Code Bazaar

Neutral or stability shoes? Hack into your running!

2011-10-16T08:59:00.000-07:00

Two month ago, I sprained my ankle. Now that my ankle recovered, I feel comfortable running again. My shoes had about 200 miles on them already so I decided to buy a new pair. I went to Texas Running Company and I discovered a very geeky equipment there, and I could not resist to share it on this blog.

I am not an expert in running shoes business but from what I understand there are two types: neutral or stability. Depending on how you run, you will need one or the other. But how do you know which one is good for you? You could ask somebody to run behind you and look, or you can go the techie way. And of course, this is the way I like the best. :)

In the store, they had a camera positioned right behind a treadmill. We recorded 2 short runs (about 30 seconds for each run) and analyzed them. I was honestly very surprised by the results.

The two pictures below shows the two shoe types. On the left, I was trying neutral shoes; on the right it is stability shoes.

As you can see, my right ankle bends inward when my feet is landing with the neutral shoes. The technical term for it is actually overpronation.

Here is the video of the 2 runs.

Since this is a tech blog, I would like to share how I merge the 2 videos I got from the store. I used Avisynth and VirtualDub with the following script.

clip1=AVISource("run1.avi").AssumeFPS(5, false)
clip2=AVISource("run2.avi").AssumeFPS(5, false)
StackHorizontal(clip1,clip2)

Chessboard picture recognition project - part 1

2011-08-03T21:41:00.000-07:00

Follow the discussion on YCombinator.

I like to play chess. It is challenging, it requires strategic thinking and it is a great way to clear up your mind. I also like to take my time to play it. It can take a day, a week or even a month! One day I took a picture of the game I was playing to help me to think about it later in the day. This picture gave me the idea to write an application that is capable to analyze the game picture and determine the position of each piece on the board. Maybe someday it could even determine the next best move or continue the game online.

I successfully implemented the first part of the application. This blog post describes how this program is working.

The photo on the left is the original picture I worked on.

Since I have never worked on computer vision, I started by reading about it on wikipedia. I also found a few student's research papers that put me in the right direction such as Scott Blunsden's paper and Chua Huiyan, Le Vinh and Wong Lai Kuan's paper.

The first step is to find the gridlines of the chessboard. I processed the image with a Canny edge detector and then a Hough line detector. I found a Java implementation for these algorithms from Tom Gibara's website and the Vision and Synthetic Environments Laboratory's web site.

The picture below on the left is the output of the Canny edge detector. The green lines on the right picture are the result of the Hough line detection.

The lines found on the picture above are actually the lines of the chessboard. But in some cases, the objects taken in the picture around the chessboard can bring some confusion. On the left picture, the chairs are introducing some lines that are not part of the board. To filter these lines out, I implemented an algorithm to filter 2 larger sets of lines with a 90-degree angle.

Once I got the 2 sets of 9 perpendicular lines, the program finds all the intersection points between these lines on the picture as shown on the picture on the left.

The program then finds the coordinates of each square that forms the chessboard.

At this point, I was able to isolate each square and process them separately. For example, the program is able to determine whether each square is white or black by calculating its average color and comparing it to the black and white colors. The results were correct except for one of the square because a piece of the opposite color was standing on it. Since the color of the squares of chessboard alternates, I could easily identify these errors.

What's next? I probably completed the easiest part of the project. I expect the chess piece recognition algorithm to be quite complex.

If you have a suggestion to help me finish this app, please leave a comment.

I am working on this project just for fun. If you are interested to see what are the real world applications of computer vision in the game industry, check out this web site: http://www.sportvision.com/.

Introduction to Metasploit and Armitage

2011-06-17T17:49:00.000-07:00

Today I had a great half-day training on Metasploit and Armitage organized by our local OWASP Austin chapter and hosted by Microsoft. What I learned today was so interesting that I can't resist to share it here.

Raphael Mudge - Designer of Armitage

Metasploit is an open source penetration testing framework. It contains a database of exploits, payloads and post modules. The goal of the training was to find an exploit on a remote machine, run a payload through this exploit and execute a post module (which is what you can do after taking control over the victim's machine). Of course, you can find more detail about it on wikipedia.

