Code Bazaar

Experimenting with AI Diffusion

2024-01-29T18:04:00.006+01:00

Code, notebook and live demo are available on my 🤗 HuggingFace Space

I made it to the Lesson 10 of the fast.ai course. Its homework was particularly fun and challenging. In a nutshell, the goal is to deconstruct an existing Diffusion model available on 🤗 HuggingFace and rebuild it component by component. This model is capable of generateing an image based on a text (prompt) and optionally an existing image. Just like this:

The first step is to use an Auto-encoder to reduce the amount of data used by image. We can encode an image to a smaller Tensor, then decode it back. It does not come back exactly the same, but the difference is marginal.

Can you spot the difference?

Now that we can work on smaller Tensor, we can efficiently generate images based on a prompt. We can control how closely the model should follow the prompt by setting the guidance parameter. In the picture below, I try different value for the guidance.

Often, the model will generate an image which does not match our expectation. We can use the negative prompt to constantly remind the model to not match specific criteria throughout the generation. In the picture on the left, we asked the model to generate "a beautiful tree" which came with a lot of green. If we don't want so much green, we can set "green" in the negative prompt.

Before the image generation starts, the model generates embeddings based on the prompt given. Multiple prompts can be used, and their respective embeddings can be merged. This method can generate some interesting pictures! We can also set weights on each prompt. In the example below, we generated 10 images with different weights.

If we just provide a prompt as input to the model, it will use an random noise picture as a starting point. But we can also provide an existing image as a starting point. To use this method, we need to first add some noise to the picture, then finish the image generation as usual. In the picture below, we show a starting image, the same image with the added noise, and on the right the final generated image. The prompt for it is: "a cute dog".

To go from the middle picture to the one on the right, the model progressively removes noise from the picture. Each step generates what is called a latent. We can capture these latents and turn them in images to show how the model progress through the image generation.

We can set the amount of noise added to the original picture. Here, we set different amount of noise (2nd row) and see the final image generated (1st row).

You can head to my HuggingFace Space to try it out!

Can AI replace Captcha click farms?

2023-12-24T15:00:00.007+01:00

The code and demo for this blog is available here on my Hugging Face Space

I recently took some great AI training (here and here). One of the courses is introduced with this xkcd joke from 2014:

It made me think: what task was considered impossible for a computer to accomplish in 2014, and can now be easily achieved using AI? 🤔

2014 was the year Google released reCaptcha v2 which became, by far, the most popular captcha solution. We've all seen these prompts:

To illegally promote companies, products, influence elections, or launder money, hackers need to create thousands of fake accounts. Captcha are meant to prevent this issue by ensuring a real human is behind the screen to verify the image. If a computer can pass the Captcha test, a hacker could automate the user creation process. I haven't tested these illegal services but it seems hackers hire Captcha click-farms where humans solve the Captcha tests for a fee ($3 for 1000 captcha according to this F5 Labs article).

Now that we have self-driving cars on the road, there is no secret that computers can recognize traffic lights. However, these cars (e.g. Tesla and Waymo) are equipped with expensive hardware and backed by top engineering teams. What I was actually interested to see is whether I could easily built a cost-efficient AI tool to solve a Captcha test.

The Captcha test splits an image in 4x4=16 squares and asks users which squares contain a specific object (e.g. traffic lights). One approach would be to use an image classification model and run it 16 times on each sub square. But it would not be very accurate as a traffic light might go across multiple squares and it may not be possible to identify part of a traffic light as one.

It turns out humans are not the only one struggling with those 😅

My first approach: train my own AI model

I started collecting online pictures and train my own model to solve the test. I used the duckduckgo-search python library with some keywords search such as:

cars and trucks on a road with a traffic light
cars at a traffic junction
cars and buses on a road at a stop
car traffic taken from dash cam

Here is code snippet for this:

from duckduckgo_search import DDGS

def search_images(keywords, max_images=1):
with DDGS() as ddgs:
return [r['image'] for r in ddgs.images(
keywords=keywords,
type_image='photo',
max_results=max_images )]

It was time-consuming to find relevant photos and label them. Some pictures were aerial pictures, some had watermarks, some were artistic photos, some were pictures of the dash cam instead of picture taken by dash cam, others were just irrelevant or duplicates. After quite some work, I was left with only about 30 descent pictures.

