on cereal motivated me to research into advertisement techniques, does that imply that my work is cereal-specific? no, now sit down.

From: super_
if watching a commercial on cereal motivated me to research into advertisement techniques, does that imply that my work is cereal-specific? no, now sit down.

[spam] loled. [/spam]

~RM

From: super_
if watching a commercial on cereal motivated me to research into advertisement techniques, does that imply that my work is cereal-specific? no, now sit down.

Besides that – im pretty sure RS or sth else would nigger on you when trying to use some kind of Java Callback/Hook

foo. that was ^ the implications i was talking about.

edit: hold on let me masturbate to skier