Metasploit is a command line tool. To make it easier (and funnier), Raphael Mudge designed Armitage, which is a user interface for Metasploit. Here is how it looks like:

Armitage - GUI for Metasploit

When a machine on the network is comprised, Armitage illustrates it as a monitor wrapped into thunder lights. Perfect for a hacker movie:D

Here are the materials we had for this training:

The training slides are available here
The exercises sheet is available at here
Metasploit - http://www.metasploit.com/download/
Metasploitable - http://blog.metasploit.com/2010/05/introducing-metasploitable.html
VM Ware player - http://www.vmware.com/

The youtube video below is the screen-cast of the exercises. I show how to setup the lab environment. Then I demonstrate how to use Armitage to find and use an exploit. The video ends with a demonstration of social engineering where the attacker takes full control over the victim's computer.

When I first started Armitage, it could not connect to the database. I had to kill all ruby processes and reconnect again.Once Armitage started, you may be asked to enter your IP address. If you dont you can always set it later by running the following command in the console; it will set a global variable.

setg LHOST 10.10.10.10

Here are some interesting resources for further reading:

offensive-security.com - online courses on Metasploit
pentest.cryptocity.net - online courses for Penetration Testing and Vulnerability Analysis currently taught at the Polytechnic Institute of New York University

Visualization of randomness

2011-05-31T17:58:00.000-07:00

As I was writing a function to generate random values, I realized it is hard to tell if the implemented function truly generates random values. A unit test can validate the length and the format of the generated values, but not its randomness.

To identify potential implementation flaws in my random generator, I developed the following tool.

Keep Last 100 Random Values Keep All Random Values

The chart above compares 2 random generators. It shows the frequency for each value generated. By default, the chart keeps the last 100 generated values. You can click on the radio button above the chart to keep track of all generated values.

What I expect to see from a bad random generator is an uneven distribution of the random values.

In the example above, I am comparing the 2 following JavaScript random generators. They both generate a random value from 0 to 9.

function randomGeneratorUsingFloor() { 
 return Math.floor( Math.random() * 10 ); 
}

function randomGeneratorUsingRound() { 
 return Math.round( Math.random() * 9 ); 
}

Can you spot what is wrong with the second implementation? The numbers 0 and 9 have a smaller chance to be generated compared to the other numbers. If this is not obvious on the chart above, select "Keep All Random Values", it should reveal the issue as shown in the picture below.

Math.random() generates a number between 0 and 1. The value generated is then multiplied. In the implementation using Math.floor(), all the values between 0 and 0.99.. will result as a 0. In the implementation using Math.round(), only the values between 0 and 0.49.. will result as a 0.

It appears that this is a common mistake as you can see it on Google Code Hosting and GitHub.

The test I put in place here is very basic. It exists some advanced work such as the Diehard tests. I also found a very creative randomness visualization on random-walk.com.

Why we need strong p4ssw0rds

2011-05-02T21:46:00.000-07:00

Back in February 2011, Rick Redman from Korelogic came to present his Supercharged Password Cracking Techniques at the Austin OWASP chapter monthly meeting.

With these techniques, he was able to crack large password database in a very short time using a tool called John The Ripper. In this article, I want to present what are these techniques and what we can do to secure our identities online.

In December 2010, the media group Gawker (Gizmodo.com, Lifehacker.com) was attacked and their 750,000-password database was stolen. The passwords were encrypted with the algorithm DES, but it did not prevent them from being cracked. More recently, the Sony's Playstation Network was also being attacked. More than 75 million passwords, emails, credit card numbers and other personal data have been compromised.

The top left shows the 250 most commonly used passwords from the Gawker database. I built this word cloud with wordle.net. On the right, it is an extract of the password dictionary used by John The Ripper. I built this with a JS library called stratus. If you are currently using one of these passwords for your bank account, you should probably change it quickly!

These decrypted real user passwords not only revealed what are the commonly used passwords but also showed that many people are using the same patterns to build their passwords. Knowing these patterns, it is possible to crack passwords in a much shorter time than using a basic brute force technique.