This model did not perform well. One of the reasons is that the dataset was too small. I tried finding an existing dataset but it wasn't that easy. I submitted an application to access the CityScape dataset but by the time my access was granted, I already had another working solution.

Second Attempt: Use a pre-trained Image Segmentation Model

I looked on HuggingFace for an existing Image Segmentation model and found one from nvidia which is pre-trained on the city scape dataset. I tested it and found that it can identify traffic lights very well. I wrote a script script that follows these steps:

resize the image to 1024x1024 as expected by the model
use the transformer python library to instantiate the model and pass the resized picture as input
as the model returns a list of masks for each object it can identify, I take the mask for the traffic lights and ignore the others
finally, I calculate which of the 16 squares the traffic lights fall into.

You can see the code here.

I built this demo using Gradio (which you can find on my HuggingFace Space). Feel free to try it out but expect to wait a minute or so for the app to start, and it will be slow because it is running on a CPU. The white squares indicate where the traffic lights are located.

Conclusion: Can my model beat the click-farm?

I ran some basic performance tests on various hardware on Hugging Face and RunPod, then I calculated the cost of solving 1000 Captcha test.

Provider	Device	Specs	Time to Solve (in Seconds) / Image	Hardware Cost ($) / Hour	cost ($) / 1000 captchas
Apple	macbook	M3 Pro 18 GB RAM	9
Hugging Face	Base cpu	2 vCPU 16 GB RAM	35
Hugging Face	CPU upgrade	8 vCPU 32 GB RAM	24	0.03	0.20
Hugging Face	Nvidia t4 medium	8 vCPU 30 GB RAM 16GB VRAM	1.2	0.90	0.30
RunPod	RTX 4000 Ada	9 vCPU 50 GB RAM	1	0.15	0.05
RunPod	RTX 4090	24 GB VRAM 46 GB RAM 16 vCPU	1.0	0.39	0.11
RunPod	RTX 6000 Ada	22 vCPU 50 GB RAM	0.85	0.69	0.16

As expected, the model runs much faster on GPU than CPU. The GPUs are more expensive per hour, but cheaper per 1000s Captcha images. Assuming a hacker would not care about security and reliability (which is debatable), I used spot (i.e. interruptible), community (i.e. run by 3rd parties) GPU instances.

The cheapest option I found was the RTX 4000 Ada, which can process each image in 1 second and costs $ 0.15 per hour, which translate is a cost of $0.05 for each 1000 captchas processed.

This is still more expensive than the price of $0.003 per image charged by click farms, but I haven't tried hard to optimize my model.

Captcha services like Google ReCaptcha or hCaptcha have others security controls and risk assessment methods which are out of scope of this blog. My focus here is only on the traffic light identification task as it is really just an excuse for me to practice what I learned in AI courses.

Still, if you think of security as an onion, captchas look like a very thin outer layer. It may prevent unskilled hackers to bypass them, but it won't hold against a motivated hacker with basic AI knowledge.

Configure Amazon SageMaker Studio to auto-shutdown unused compute resources and install developer productivity extensions

2022-09-21T13:58:00.008+02:00

I have been learning and exploring Machine Learning lately. As I experimented with various tutorials and Jupyter notebooks, I found that Amazon SageMaker Studio was great for productivity. Simply put, it is a cloud IDE for Machine Learning.

There are many great extensions available to enhance the developer experience. For example, the LSP extension enables code auto-completion.

In the example above, the auto-completion helps me navigate the class and functions available. Also, pyflakes indicates I imported the sagemaker module but I am not using it, which helps me to keep my code clean.

Also, I (painfully) learned that it is easy to forget a running instance. From SageMaker Studio, you can launch services such as SageMaker Training Job, Hyperparameter tuning job or Serverless Inference. With these services, you will pay only for what you use, which is great. But SageMaker Studio can run multiple instances for the various notebooks you are working on. And if you are training your model directly in the notebook, you will need a beefy instance. In my case, I was using a ml.g4dn.xlarge instance which has 4 vCPU, 16 Gb of RAM and 1 GPU. If I let it run 24/7, it will generate unnecessary costs and CO2 emissions.

To enable the developer productivity extensions and configure the server to automatically shut down all SageMaker Studio compute resources, you have to configure a Lifecycle Configuration. There are other ways to install these extensions, but they won't persist after a shutdown, so I don't recommend using them.

