Three photos of old boards

Diamond Monster 3Dfx.


Creative Sound Blaster.


BusLogic SCSI adapter.

Active money

I was on vacation last week.
And now I have started my new blog:

Active Money

Active money - blog about money.
About coins and paper currency and theirs views.



I will publish the scanned images and photos of money.
At first I'm going to publish Russian money from my family collection.

Welcome!

Java code injection via WinAPI's CreateRemoteThread function

There is the way to inject some functionality into JVM (Java Virtual Machine) from another process or another JVM.

It works only in Windows NT/200/XP and uses WinAPI functions.
Today I publish this solution.

How it works:

• User compiles Injector.class, Injector.dll, Insider.dll from sources (via make.bat)


• User starts java application (e.g.: start java -jar %JAVA_HOME%\demo\jfc\Notepad\notepad.jar) in the JVM-1


• User recognises the PID (process id) of started application (via Task Manager)


• User executes java -Djava.library.path=. Injector (starts JVM-2) and enters PID of JVM-1



• JVM-1 calls Injector.dll's native function


• Injector.dll calls CreateRemoteThread WinAPI function and loads Insider.dll into JVM-1


• Insider.dll attaches to JVM-1 via JNI, defines new class from bytes array and loads it.
  !!! In this case class's bytecode stores as a jbyte clazz[] array within the Insider.dll


• And then new class works in the JVM-1

Injected class only prints numbers within JVM-1's console:




Sources:

Bin2H.java
Injector.cpp
Injector.java
Insider.java
insider.cpp
make.bat

listed below:

Bin2H.java 

public class Bin2H {
    public static void main(String[] args) throws Exception {
        System.out.print("#include <jni.h>\nconst jbyte clazz[]={");
        for (int i = System.in.read(); i >= 0; i = System.in.read()) 
            System.out.print(Integer.toString(i) + ",");
        System.out.print("};");
    }
}

Injector.cpp

#include <windows.h>
#include <jni.h>
#include "injector.h"


void Inject (unsigned long PID, const char *dllname)
{
    DWORD hLibModule;

    HMODULE hKernel32 = GetModuleHandle (TEXT ("Kernel32"));

    void *hProcess = OpenProcess (PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION |
        PROCESS_VM_WRITE, false, PID);
    int cch = strlen (dllname) + 1;
    void *pLibRemote = VirtualAllocEx (hProcess, NULL, cch, MEM_COMMIT,
        PAGE_READWRITE);

    WriteProcessMemory (hProcess, pLibRemote, (void *) dllname, cch, NULL);

    HANDLE hThread = CreateRemoteThread (hProcess, NULL, 0,
        (PTHREAD_START_ROUTINE)
        GetProcAddress (hKernel32,
        "LoadLibraryA"),
        pLibRemote, 0, NULL);

    WaitForSingleObject (hThread, INFINITE);
    GetExitCodeThread( hThread, &hLibModule );
    CloseHandle (hThread);

    VirtualFreeEx (hProcess, pLibRemote, sizeof (dllname), MEM_RELEASE);

    hThread = CreateRemoteThread (hProcess, NULL, 0,
        (PTHREAD_START_ROUTINE) GetProcAddress (hKernel32,
        "FreeLibrary"),
        (void *) hLibModule, 0, NULL);
    WaitForSingleObject (hThread, INFINITE);
    CloseHandle (hThread);
}

void JNICALL Java_Injector_inject (JNIEnv * env, jclass, jint pid, jstring dll)
{
    try
    {
        Inject (pid, env->GetStringUTFChars (dll, NULL));
    } catch (...)
    {
        MessageBox (NULL, "Exception::Inject", "Injector", MB_ICONERROR);
    }
}

Injector.java 

import java.io.File;
import java.io.IOException;

public class Injector {
    public static native void inject(int pid, String dll);

    public static void main(String[] args) {
        System.loadLibrary("Injector");
        byte[] str = new byte[5];
        try {
            System.in.read(str);
            System.out.println(new File("").getAbsolutePath()+"\\insider.dll");         
            inject(Integer.parseInt(new String(str).trim()), new File("").getAbsolutePath()+"\\insider.dll");
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

insider.cpp 

#include <windows.h>
#include <jni.h>
#include "insider.h"

BOOL APIENTRY
DllMain (HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
  if (ul_reason_for_call == DLL_PROCESS_ATTACH)
    {
      JavaVM *vmBuf;
      JNIEnv *env;
      jsize nVMs;
      jint res = 0;
      jclass resjclass = NULL;
      try
      {
    res = JNI_GetCreatedJavaVMs (&vmBuf, 1, &nVMs);
    if (res != JNI_OK || nVMs < 1)
      {
        MessageBox (NULL, "JVMs not found", "Insider", MB_ICONERROR);
        return FALSE;
      }

