JETT 2003

Java.compareTo(C++)

JAVA

• Java Platform consists of 4 parts:– Java Language– Java API– Java class format– Java Virtual Machine

Java - the Language

• Java minimizes debugging and maximizes productivity– Features that are build-in into Java:

• OO, Reflection & multithreading

• Multiple Interface Inheritance

• Distributed, portable & secure

• Architecture neutral (utilizing bytecode)

• JIT, Garbage Collected & well-understood

Programming Constructs Tradeoffs

• Java Language syntax is simpler– C/C++ Constructs that are NOT present in Java:

• Destructors, Operator overloading

• Multiple class inheritance

• Header files & preprocessor

• Pointers, goto, enumerations, structures & unions

• Global functions

• HelloUniverse & HelloWorld DEMO

Bytecode vs Shellcode

• Bytecode

Method float add(float, int)

0 fload_1

1 iload_2

2 i2f

3 fadd

4 freturn

• Assembly

push %ebp

mov %esp,%ebp

fildl 0x10(%ebp)

fadds 0xc(%ebp)

pop %ebp

ret

Java Platform Stacks

Thread Stack

Global Heap

MethodOperand

Stack

LocalVariables

Table

Stack frame

ExecEnvirmt

C/C++ Family Stacks

Kernel Virtual Memory(code, data, heap, stack)

. . . . . . . . . . . . .

System Stack (Linux)

Method Invocation Stack Segment

SharedLibraries

region…

UserStack

…mallocheap

Segments Loaded from

Exec file.

Void foo(int k, int m) {int buffer[15]; }

buffer FP SP k m

C++ vs. Java Stack Security

• Memory Scan DEMO • BOF Attack DEMO

• Both DEMO’s will NOT work in Java– Cannot use NULL reference in Java

– methods have individual operand stacks

– Java API dynamically linked

Java API

• Java 2 Platform API Editions:– Enterprise Edition (J2EE) – Standard Edition (J2SE)– Micro Edition (J2ME)

• Java code no longer runs everywhere, only where appropriate JVM & API are installed (still better than recompiling for every host)

0xCAFEBABE

• magic 0xCAFEBABE 4 bytes• version ... 4 bytes• constant pool ... 9th byte

(starts with it's own length)• Access flags… 2 bytes (directly

after the constant pool are the access flags)• this class …• super class …• and so on... …

C-Family API & Executables

• C-Family executables are virtually monolithic, which requires to compile a version for each host type

• As in Java, all libraries must be installed on the host beforehand– This is much harder than in Java, since virtually

every company has its own libraries to use

Java Virtual Machine (VM)

Class Loader

Bytecode Execution Engine

Java API Your Code

bytecode

Native shellcode

Class Bytecode Verifier

Java Language DEMOs

• String DEMO– String Object– Performance– Structured Exception Handling

• Reference DEMO– Synchronization– Passing by reference– Inner classes

Java GC - Generational

• Young (collected by Copying)– Eden, 2 survivor spaces & Virtual

• Old (collected by Mark-Compact)– Permanent, Standard & Virtual

Per

m

Standard Virtual Eden

Su

rviv

orS

pac

es

Virtual

Old GenerationOld Generation Young GenerationYoung Generation

C Malloc / C++ New

Malloc list

poin

ter

User Space

Address returned to the userSIZE

Low address High address

. .

. .. . .. . .

Does NOT belongto malloc

. . .

. . .. .. .

Java Bytecode Portability

• Java does provide relatively mobile code– MadeInWindows DEMO

– MadeInSolaris DEMO

• C++ provides no illusions on its hardware architecture dependence – C++ counts on it

Java Pros & Cons

• Pros– Distributed, Network Oriented

– Fast Development and Easy Reuse

– GC, multithreaded, buld-in synchronization

– Stack, heap, array & string security

• Cons– Easily Decompiled

– Cannot be used in real-time systems