This repo contains some examples of scripts to be used with the Lifecycle Configuration. For this blog, we will enable the LSP Server and auto-shutdown extensions. I tweaked the examples from this repo and combined them in a single bash script.

The first step is to configure the server timeout. After 45 minutes of inactivity, I want the server to shut down.


#!/bin/bash
# This script installs the idle notebook auto-checker server extension to SageMaker Studio
# The original extension has a lab extension part where users can set the idle timeout via a Jupyter Lab widget.
# In this version the script installs the server side of the extension only. The idle timeout
# can be set via a command-line script which will be also created by this create and places into the
# user's home folder
#
# Installing the server side extension does not require Internet connection (as all the dependencies are stored in the
# install tarball) and can be done via VPCOnly mode.

set -eux

# timeout in minutes
export TIMEOUT_IN_MINS=45

Next, the script prepares the installation of the shutdown.


# Should already be running in user home directory, but just to check:
cd /home/sagemaker-user

# By working in a directory starting with ".", we won't clutter up users' Jupyter file tree views
mkdir -p .auto-shutdown

# Create the command-line script for setting the idle timeout
cat > .auto-shutdown/set-time-interval.sh << EOF
#!/opt/conda/bin/python
import json
import requests
TIMEOUT=${TIMEOUT_IN_MINS}
session = requests.Session()
# Getting the xsrf token first from Jupyter Server
response = session.get("http://localhost:8888/jupyter/default/tree")
# calls the idle_checker extension's interface to set the timeout value
response = session.post("http://localhost:8888/jupyter/default/sagemaker-studio-autoshutdown/idle_checker",
            json={"idle_time": TIMEOUT, "keep_terminals": False},
            params={"_xsrf": response.headers['Set-Cookie'].split(";")[0].split("=")[1]})
if response.status_code == 200:
    print("Succeeded, idle timeout set to {} minutes".format(TIMEOUT))
else:
    print("Error!")
    print(response.status_code)
EOF
chmod +x .auto-shutdown/set-time-interval.sh

# "wget" is not part of the base Jupyter Server image, you need to install it first if needed to download the tarball
sudo yum install -y wget
# You can download the tarball from GitHub or alternatively, if you're using VPCOnly mode, you can host on S3
wget -O .auto-shutdown/extension.tar.gz https://github.com/aws-samples/sagemaker-studio-auto-shutdown-extension/raw/main/sagemaker_studio_autoshutdown-0.1.5.tar.gz

# Or instead, could serve the tarball from an S3 bucket in which case "wget" would not be needed:
# aws s3 --endpoint-url [S3 Interface Endpoint] cp s3://[tarball location] .auto-shutdown/extension.tar.gz

# Installs the extension
cd .auto-shutdown
tar xzf extension.tar.gz
cd sagemaker_studio_autoshutdown-0.1.5

# Activate studio environment just for installing extension
export AWS_SAGEMAKER_JUPYTERSERVER_IMAGE="${AWS_SAGEMAKER_JUPYTERSERVER_IMAGE:-'jupyter-server'}"
if [ "$AWS_SAGEMAKER_JUPYTERSERVER_IMAGE" = "jupyter-server-3" ] ; then
    eval "$(conda shell.bash hook)"
    conda activate studio
fi;

pip install --no-dependencies --no-build-isolation -e .
jupyter serverextension enable --py sagemaker_studio_autoshutdown

Then we install the LSP


# Install:
# - The core JupyterLab LSP integration and whatever language servers you need (omitting autopep8
#   and yapf code formatters for Python, which don't yet have integrations per
#   https://github.com/jupyter-lsp/jupyterlab-lsp/issues/632)
# - Additional LSP plugins for formatting (black, isort) and refactoring (rope)
# - Spellchecker for markdown cells
# - Code formatting extension to bridge the LSP gap, and supported formatters
echo "Installing jupyterlab-lsp and language tools"
pip install jupyterlab-lsp \
    'python-lsp-server[flake8,mccabe,pycodestyle,pydocstyle,pyflakes,pylint,rope]' \
    jupyterlab-spellchecker \
    jupyterlab-code-formatter black isort
# Some LSP language servers install via JS, not Python. For full list of language servers see:
# https://jupyterlab-lsp.readthedocs.io/en/latest/Language%20Servers.html
jlpm add --dev bash-language-server dockerfile-language-server-nodejs