      }
      catch (...)
      {
    MessageBox (NULL, "Exception:JNI_GetCreatedJavaVMs", "Insider",
            MB_ICONERROR);
    return FALSE;
      }


      try
      {
    res = vmBuf[0].AttachCurrentThread ((void **) &env, NULL);
    if (res != JNI_OK)
      {
        MessageBox (NULL, "Can't attach to JVM", "Insider", MB_ICONERROR);
        return FALSE;
      }
      }
      catch (...)
      {
    MessageBox (NULL, "Exception:AttachCurrentThread", "Insider",
            MB_ICONERROR);
    return FALSE;
      }

      try
      {
    resjclass = env->DefineClass ("Insider", NULL, clazz, sizeof (clazz));
    if (resjclass == NULL)
      {
        MessageBox (NULL, "Error Define Class", "Insider", MB_ICONERROR);
        return FALSE;
      }
    resjclass = env->FindClass ("Insider");
    if (resjclass == NULL)
      {
        MessageBox (NULL, "Error Load Class", "Insider", MB_ICONERROR);
        return FALSE;
      }
      }
      catch (...)
      {
    MessageBox (NULL, "Exception:DefineClass,FindClass", "Insider",
            MB_ICONERROR);
      }
      try
      {
    vmBuf[0].DetachCurrentThread ();
      }
      catch (...)
      {
    MessageBox (NULL, "Exception:DetachCurrentThread", "Insider",
            MB_ICONERROR);
    return FALSE;
      }

    }

  return TRUE;
}

Insider.java 

//Warning: Make Insider as single class!

public class Insider implements Runnable {
    static {
        Thread t = new Thread(new Insider());
        t.setPriority(Thread.MIN_PRIORITY);
        t.setDaemon(true);
        t.start();
    }

    public void run() {
        int i = 0;
        while (true) {
            System.out.println(i++);
            try {
                Thread.sleep(300);
            } catch (InterruptedException e) {
                break;
            }
        }
    }
}

make.bat

@echo off
call "E:\Devel\Microsoft Visual Studio\VC98\Bin\vcvars32.bat" 
set JAVA_HOME=E:\Devel\jdk1.5.0_09

set PATH=%PATH%;%JAVA_HOME%\bin

rd /Q /S out
md out

javac -d out Injector.java
javah -classpath out Injector
javac -source 1.3 -target 1.1 Insider.java
javac Bin2H.java
type Insider.class |java Bin2H >insider.h
del Bin2H.class
del Insider.class

cl.exe /c -GX /I%JAVA_HOME%\include /I%JAVA_HOME%\include\win32 Injector.cpp
link /DLL /OUT:out/Injector.dll kernel32.lib user32.lib gdi32.lib Injector.obj

cl.exe /c -GX /I%JAVA_HOME%\include /I%JAVA_HOME%\include\win32 Insider.cpp
link /DLL /OUT:out/Insider.dll kernel32.lib user32.lib gdi32.lib %JAVA_HOME%\lib\jvm.lib Insider.obj

del Insider.obj
del Injector.obj
del Injector.h
del Insider.h
del out\Injector.exp
del out\Injector.lib 

echo java -Djava.library.path=. Injector>out\injector.bat
echo start java -jar %JAVA_HOME%\demo\jfc\Notepad\notepad.jar Notepad >out\demo.bat

How do you like it?

---

You may download these sources from Xantorohara.blogspot.com samples

HTML Encoder

I've released new online service: HTML Encoder
It replaces ampersands, tabs, less/greater braces and prepares source code for posting into blog.

If you prefer shell scripts, you may use this:

sed -e 's/\x26/\&/g;s/\x3c/\</g;s/\x3e/\>/g' sourcefile.txt | expand -t 4 >sourcefile.blog

See this project on GitHub

Javascript injection

There is the way to include javascript into any html pages via 'javascript:' protocol. Internet Explorer and FireFox support this.
Just open web page and replace site's URL with some javascript e.g.: javascript: alert('WOW!');

I've released online tool for web developers that based on this feature - Hyperbox. Developers can use it for design tasks.

It is simple to use:

• Open any site (e.g.: google.com).
  
• Replace site's URL with this string:
  
  
javascript:(function(){var s=document.createElement('script'); s.src='http://xantorohara.jino-net.ru/hyperbox/hyperbox.js'; s.type='text/javascript'; document.getElementsByTagName('head')[0].appendChild(s); })();

  
  
• Move it, resize, change color and borders, measure.
  
  

This javascript tool is absolutely free for using and modifying.
Everybody may download the script from my site and investigate it.