diff --git a/rasp/jvm/JVMAgent/src/main/java/com/security/smithloader/AttachInfo.java b/rasp/jvm/JVMAgent/src/main/java/com/security/smithloader/AttachInfo.java deleted file mode 100644 index cbfb72c50..000000000 --- a/rasp/jvm/JVMAgent/src/main/java/com/security/smithloader/AttachInfo.java +++ /dev/null @@ -1,7 +0,0 @@ -package com.security.smithloader; - -public class AttachInfo { - public static void info() { - System.out.println("Your Service Will Be Protected By RASP"); - } -} diff --git a/rasp/jvm/JVMAgent/src/main/java/com/security/smithloader/SmithAgent.java b/rasp/jvm/JVMAgent/src/main/java/com/security/smithloader/SmithAgent.java index a3d4c4025..92752393b 100644 --- a/rasp/jvm/JVMAgent/src/main/java/com/security/smithloader/SmithAgent.java +++ b/rasp/jvm/JVMAgent/src/main/java/com/security/smithloader/SmithAgent.java @@ -278,7 +278,6 @@ public static void agentmain(String agentArgs, Instrumentation inst) { SmithAgentLogger.logger.info("parse parseParameter success"); if(cmd.equals("attach")) { - AttachInfo.info(); checksumStr = checksumStr_sb.toString(); proberPath = proberPath_sb.toString(); diff --git a/rasp/jvm/JVMProbe/src/main/java/com/security/smith/SmithProbe.java b/rasp/jvm/JVMProbe/src/main/java/com/security/smith/SmithProbe.java index c2b55fcb4..1718d4ed0 100644 --- a/rasp/jvm/JVMProbe/src/main/java/com/security/smith/SmithProbe.java +++ b/rasp/jvm/JVMProbe/src/main/java/com/security/smith/SmithProbe.java @@ -17,6 +17,7 @@ import com.security.smith.client.message.*; import com.security.smith.common.Reflection; import com.security.smith.common.SmithHandler; +import com.security.smith.log.AttachInfo; import com.security.smith.log.SmithLogger; import com.security.smith.module.Patcher; import com.security.smith.type.*; @@ -179,6 +180,7 @@ public void setProbePath(String proberPath) { } public void init() { + AttachInfo.info(); SmithLogger.loggerProberInit(); SmithLogger.logger.info("probe init enter"); smithClasses = new ConcurrentHashMap<>(); diff --git a/rasp/jvm/JVMProbe/src/main/java/com/security/smith/log/AttachInfo.java b/rasp/jvm/JVMProbe/src/main/java/com/security/smith/log/AttachInfo.java new file mode 100644 index 000000000..e54bec0bf --- /dev/null +++ b/rasp/jvm/JVMProbe/src/main/java/com/security/smith/log/AttachInfo.java @@ -0,0 +1,37 @@ +package com.security.smith.log; + +import java.io.File; +import java.io.FileWriter; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; + +import com.security.smith.common.ProcessHelper; + +public class AttachInfo { + public static void info() { + + try { + Path path = Paths.get("/proc/" + ProcessHelper.getCurrentPID() + "/cwd"); + String cwd = Files.readSymbolicLink(path).toString(); + + File file = new File(cwd); + + if (file.exists()) { + + file = new File(cwd + "/0_your_service_has_been_protected_by_elkeid_rasp.log"); + if (!file.exists()) { + if (file.createNewFile()) { + + FileWriter writer = new FileWriter(file); + writer.write("Your Java Service Will Be Protected By RASP"); + writer.close(); + } + } + } + } catch (IOException e) { + System.out.println(e.getMessage()); + } + } +} \ No newline at end of file