# This configuration override is optional, to make LSP "extra-helpful" by default:
CMP_CONFIG_DIR=.jupyter/lab/user-settings/@krassowski/jupyterlab-lsp/
CMP_CONFIG_FILE=completion.jupyterlab-settings
CMP_CONFIG_PATH="$CMP_CONFIG_DIR/$CMP_CONFIG_FILE"
if test -f $CMP_CONFIG_PATH; then
    echo "jupyterlab-lsp config file already exists: Skipping default config setup"
else
    echo "Setting continuous hinting to enabled by default"
    mkdir -p $CMP_CONFIG_DIR
    echo '{ "continuousHinting": true }' > $CMP_CONFIG_PATH
fi

Finally, the script restart the server and configure the timeout.


if [ "$AWS_SAGEMAKER_JUPYTERSERVER_IMAGE" = "jupyter-server-3" ] ; then
    conda deactivate
fi;

# Restarts the jupyter server
nohup supervisorctl -c /etc/supervisor/conf.d/supervisord.conf restart jupyterlabserver

# Waiting for 30 seconds to make sure the Jupyter Server is up and running
sleep 30

# Calling the script to set the idle-timeout and active the extension
/home/sagemaker-user/.auto-shutdown/set-time-interval.sh

Now that we have the script, we can load it using the AWS CLI or from the console. Since there is already an example with the CLI here, I will show how to do this with the console.

I already have Sagemaker Studio configured and working. In the AWS console for SageMaker Studio, click on the Attach button of the Lifecycle Configurations section.

Select New configuration. The configuration type is Jupyter server app. And I gave it the name autoshutdown-and-lsp.

Copy and paste your script and click on the button Attach to domain.

The Lifecycle Configuration should now be visible.

Select the script and click on the button Set as default

From the console, you can see what is running for a user but it is not telling which instance types are used.

Here is an example showing all compute resources shut down.

If SageMaker Studio is running, you can also see which Apps and Kernels are running.

If you search for lsp in the Extension section, you will see it has been automatically installed.

Finally, you can see the logs from your bash script in Cloudwatch. The log group is called /aws/sagemaker/studio and the Log streams ends with /LifecycleConfigOnStart.

Note that if you want to update your script, you will have to start from step 1. You can't update a script in a Lifecycle Configuration that has already been created. For this reason, I recommend creating a pipeline using the AWS CLI to manage this process. Also, you could store the settings such as the timeout in AWS System Manager Parameter Store. Another approach would be to make the bash script generic and make it download and execute the necessary updatable scripts.

Update 09/22: I realized I had another incurring charges from a ml.p3.2xlarge instance but I did not have any visible inference host in the console. The support team advised me to delete all endpoint configurations, models, users and domains from the console. In the Cost Explorer, you can filter per instance type to understand what is generating the cost. Additionally, I set up a daily and monthly billing alert.

Encrypt your MSSQL database with TDE and SafeNet KeySecure, and why!

2017-01-14T04:59:00.003+01:00

One of the easiest way to encrypt a MSSQL (or Oracle) database is to use TDE - Transparent Data Encryption. TDE requires the higher end enterprise MSSQL license and requires a DBA to execute SQL commands.

Why should you encrypt your database? If a hacker gets into your network, he may be able to steal a copy of the database or parts of the database. If the data is confidential or under HIPAA, SOX, CJIS or one of the many regulations out there, it can become quite a headache.

One of the benefit of TDE is that the application querying the database does not need to be aware the database encryption: it is transparent to the application. If you have an existing application and database, you can enable TDE on the database without downtime and without changing the code of the application.

But there is catch! By default, MSSQL (or Oracle) stores the encryption key in software on the same machine, so it is not protected and not physically separated from the data. Again, if a hacker has access to you network and access to the data, he will have access to the key next to it so he can just decrypt the data. It is basically like leaving the key on the door of your car. Might as well not lock it!

SafeNet KeySecure solves this issue by keeping a Key Encryption Key outside of the database. In the video below, I walk you through the step of encrypting a SQL database with KeySecure. We look at the MDF and backup files in a text editor before and after encryption to prove the data is being encrypted. We also look at how the access to key in KeySecure is being logged.