Here is how you can customize John The Ripper (JTR) to crack encrypted passwords. Please note that I am using an unofficial build of JTR available here. First, you need to create a file containing the passwords to crack. In our example, this file is called pwd2crack.txt and here is the file content:

user1:d0763edaa9d9bd2a9516280e9044d885
user2:a8e003b1180fd689f558657079d05f5a

The file contains the passwords for 2 users: user1 and user2. The passwords are hashed using the MD5 algorithm.

To run John The Ripper, you can use the following command:

>john --wordlist=password.lst --format=raw-MD5 pwd2crack.txt
Loaded 2 password hashes with no different salts (Raw MD5 [raw-md5 SSE2 16x4])
monkey           (user1)
guesses: 1  time: 0:00:00:00 100.00% (ETA: Mon May  2 22:42:22 2011)  c/s: 469428  trying: trinity - hallo

As you can see, JTR was able to crack user1's password almost instantly because "monkey" was in its list of passwords. But JTR was unable to crack user2's password. You can try the default command using the built-in logic to guess the passwords.

>john --format=raw-MD5 pwd2crack.txt
Loaded 2 password hashes with no different salts (Raw MD5 [raw-md5 SSE2 16x4])
Remaining 1 password hash
guesses: 0  time: 0:00:00:04 (3)  c/s: 195765  trying: 39of - 3ayo
guesses: 0  time: 0:00:00:15 (3)  c/s: 2965K  trying: beteng95 - betel197
guesses: 0  time: 0:00:00:43 (3)  c/s: 5430K  trying: swoji1x - swojsem
guesses: 0  time: 0:00:00:55 (3)  c/s: 5817K  trying: ahabh9 - ahabu2
guesses: 0  time: 0:00:01:08 (3)  c/s: 6052K  trying: luk12ay - luk11io
Session aborted

After running this command for a few minutes, my computer got really hot and JTR was still not able to crack user2's password. While JTR is running, press the space bar to print in the console the progress of the operation.

One of the common patterns for password is to add a date at the end of the password, especially the current year. You can configure JTR to use its password dictionary with "2011" at the end of each entry by adding the following to the file john.ini or john.conf.

[List.External:CustomWithYear2011]
void filter() {
 /* calculate word length */
 int length;
 length = 0;
 while (word[length]) length++;

 word[length] = '2';
 word[length+1] = '0';
 word[length+2] = '1';
 word[length+3] = '1';
 word[length+4] = 0;
}

This function, written in C, alters the password to hash before it is compared to the one in pwd2crack.txt. Then you can call JTR with this customization.

>john.exe --format=raw-MD5 --wordlist=password.lst --external=CustomWithYear2011 pwd2crack.txt
Loaded 2 password hashes with no different salts (Raw MD5 [raw-md5 SSE2 16x4])
Remaining 1 password hash
monkey2011       (user2)
guesses: 1  time: 0:00:00:00 100.00% (ETA: Mon May  2 22:06:09 2011)  c/s: 25600  trying: freedom2011 - barney2011

This time JTR was able to crack the second password: monkey2011.

You can get more details about these techniques on the Korelogic website.

Here are a few tips I would recommend:

The passwords protecting your most valuable accounts should not be shared with other website
Use password that are strong and easy to remember
If available, use 2-factor authentication (eg: Paypal, Google, World of Warcraft)

If you are responsible of a website, you can:

Raise your users awareness (password strength indicator, trainings)
Use a strong hash algorithm to store the passwords (BlowFish)
Integrate a second factor of authentication

Get in a hot air balloon ride with Google Street View and Maps API

2011-04-09T19:12:00.000-07:00

I have wanted to experiment the Google Maps API for a long time. So today I used it to create an animation replaying a hot air balloon trip I did in 2009 in Santa Rosa, California.

Before I got into the balloon, I started the Google MyTracks application on my phone. It records your GPS coordinates and altitude periodically. I used this data, Google Street View and Maps API to create the following animation.

