Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsWhite Papers
Discussion GroupsFirst AidDatabasesJavaBeansGUIJava 3DVirtual MachineCORBASecurityToolsGeneral
Java DirectoryOpen Source ProjectsSample Book ChaptersUser GroupsWeb Resources
Related Topics
Databases.NETMore Topics ...

Java Forum / Tools / May 2005

Tip: Looking for answers? Try searching our database.

detecting a JVM embedded in an app?

Thread view: 
Brandon J. Van Every - 19 May 2005 23:33 GMT
I heard a rumor that Alias uses the JVM in their software, and that MEL
(the Maya Extension Language) just runs as a level over that.  I'm
wondering what technical means I could use to substantiate such a
rumor.  Like, somehow snoop a code stream and see if Java bytecodes are
recognizably being passed about?  I'm curious if anyone knows how I'd
approach such a problem, as it's not my forte and I really have no
idea.  Seems like instrumenting the innards of a 3rd party app would be
related to software piracy techniques.  Not my goal, but I'd like to
know what Alias' business model is with regard to the JVM.

Maybe if I just ask 'em they'll tell me with less hassle.  :-)  Or I
could dig deeper at the rumor and see whether it's substantiable.

Signature

Cheers,                     www.indiegamedesign.com
Brandon Van Every           Seattle, WA

"We live in a world of very bright people building
crappy software with total sh.t for tools and process."
                               - Ed McKenzie

Stephen Kellett - 20 May 2005 10:49 GMT
>I heard a rumor that Alias uses the JVM in their software, and that MEL
>(the Maya Extension Language) just runs as a level over that.  I'm
>wondering what technical means I could use to substantiate such a

For Windows, look for the module "jvm.dll".

Int isJVMPresent()
{
       HMODULE hModule;
       int             jvmIsPresent;

       hModule = GetModuleHandle(_T("JVM.DLL");
       jvmIsPresent = (hModule != NULL);

       return jvmIsPresent;
}

and/or you could look at the imports for other EXE/DLLs and see if any
of them link to JVM.DLL (and for earlier version of Java, JAVAI.DLL).

Stephen
Signature

Stephen Kellett
Object Media Limited
Computer Consultancy, Software Development
Windows C++, Java, Assembler, Performance Analysis, Troubleshooting

"." - 20 May 2005 14:02 GMT
> I heard a rumor that Alias uses the JVM in their software, and that MEL
> (the Maya Extension Language) just runs as a level over that.  I'm
[quoted text clipped - 5 lines]
> related to software piracy techniques.  Not my goal, but I'd like to
> know what Alias' business model is with regard to the JVM.

The trick to solving this problem is knowing the OS and how to observe
what is going on. What files are being accessed? What is the content of
these files?

Someone recommended looking for jvm.dll. What if they renamed the DLL and
it exists in their installation? You might need to dig a little deeper.
You didn't mention what OS. If it is Windows I would use something like
dependency.exe to examine the binaries. I'd look at the functions they are
exporting and see of the names gave any hint. I'd look at the binaries of
Java and see if any of the files in Alias matched.

Bottom line, I know how things work in a computer. I formulate some ideas
as to how they might implement a JVM inside their code. I'd also think
about how they might easily hide it from prying eyes. I'd have to peek and
poke things to see what happens. What I see would determine my next steps.

> Maybe if I just ask 'em they'll tell me with less hassle.  :-)  Or I
> could dig deeper at the rumor and see whether it's substantiable.

I dig deeper at these things just so I can learn more about the computer.
It is sort of thing doing a crossword puzzle; I could ask someone else for
answers to the puzzle but I get more satisfaction solving it all on my
own.

So it depends why you want to know. Some people travel to get somewhere.
Others travel for the sake of traveling. What is more important to you?
The experience of traveling or arriving at your destination?

> --
> Cheers,                     www.indiegamedesign.com
[quoted text clipped - 3 lines]
> crappy software with total sh.t for tools and process."
>                                 - Ed McKenzie

Signature

Send e-mail to: darrell dot grainger at utoronto dot ca

Brandon J. Van Every - 20 May 2005 17:09 GMT
. wrote:

>Someone recommended looking for jvm.dll. What if they renamed the DLL and
>it exists in their installation? You might need to dig a little deeper.
[quoted text clipped - 3 lines]
>Java and see if any of the files in Alias matched.
>  

Yeah, I'm on Windows.  I agree that Alias would probably obfuscate these
things, making it "a rumor" rather than a certainty.  But truthfully I
haven't really searched all that hard for answers yet.