/****************************************************/
/* Dummy database */
/****************************************************/
USE master;

CREATE DATABASE SampleDBwithPII;
GO

USE SampleDBwithPII;

Create table Customers (Id int not null, Name varchar(max) not null, Address varchar(max) not null, SSN varchar(max) not null);
GO

INSERT INTO Customers values (2, 'Matt Buchner', 'Arboretum Plaza II, 9442 Capitol of Texas Hwy, 78759 Austin TX', '111-222-3333');



/****************************************************/
/* PREP FOR TDE */
/****************************************************/


/*  enable EKM - Extensible Key Management
 you must be a sysadmin
*/

USE master;

GO 

sp_configure 'show advanced options', 1;
RECONFIGURE;

GO 

sp_configure 'EKM provider enabled', 1;
RECONFIGURE;

GO 


/* Load KS EKM - must be a sysadmin */
/* After running this command, check Security\Cryptographic Providers */
CREATE CRYPTOGRAPHIC PROVIDER safenetSQLEKM
FROM FILE = 'C:\Program Files\Safenet\SQLEKM\safenetsqlekm.dll'

GO 

/* The credentials below should match the credential in KS */
/* After running this command, check Security\Credentials */
CREATE CREDENTIAL EKMCred WITH IDENTITY='tdeuser', SECRET='P@ssw0rd'
FOR CRYPTOGRAPHIC PROVIDER safenetSQLEKM

GO 

ALTER LOGIN sa ADD CREDENTIAL EKMCred
/* example with Windows credentials
ALTER LOGIN [GTOLAB\mbuchner] ADD CREDENTIAL EKMCred;
*/

GO 

/* create a key in KS and create a reference to it in MSSQL */
CREATE ASYMMETRIC KEY SQL_EKM_RSA_2048_Key
FROM Provider safenetSQLEKM
WITH ALGORITHM = RSA_2048,
PROVIDER_KEY_NAME = 'MSSQL_TDE_EKM_RSA_2048_Key',
CREATION_DISPOSITION=CREATE_NEW

GO 

/* reuse the existing key in other cluster nodes 
CREATE ASYMMETRIC KEY SQL_EKM_RSA_2048_Key
FROM Provider safenetSQLEKM
WITH ALGORITHM = RSA_2048,
PROVIDER_KEY_NAME = 'MSSQL_TDE_EKM_RSA_2048_Key',
CREATION_DISPOSITION=OPEN_EXISTING
*/


/* check the keys have been created */
Select * from [master].[sys].[asymmetric_keys]



/****************************************************/
/* HOW TO CONFIGURE TDE */
/****************************************************/
USE master;

GO 

CREATE CREDENTIAL EKMCredTDE
WITH IDENTITY = 'tdeuser',
SECRET = 'P@ssw0rd'
FOR CRYPTOGRAPHIC PROVIDER safenetSQLEKM ;

CREATE LOGIN tde_login
FROM ASYMMETRIC KEY SQL_EKM_RSA_2048_Key ;
GO

ALTER LOGIN tde_login
ADD CREDENTIAL EKMCredTDE;
GO


/* connect to our database */
USE SampleDBwithPII ;
GO

/* create symmetric encryption key */
CREATE DATABASE ENCRYPTION KEY
WITH ALGORITHM = AES_256
ENCRYPTION BY SERVER ASYMMETRIC KEY SQL_EKM_RSA_2048_Key ;
GO

/* enable encryption */
ALTER DATABASE SampleDBwithPII
SET ENCRYPTION ON ;
GO

/* query encryption state */
SELECT DB_NAME(e.database_id) AS DatabaseName, e.database_id, e.encryption_state,
CASE e.encryption_state
 WHEN 0 THEN 'No database encryption key present, no encryption'
 WHEN 1 THEN 'Unencrypted'
 WHEN 2 THEN 'Encryption in progress'
 WHEN 3 THEN 'Encrypted'
 WHEN 4 THEN 'Key change in progress'
 WHEN 5 THEN 'Decryption in progress'
END AS encryption_state_desc, c.name, e.percent_complete
FROM sys.dm_database_encryption_keys AS e
LEFT JOIN master.sys.asymmetric_keys AS c
ON e.encryptor_thumbprint = c.thumbprint

SafeNet Authentication Service video demos

2017-01-14T04:30:00.000+01:00

Below are a couple of video demos which I made for my work as Sales Engineer at Gemalto.

Demonstration of the SAS integration with the Microsoft Remote Desktop Gateway and Remote Desktop WebAccess. The most interesting part is when we show how the 2nd factor authentication can be bypassed by clicking directly on a cached RDP file.