It is fairly easy to start programming with this API. The Google Code Playground was a very useful resource of API examples. You can find the implementation details in the source code of this page. The following summarizes the main points of the implementation. The animation is in a DIV element:

The first thing I do in the script is to obtain a JS reference to this object:

  var mapDiv = document.getElementById("map-canvas");

Then I instantiate the StreetViewPanorama class with some GPS coordinates:

streetViewPanorama = new google.maps.StreetViewPanorama(
    mapDiv, {
        position: new google.maps.LatLng(
            latitude, 
            longitude,  
            pov: { /*pov stands for point of view*/
                heading:20, /*in degrees, relative to the north*/ 
                pitch:0,   
                zoom:4},
            /* hide all controls */  
            addressControl: false,  
            zoomControl: false,  
            scrollwheel: false,  
            panControl: false,  
            linksControl: false
    });

To update the point of view, I call the following method every few milliseconds.

streetViewPanorama.setPov({ heading:20, pitch:0, zoom:4 } );

After the hot air balloon takes off, the animation switches to Google Maps.

  var map = new google.maps.Map(mapDiv, {
    center: new google.maps.LatLng(latitude, longitude),
    zoom: 20 ,  
    mapTypeId: google.maps.MapTypeId.SATELLITE,  
    disableDefaultUI: true
  });

To move the map and simulate the balloon movement, I call the following methods with new coordinates:

map.panTo( new google.maps.LatLng(latitude, longitude ));
map.setZoom( newZoom );

The animation is quite shaky. I could actually get a better result using the Google Earth API, but this will be for a later post ;-)

Analyzing data from Twitter feeds

2011-04-04T22:36:00.000-07:00

On average 1 billion tweets are being posted per week. This gigantic amount of data represents a great opportunity to analyze live trends and opinions... if you can filter out the data you are looking for.

I attended a very interesting conference at SXSW that enticed me to try this out. The idea is to pull some data from social media websites (Twitter in this example) and analyze them.

I hacked a little program to download tweets, to store them in a database and to run some basic analysis on these data. It is using twitter4j and sqlite4java. The source code is available upon request.

My original plan was to download all tweets posted during the SXSW conference containing the word SXSW. Unfortunately, Twitter limits their search results to 1500 tweets per day, so I was not able to download them all. That's why I decided to narrow my search to all tweets posted during the time of the final keynote and at the Austin Convention Center using the GPS coordinates. With these new filters, I was able to retrieve 2600 tweets in 2 days.

First, I counted the numbers of occurrence for each word. After excluding all the common punctuations, prepositions, articles and numbers, I looked at the most common words used in these tweets:

The words that are tweeted the most are the users' location (i.e. Austin, Convention, Center), followed by the particulars of the keynote speaker-- Blake Mycoskie.

Only a few words are being tweeted repeatedly. Out of the 4840 words my program counted, 97% of them were used 20 times or less as you can see below.

The vocabulary diversity chart above demonstrates that the words occurring more than 20 times are representative of the tweeting trend at that time and place.

At this point, it was still very hard to determine what is the trend/opinion specific to the keynote. The program was still processing many tweets that are not related to the content of the keynote itself. So I decided to add another filter to select only the tweets that contain at least one of the following word: Blake, Mycoskie, TOMS or shoes. I also used a dictionary of the 5000 most commonly used words from the Princeton university to filter out the results.

With this new filters, the following words stood out:

great amazing giving story june 1for1

This may be a little simplistic but as a conclusion I would say that the attendees of the keynote speech:
- enjoyed the speech (great, amazing, story)
- understood the concept of TOMS business and were willing to share it (giving, 1for1)
- were excited to share the coming announcement on June 7th (june).

This post is the result of a few long nights of coding and analyzing. There are a lot more advanced works publicly available. You may be interested in the following links:

How to automate tasks in Photoshop with JavaScript

2011-03-28T21:58:00.000-07:00

I recently learned it is possible to control Adobe Photophop in JavaScript, so I tried it out! From this article, I hope you will learn how to get started with Photoshop scripting.

Photoshop is able to record your manual actions into a JavaScript. To enable this feature:

copy the file ScriptingListenerJS.8LI from C:\Program Files\Adobe\Adobe Photoshop CS5\Scripting\Utilities to C:\Program Files\Adobe\Adobe Photoshop CS5\Plug-ins\Automate
restart Photoshop
start manipulating Photoshop

A file ScriptingListenerJS.txt should be created on your Desktop. I opened an image and resized it, here is the script generated:

// =======================================================
var idOpn = charIDToTypeID( "Opn " );
    var desc1 = new ActionDescriptor();
    var idnull = charIDToTypeID( "null" );
    desc1.putPath( idnull, new File( "C:\\codebazaar\\3x3gifmaker\\input\\IMG_5032.JPG" ) );
executeAction( idOpn, desc1, DialogModes.NO );

// =======================================================
var idImgS = charIDToTypeID( "ImgS" );
    var desc2 = new ActionDescriptor();
    var idWdth = charIDToTypeID( "Wdth" );
    var idPxl = charIDToTypeID( "#Pxl" );
    desc2.putUnitDouble( idWdth, idPxl, 3000.000000 );
    var idscaleStyles = stringIDToTypeID( "scaleStyles" );
    desc2.putBoolean( idscaleStyles, true );
    var idCnsP = charIDToTypeID( "CnsP" );
    desc2.putBoolean( idCnsP, true );
    var idIntr = charIDToTypeID( "Intr" );
    var idIntp = charIDToTypeID( "Intp" );
    var idBcbc = charIDToTypeID( "Bcbc" );
    desc2.putEnumerated( idIntr, idIntp, idBcbc );
executeAction( idImgS, desc2, DialogModes.NO );

A script helps to automate repetitive tasks in Photoshop. You can use the generated code as a starting point to do so.

Adobe also offers an API. For example, I built a script executing the following operations:

ask the user to select a folder
open all the images present in the selected folder
resize all the images
copy/cut and paste all the images into different layers
build a GIF animation

The complete script is available for download here.

To run the script:

open Adobe Extended Toolkit
in the dropdown menu at the top left of the window, select Adobe Photoshop
in the menu, select File, then Open and select the script to execute
in the menu, select Debug, Run (or press F5)
Photoshop will ask to select a folder containing the images to process
then you can see Photoshop executing all the tasks coded in the script

This is a screenshot of Adobe Extended Toolkit. It allows you to set breakpoints, view the local variables as you are debugging and inspect the call stack

I did not find how to automatically set the time interval between each animation frame, so I manually had to do this step and save the animation (File, Save for Web & Device, Save).

The following image has been generated by the script.

The API allows to write a code that is more concise and easier to read than the code generated by Photoshop. In some cases I was not always able to find what method to use from the API to execute a specific action, so I recorded some of these actions and incorporated the generated code into my script.

Here are some web sites I found useful:

Also, if you don't get dizzy by looking at this animation, you can try this one made in HTML 5.

Monkey see, GreaseMonkey do!

2010-11-03T17:07:00.000-07:00

GreaseMonkey has been around for quite a while, but it is not known as much as it should! Originally, it started as a browser extension for Firefox but the userscripts are now natively supported in Chrome.

In this video tutorial, I will talk about:

What GreaseMonkey is
How I used it
Fews tips regarding the development of userscript

The userscript I use as example is available here: http://userscripts.org/scripts/show/87653. userscript.org hosts about 60,000 userscripts as I am writing this! You can search the best rated or the most downloaded userscripts. The nature of the scripts that are available on this website is very diverse. It ranges from providing cheats on popular Facebook games to enhancing the look of your everyday news website.

Two Factor Authentication without the Overhead of Traditional OTP

2010-09-02T19:09:00.000-07:00

My colleagues and I published a paper where we discussed our design of a two-factor authentication taylored to lower the cost without compromising the security.

Here is the abtract: "This paper describes a simple security architecture that supports two factor authentication for accessing Internet resources. Instead of utilizing the complex traditional OTP frameworks, which can be cumbersome to both deploy and use, we present a software architecture based on a shared knowledge between a token and a remote Internet resource; such as a web server. The confidentiality of this shared knowledge is protected by the smart card embedded in the token. The approach is explained in the context of initial token setup and a practical use-case for two factor online authentication. Despite its simplicity, this software optimization provides a comparable level of security for asserting the identity of users."

We presented it at the 13th IASTED International Conference on Software Engineering and Applications 2009 in Cambridge, MA. The full paper is also available on actapress.com, but it is not free :/

We are featured on the GWT blog!

2010-09-02T18:50:00.000-07:00

I met Patrick Chanezon, Google developer advocate, at the Google Hackathon in SXSW 2010. As a former engineer at Sun, he has a clear understanding of the world of smart card. I showed him my team's work, where we married GWT and smart cards in an innovative application.