>I dig deeper at these things just so I can learn more about the computer.
>It is sort of thing doing a crossword puzzle; I could ask someone else for
[quoted text clipped - 5 lines]
>The experience of traveling or arriving at your destination?
>  

The point would be to figure out if I can make money off of Alias using
Java, so it would behoove me to ask them directly.  The use of Java is
not interesting if there's no money in it for me.  The knowledgeable
people at the Alias NW User's Group say that nobody's using Java in
Alias-land, so there's no point trying to sell Java skills in that market.

Signature

Cheers,                     www.indiegamedesign.com
Brandon Van Every           Seattle, WA

"We live in a world of very bright people building
crappy software with total sh.t for tools and process."
                               - Ed McKenzie

Stephen Kellett - 20 May 2005 23:42 GMT
>Someone recommended looking for jvm.dll. What if they renamed the DLL and
>it exists in their installation?

Then their application will not work. The binary that uses JVM.DLL will
have the name JVM.DLL embedded in it. This will result in a failure to
load the DLL at runtime.

>You didn't mention what OS. If it is Windows I would use something like
>dependency.exe to examine the binaries.

Which will show JVM.DLL. Dependency.exe shows the IAT and EAT. I
recommended examining the IAT, which is what is of interest in this
case.

Code for reading the IAT can be found at
       http://www.objmedia.demon.co.uk/software.html

Look for PEExplorer and PEDLL. The code is not encumbered by GPL - it is
completely open source. Use it as you wish.

Stephen
Signature

Stephen Kellett
Object Media Limited    http://www.objmedia.demon.co.uk
Computer Consultancy, Software Development
Windows C++, Java, Assembler, Performance Analysis, Troubleshooting

George Neuner - 21 May 2005 03:39 GMT
>>Someone recommended looking for jvm.dll. What if they renamed the DLL and
>>it exists in their installation?
>
>Then their application will not work. The binary that uses JVM.DLL will
>have the name JVM.DLL embedded in it. This will result in a failure to
>load the DLL at runtime.

It will work if the DLL is loaded manually by the application using
dlopen() or LoadLibrary().  It will also work if the statically linked
lib file was edited or regenerated to reference the renamed DLL.

George

Signature

for email reply remove "/" from address

Stephen Kellett - 21 May 2005 08:56 GMT
>It will work if the DLL is loaded manually by the application using
>dlopen() or LoadLibrary().

True. I'd surprised if it was loaded that way. Implicit linking is a
much easier way of developing. Odds are that the application in question
has an implicit link to the DLL.

>It will also work if the statically linked
>lib file was edited or regenerated to reference the renamed DLL.

How likely is it that someone is going to go to that much effort? Why
would anyone rename the DLL in the first place? This is nonsense, I've
never known any company rename another company's DLLs. Probably violates
the license agreement in the first place.

Here is a solution, even allowing for the minute possibility that
someone would rename the DLL.

The exports from the DLL are defined in JVM.DLL's export table. Simply
search all DLLs IAT for references to these functions. Find one and
you've almost certainly found that the DLL is in use. It is unlikely
that it is possible to rename the exports from JVM.DLL as they will be
part of a published API used by JNI or some other publicly available
part of Java. I haven't checked this.

Stephen
Signature

Stephen Kellett
Object Media Limited
Computer Consultancy, Software Development
Windows C++, Java, Assembler, Performance Analysis, Troubleshooting

George Neuner - 23 May 2005 06:08 GMT
>>It will also work if the statically linked
>>lib file was edited or regenerated to reference the renamed DLL.
>
>How likely is it that someone is going to go to that much effort?

It's no effort on Windows if you have the MS toolchain ... you just
use lib.exe with the /DEF option.

>Why would anyone rename the DLL in the first place? This is nonsense,
>I've never known any company rename another company's DLLs.
>Probably violates the license agreement in the first place.

This is a much better argument although renaming rights can probably
be negotiated if you're serious about it.  Certainly the standard
licenses from most companies would disallow it.

George
Signature

for email reply remove "/" from address



Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.