Demonstration of the SAS integration with Netscaler using SAML, where SAS is the IdP and Netscaler is the SP.

Demonstration of the integration of SAS with CryptoAuditor from the company SSH Communications Security Corp.

Demonstration of the integration of SAS with Salesforce.com. The first video shows the configuration, the 2nd video shows the authentication user experience.

Demonstration of the integration of SAS with Twillio Programmable Voice APIs. The authenticating user receives a call and Twillio plays the 6 digit code the user need to authenticate.

Demonstration of SAS integration with Linux PAM.

How to SSH with your Smart Card

2014-07-11T05:11:00.001+02:00

If you have Linux servers, you must be familiar with SSH - Secure SHell. It is common for administrators to use strong authentication because they have the control of the entire company network and resources.

You can configure tools such as PuttySC, PuttyCAC or SecureCRT to use smart card credentials to SSH to your servers.

I made this video to show how it works, enjoy!

To configure your server for smart card authentication:
1. Extract the public key out of the certificate in the card, I run the following command:

pprint.exe -l "c:\Program Files (x86)\Gemalto\DotNet PKCS11\gtop11dotnet.dll"

2. Add the public key to ~/.sshd/authorized_keys on the server, it looks like this:

ssh-rsa AAAAB3NzaC1yc2EAAAAFAAABAAEAAACBANnQe0X1Rl6QezigIXlfe4uzBtKkI083/oL3fl3vfQKdpdwwlwit3ODAOh2qpfs97r+OYUQPY66knNCW/u6hX2hiQk5DXeMR1HuZXQRxGKBxJZAftRXO3pD6b3pfH7djnfudGpg8UMHUBoWDUJ1UMh60K/+0QUqAyKT42vexh1Kj token-key

Install and Configure Citrix XenApp 6.5 in 15 minutes

2014-06-29T00:15:00.000+02:00

I recently had to build a Citrix XenApp lab and I decided to make this video to help others that are just getting started with this software.

The video shows how to install and configure step by step:
- Citrix License Server
- Citrix XenApp 6.5
- Citrix Web Interface

Finally we connect to the Citrix environment to access a virtualized application.

Neutral or stability shoes? Hack into your running!

2011-10-16T17:59:00.000+02:00

Two month ago, I sprained my ankle. Now that my ankle recovered, I feel comfortable running again. My shoes had about 200 miles on them already so I decided to buy a new pair. I went to Texas Running Company and I discovered a very geeky equipment there, and I could not resist to share it on this blog.

I am not an expert in running shoes business but from what I understand there are two types: neutral or stability. Depending on how you run, you will need one or the other. But how do you know which one is good for you? You could ask somebody to run behind you and look, or you can go the techie way. And of course, this is the way I like the best. :)

In the store, they had a camera positioned right behind a treadmill. We recorded 2 short runs (about 30 seconds for each run) and analyzed them. I was honestly very surprised by the results.

The two pictures below shows the two shoe types. On the left, I was trying neutral shoes; on the right it is stability shoes.

As you can see, my right ankle bends inward when my feet is landing with the neutral shoes. The technical term for it is actually overpronation.

Here is the video of the 2 runs.

Since this is a tech blog, I would like to share how I merge the 2 videos I got from the store. I used Avisynth and VirtualDub with the following script.

clip1=AVISource("run1.avi").AssumeFPS(5, false)
clip2=AVISource("run2.avi").AssumeFPS(5, false)
StackHorizontal(clip1,clip2)

Chessboard picture recognition project - part 1

2011-08-04T06:41:00.000+02:00

Follow the discussion on YCombinator.

I like to play chess. It is challenging, it requires strategic thinking and it is a great way to clear up your mind. I also like to take my time to play it. It can take a day, a week or even a month! One day I took a picture of the game I was playing to help me to think about it later in the day. This picture gave me the idea to write an application that is capable to analyze the game picture and determine the position of each piece on the board. Maybe someday it could even determine the next best move or continue the game online.

I successfully implemented the first part of the application. This blog post describes how this program is working.

The photo on the left is the original picture I worked on.

Since I have never worked on computer vision, I started by reading about it on wikipedia. I also found a few student's research papers that put me in the right direction such as Scott Blunsden's paper and Chua Huiyan, Le Vinh and Wong Lai Kuan's paper.