Here is a video where Patrick interviewed me to talk about my company Gemalto, my team's work and explained how GWT helps us to meet our various project requirements.

In addition to the video, our team was invited to guest blog on the Google GWT blog to share more application design and programming tips.

Video tutorial for JNI

2010-08-22T14:37:00.000-07:00

JNI (Java Native Interface) allows the communication between a JAVA program and a native program (C, C++). The objective of this first blog post is to give you a quick introduction to this technology. Hopefully, after reading this post and watching the video, you should be able to:

set up your own environment with Eclipse and Visual Studio
create a program using JNI
debug while switching between JAVA and native code
avoid memory leaks
understand the risk of JVM crash

I used Eclipse and Microsoft Visual Studio for this demonstration. Eclipse is a popular development IDE for JAVA. You can download it for free on http://www.eclipse.org/. Visual Studio Express is the free version of Visual Studio and it is available here: http://www.microsoft.com/express/.

The example is using two classes Bean and JniExample. JniExample loads the native library (JniExampleLibrary.dll) and exposes the native methods implemented in the DLL. The bean is used to demonstrate how to exchange data through JNI.

We used javah.exe to generate the header file declaring the native methods in the DLL as defined in JniExample.java. The command line is:

javah -d C:\codebazaar\JniExample\cpp\JniExample codebazaar.example.JniExample

We also used javap.exe to generate the method signatures. The command line is:

javap -s codebazaar.example.JniExample

As your program may evolve, I recommend you to save these commands as external tools in eclipse.

To debug the library and the JAVA, in Visual Studio go to Debug, select Attach to Process, find javaw.exe and click on the Attach button.

As in any native code, you need to pay a special attention to memory leak. In the case of JNI, the JVM takes care of most of the job. Any instance passed to or returned by the DLL will be freed by the JVM. You need to free a buffer only if it has been allocated outside the JVM.

Finally, we demonstrated how to get the JVM crash... That was the easy part :D If you are considering communicating with a native library from your web application, you need to realize that a problem in the native library might take the whole server down. As this is not great in term of avaibility, you may consider running the native library on a separate web server.

I uploaded all the source code used. But you can view it directly from here:

package codebazaar.example;

public class Bean {
//public members
public String dataString; 
public byte[] dataByteArray;

public Bean() {}

//getters and setters
public String getDataString() {
return dataString;
}

public void setDataString(String dataString) {
this.dataString = dataString;
}

public byte[] getDataByteArray() {
return dataByteArray;
}

public void setDataByteArray(byte[] dataByteArray) {
this.dataByteArray = dataByteArray;
} 

@Override
public String toString(){
String ret = "string = " + dataString;

ret += " / byteArray =";
if ( dataByteArray != null ) {
for ( byte b : dataByteArray) {
ret += " " + b;
}
}

return  ret; 
}
}

package codebazaar.example;

public class JniExample {
static {
System.loadLibrary("JniExampleLibrary");
}

// native methods
/**
* this method calls printSomething
*/
public native void callJavaMethod();

/**
* this method creates an instance of Bean and returns it
*/
public native Bean createAndReturnBean();

/**
* this method takes an instance of Bean as parameter and changes the value of its members
*/
public native void modifyBean(Bean bean);

/**
* this method will the JVM when invoked 
*/
public native void crashTheJvm();

public void printSomething() {
System.out.println("Thanks for watching this video");
}

public void runExample1() {
System.out.println("starting runExample1...");
callJavaMethod();
}

public void runExample2() {
System.out.println("starting runExample2...");

Bean bean = createAndReturnBean();
System.out.println("returned= " + bean.toString());
}

public void runExample3() {
System.out.println("starting runExample3...");

Bean bean = new Bean();
bean.setDataString("hello");

byte[] byteArray = new byte[] { 0x01, 0x02, 0x03 };
bean.setDataByteArray(byteArray);

System.out.println("before: " + bean.toString());
modifyBean(bean);
System.out.println("after: " + bean.toString());
}

public void runExample4() {
System.out.println("starting runExample4...");
crashTheJvm();
}
}

package codebazaar.example;

public class Main {

/**
* @param args
*/
public static void main(String[] args) {
System.out.println("Starting JavaMain...");

