Traditional RASP solutions typically hook at the first layer shown in Figure 1-2—specifically, the or start methods of java.lang.ProcessImpl (JDK 9+) or java.lang.UNIXProcess (JDK 8 and earlier). These are pure Java methods and can be instrumented directly via bytecode manipulation.