JETT 2003 Java.compareTo(C++)

JAVA Java Platform consists of 4 parts: –Java Language –Java API –Java class format –Java Virtual Machine

Java - the Language Java minimizes debugging and maximizes productivity –Features that are build-in into Java: OO, Reflection & multithreading Multiple Interface Inheritance Distributed, portable & secure Architecture neutral (utilizing bytecode) JIT, Garbage Collected & well-understood

Programming Constructs Tradeoffs Java Language syntax is simpler –C/C++ Constructs that are NOT present in Java: Destructors, Operator overloading Multiple class inheritance Header files & preprocessor Pointers, goto, enumerations, structures & unions Global functions HelloUniverse & HelloWorld DEMO

Bytecode vs Shellcode Bytecode Method float add(float, int) 0 fload_1 1 iload_2 2 i2f 3 fadd 4 freturn Assembly push %ebp mov %esp,%ebp fildl 0x10(%ebp) fadds 0xc(%ebp) pop %ebp ret

Java Platform Stacks Thread Stack Global Heap Method Operand Stack Local Variables Table Stack frame Exec Envirmt

C/C++ Family Stacks Kernel Virtual Memory (code, data, heap, stack) System Stack (Linux) Method Invocation Stack Segment Shared Libraries region … User Stack … malloc heap Segments Loaded from Exec file. Void foo(int k, int m) { int buffer[15]; } bufferFPSPkm

C++ vs. Java Stack Security Memory Scan DEMO BOF Attack DEMO Both DEMO’s will NOT work in Java –Cannot use NULL reference in Java –methods have individual operand stacks –Java API dynamically linked

Java API Java 2 Platform API Editions: –Enterprise Edition (J2EE) –Standard Edition (J2SE) –Micro Edition (J2ME) Java code no longer runs everywhere, only where appropriate JVM & API are installed (still better than recompiling for every host)

0xCAFEBABE magic0xCAFEBABE4 bytes version...4 bytes constant pool...9th byte ( starts with it's own length ) Access flags…2 bytes ( directly after the constant pool are the access flags ) this class… super class… and so on...…

C-Family API & Executables C-Family executables are virtually monolithic, which requires to compile a version for each host type As in Java, all libraries must be installed on the host beforehand –This is much harder than in Java, since virtually every company has its own libraries to use

Java Virtual Machine (VM) Class Loader Bytecode Execution Engine Java APIYour Code bytecode Native shellcode Class Bytecode Verifier

Java Language DEMOs String DEMO –String Object –Performance –Structured Exception Handling Reference DEMO –Synchronization –Passing by reference –Inner classes

Java GC - Generational Young (collected by Copying) –Eden, 2 survivor spaces & Virtual Old (collected by Mark-Compact) –Permanent, Standard & Virtual Perm StandardVirtual Eden Survivor Spaces Virtual Old Generation Young Generation

C Malloc / C++ New Malloc list pointer User Space Address returned to the user SIZE Low addressHigh address.... Does NOT belong to malloc....

Java Bytecode Portability Java does provide relatively mobile code –MadeInWindows DEMO –MadeInSolaris DEMO C++ provides no illusions on its hardware architecture dependence – C++ counts on it

Java Pros & Cons Pros –Distributed, Network Oriented –Fast Development and Easy Reuse –GC, multithreaded, buld-in synchronization –Stack, heap, array & string security Cons –Easily Decompiled –Cannot be used in real-time systems