JniExample jniExample = new JniExample();
jniExample.runExample1();
jniExample.runExample2();
jniExample.runExample3();
jniExample.runExample4();
}

}

/* DO NOT EDIT THIS FILE - it is machine generated */
#include 
/* Header for class codebazaar_example_JniExample */

#ifndef _Included_codebazaar_example_JniExample
#define _Included_codebazaar_example_JniExample
#ifdef __cplusplus
extern "C" {
#endif
/*
* Class:     codebazaar_example_JniExample
* Method:    callJavaMethod
* Signature: ()V
*/
JNIEXPORT void JNICALL Java_codebazaar_example_JniExample_callJavaMethod
(JNIEnv *, jobject);

/*
* Class:     codebazaar_example_JniExample
* Method:    createAndReturnBean
* Signature: ()Lcodebazaar/example/Bean;
*/
JNIEXPORT jobject JNICALL Java_codebazaar_example_JniExample_createAndReturnBean
(JNIEnv *, jobject);

/*
* Class:     codebazaar_example_JniExample
* Method:    modifyBean
* Signature: (Lcodebazaar/example/Bean;)V
*/
JNIEXPORT void JNICALL Java_codebazaar_example_JniExample_modifyBean
(JNIEnv *, jobject, jobject);

/*
* Class:     codebazaar_example_JniExample
* Method:    crashTheJvm
* Signature: ()V
*/
JNIEXPORT void JNICALL Java_codebazaar_example_JniExample_crashTheJvm
(JNIEnv *, jobject);

#ifdef __cplusplus
}
#endif
#endif

#include "codebazaar_example_JniExample.h"
#include 

JNIEXPORT void JNICALL Java_codebazaar_example_JniExample_callJavaMethod (JNIEnv * env, jobject obj) {
jclass jniExampleCls = env->GetObjectClass(obj);

jmethodID mid = env->GetMethodID(jniExampleCls, "printSomething", "()V");

env->CallVoidMethod(obj, mid);
}

JNIEXPORT jobject JNICALL Java_codebazaar_example_JniExample_createAndReturnBean  (JNIEnv *env, jobject obj) {
jclass beanClass = env->FindClass("codebazaar/example/Bean");
jmethodID constructorMethodId = env->GetMethodID(beanClass, "", "()V"); 
jobject bean = env->NewObject(beanClass, constructorMethodId);

jstring newString = env->NewStringUTF("this bean has been created in Java_codebazaar_example_JniExample_createAndReturnBean");

jmethodID setStringMid = env->GetMethodID(beanClass, "setDataString", "(Ljava/lang/String;)V");

env->CallVoidMethod(bean, setStringMid, newString );

return bean;
}

JNIEXPORT void JNICALL Java_codebazaar_example_JniExample_modifyBean  (JNIEnv *env, jobject obj, jobject bean) {
jclass beanCls = env->GetObjectClass(bean);

jmethodID setStringMid = env->GetMethodID(beanCls, "setDataString", "(Ljava/lang/String;)V");

// set the bean member "dataString"
jstring newString = env->NewStringUTF("world");
env->CallVoidMethod(bean, setStringMid, newString );

// set the bean member "dataByteArray"
jbyteArray newByteArray = env->NewByteArray(5);
jbyte buffer[5] = {5,4,3,2,1};
env->SetByteArrayRegion( newByteArray, 0, 5, buffer);

jmethodID setByteArrayMid = env->GetMethodID(beanCls, "setDataByteArray", "([B)V");

env->CallVoidMethod(bean, setByteArrayMid, newByteArray );
}


JNIEXPORT void JNICALL Java_codebazaar_example_JniExample_crashTheJvm (JNIEnv *env, jobject obj) {
//stack overflow - http://en.wikipedia.org/wiki/Stack_overflow
double x[1000000];
}

UPDATE 04/02/11:
If you encounter the following error:

java.lang.UnsatisfiedLinkError: ${path here}/library.dll: This application has failed to start because the application configuration is incorrect. Reinstalling the application may fix this problem

I would recommend you to use Dependency Walker to verify your DLL can find all its dependencies. If you are missing msvcr90.dll, you may be missing the Microsoft Redistributable Merge Modules.