Published update to my Practical Jni4Net book

You can get the latest version from https://leanpub.com/Practical_Jni4Net

Here is the email I send to my readers:

Published Beta version of "Practical Jni4Net" eBook

After releasing "Practical AngularJS" and Practical Git and GitHub, here is an equivalent book containing my Jni4Net related posts.

This new book has 74 pages and is made of 13 blog posts published in the last 16 months.

As with the first release of the other books, I'm starting with the original chronological/published order, and will try later to figure out a better logical way to group these posts together.

The article's Html was converted by LeanPub into Markdown, who also created the eBook versions linked below (pdf, mobi, epub and online)

Creating a Fork of Jni4Net,dealing with ‘Attempted to read or write protected memory’ problem and what I had to do to make it work with ZAP

An O2 user was having some issues with the Jni4Net scripts and I think the root cause is because the current O2 Scripts uses the jni4net.n-0.8.6.0.dll which is the version currently available for download


TLDR: The code of the patched version is here the compiled binaries are here

NOTE: THIS VERSION IS CURRENTLY published as DRAFT since I'm on the Algarve (i.e. the beach is waiting) and don't have time to proof read the text below (which is posted how I wrote it at the time)

Another step in the use of ESAPI and AppSensor Jars from .Net/C# (using Jni4Net)

Yesterday at the OWASP EU Tour London Chapter event meeting I presented the next step of my research on using ESAPI and AppSensor inside a .NET application like TeamMentor (using Jni4Net to allow the JVM to work side by side with the CLR).

The source code of the demo I presented is posted to the github.com:DinisCruz/TeamMentor_3_3_AppSensor repo, and this post shows a number of screenshots of what is in there.

I used TeamMentor’s TBot C# and AngularJS pages to create the prototypes (since it is very easy and fast to code in that enviroment)

First execution of ESAPI.jar Encoder methods from O2's C# REPL

Last month (when I was preparing to do the OWASP AppSensor and O2 Platform at Security B-Sides London workshop with colin), I achieved something that I have been trying to do for a while:

Use the O2 Platform's C# REPL environment to programatically access (in real time) the ESAPI jar apis and methods. (see prob described at the end of Loading OWASP ESAPI jar and its dependencies from C# (using jni4net) for my last attempt)

And I'm happy to say that 'consuming the ESAPI jar from .Net', is exactly what I was able to achieve last month :)

I was also able to consume AppSensor's jar directly from a .NET app (in that case TeamMentor) and I have a lot more blog posts to write up on that topic.

This current post,  is the one I wrote at the time of the breakthrough (last month), which got stuck in the drafts folder and remained unpublished (until now)

--------------

Util - Jni4Net - Java BeanShell REPL v1.0.exe

Using the technique shown in the Invoking Java BeanShell from .Net CLR  post, here is REPL that allows the quick execution of Java BeanShell command in a C# GUI

You can download this stand-alone O2 tool from: Util - Jni4Net - Java BeanShell REPL v1.0.exe

And this is what the default GUI looks like:

Getting list of Jars loaded in SystemClassLoader (using Jni4Net)

I just created a couple extension methods for Jni4Net that allow (amongst other things) the listing of the jars currently loaded in the SystemClassLoader (see API_Jni4Net.cs for the code of these .NET Extension Methods)

The objective is to simplify the use of Jni4Net, and to hide the complexity in consuming Java code from .NET:

Here are a couple examples of these Extension Methods in action:

Loading OWASP ESAPI jar and its dependencies from C# (using jni4net)

Here is a pretty cool PoC where I was able to load an jar file and its dependencies into an 'Jni4Net created' JVM

Invoking Java BeanShell from .Net CLR

Here is a very rough PoC of how I was able to execute a JavaBean shell script from inside the O2 Platform (with the java code executed under a JVM)

Executing "return 2+2;" as a java beanshell comand (see result on the bottom right Output pane)

Invoking an OWASP AppSensor Java method from .NET C# REPL (using Jni4Net)

On the topic of AppSensor, you might find the code snippet below interesting. 

Inside an O2 Platform C# REPL editor (which is running in .Net's CLR), I was able to:

• load the AppSensor jar in a new class loader, 
• access/view its classes in a GUI 
• create an instance of org.owasp.appsensor.trendmonitoring.TrendEvent 
• execute the getTime method). 

Note that the AppSensor code is running on the Java's JVM (loaded in the same process as the .Net's CLR)

The code is still in very rough status, but it works :)

Making Java, .Net and C++ apps work together

This past week I was in the 'zone' (coding 16h a day) and as you can see by the links below, I was able to (finally) find a way to make Java, .Net and C++ apps work together. 

I've 'only' been trying to do this for the past 5 years.

There are two key technological concepts at play here (which can work together or isolation)

Using Jni4Net (Part 4) - Integrating AppScan with TeamMentor (first PoC)

Using the Jni4Net based  Eclipse plugin shown in the Using Jni4Net (Part 3) - Writing and Invoking O2 Methods from Java and Eclipse post, I was able to create a PoC of showing TeamMentor Guidance when a particular security finding is selected (in AppScan Source):

Using Jni4Net (Part 3) - Writing and Invoking O2 Methods from Java and Eclipse.pdf

After Using Jni4Net (Part 1) - To C# REPL a java process (ZAP Proxy) and  Using Jni4Net (Part 2) - Controling OWASP ZAP remotely (via Java BeanShell REPL in .Net) the next step was to see if we could consume (and code) the .NET APIs from Java.

And again Jni4Net really worked!

Here is a .NET WinForms control, coded and executed from the (Eclipse written) Java code:

Using Jni4Net (Part 2) - Controling OWASP ZAP remotely (via Java BeanShell REPL in .Net)

Once I was able to Use Jni4Net (Part 1) - To C# REPL a java process (ZAP Proxy) I was able to use the ZAP BeanShell support to start controlling and manipulating ZAP's GUI from the .Net C# REPL.

Here is an example of adding a new 'Site' (i.e. a TreeNode) to the main ZAP 'Site's window (i.e. TreeView)

Using Jni4Net (Part 1) - To C# REPL a java process (ZAP Proxy)

Last week I discovered the Jni4Net FOSS project which provides the foundation blocks to create a Java bridge to .Net (and vice-versa).

To try Jni4Net, and see if it was really possible to have .Net and Java code running on the same process (with the CLR and JVM being able to invoke each other's methods), I decided to see if I could connect the O2 Platform with the OWASP ZAP project (with both running on the same process)

My first step was to use the Injecting C# DLLs into Managed (C#) and Unmanaged (C++) processes  O2 capabilities to inject an C# REPL into the ZAP process.

And here they are in action:

• the foreground window is the (CLR based) C# REPL 
• the background window is the (JVM based) ZAP process.