The first step is to find the gridlines of the chessboard. I processed the image with a Canny edge detector and then a Hough line detector. I found a Java implementation for these algorithms from Tom Gibara's website and the Vision and Synthetic Environments Laboratory's web site.

The picture below on the left is the output of the Canny edge detector. The green lines on the right picture are the result of the Hough line detection.

The lines found on the picture above are actually the lines of the chessboard. But in some cases, the objects taken in the picture around the chessboard can bring some confusion. On the left picture, the chairs are introducing some lines that are not part of the board. To filter these lines out, I implemented an algorithm to filter 2 larger sets of lines with a 90-degree angle.

Once I got the 2 sets of 9 perpendicular lines, the program finds all the intersection points between these lines on the picture as shown on the picture on the left.

The program then finds the coordinates of each square that forms the chessboard.

At this point, I was able to isolate each square and process them separately. For example, the program is able to determine whether each square is white or black by calculating its average color and comparing it to the black and white colors. The results were correct except for one of the square because a piece of the opposite color was standing on it. Since the color of the squares of chessboard alternates, I could easily identify these errors.

What's next? I probably completed the easiest part of the project. I expect the chess piece recognition algorithm to be quite complex.

If you have a suggestion to help me finish this app, please leave a comment.

I am working on this project just for fun. If you are interested to see what are the real world applications of computer vision in the game industry, check out this web site: http://www.sportvision.com/.

Introduction to Metasploit and Armitage

2011-06-18T02:49:00.000+02:00

Today I had a great half-day training on Metasploit and Armitage organized by our local OWASP Austin chapter and hosted by Microsoft. What I learned today was so interesting that I can't resist to share it here.

Raphael Mudge - Designer of Armitage

Metasploit is an open source penetration testing framework. It contains a database of exploits, payloads and post modules. The goal of the training was to find an exploit on a remote machine, run a payload through this exploit and execute a post module (which is what you can do after taking control over the victim's machine). Of course, you can find more detail about it on wikipedia.

Metasploit is a command line tool. To make it easier (and funnier), Raphael Mudge designed Armitage, which is a user interface for Metasploit. Here is how it looks like:

Armitage - GUI for Metasploit

When a machine on the network is comprised, Armitage illustrates it as a monitor wrapped into thunder lights. Perfect for a hacker movie:D

Here are the materials we had for this training:

The training slides are available here
The exercises sheet is available at here
Metasploit - http://www.metasploit.com/download/
Metasploitable - http://blog.metasploit.com/2010/05/introducing-metasploitable.html
VM Ware player - http://www.vmware.com/

The youtube video below is the screen-cast of the exercises. I show how to setup the lab environment. Then I demonstrate how to use Armitage to find and use an exploit. The video ends with a demonstration of social engineering where the attacker takes full control over the victim's computer.

When I first started Armitage, it could not connect to the database. I had to kill all ruby processes and reconnect again.Once Armitage started, you may be asked to enter your IP address. If you dont you can always set it later by running the following command in the console; it will set a global variable.

setg LHOST 10.10.10.10

Here are some interesting resources for further reading:

offensive-security.com - online courses on Metasploit
pentest.cryptocity.net - online courses for Penetration Testing and Vulnerability Analysis currently taught at the Polytechnic Institute of New York University

Visualization of randomness

2011-06-01T02:58:00.000+02:00

As I was writing a function to generate random values, I realized it is hard to tell if the implemented function truly generates random values. A unit test can validate the length and the format of the generated values, but not its randomness.

To identify potential implementation flaws in my random generator, I developed the following tool.

Keep Last 100 Random Values Keep All Random Values

The chart above compares 2 random generators. It shows the frequency for each value generated. By default, the chart keeps the last 100 generated values. You can click on the radio button above the chart to keep track of all generated values.

What I expect to see from a bad random generator is an uneven distribution of the random values.

In the example above, I am comparing the 2 following JavaScript random generators. They both generate a random value from 0 to 9.

function randomGeneratorUsingFloor() { 
 return Math.floor( Math.random() * 10 ); 
}

function randomGeneratorUsingRound() { 
 return Math.round( Math.random() * 9 ); 
}

Can you spot what is wrong with the second implementation? The numbers 0 and 9 have a smaller chance to be generated compared to the other numbers. If this is not obvious on the chart above, select "Keep All Random Values", it should reveal the issue as shown in the picture below.

Math.random() generates a number between 0 and 1. The value generated is then multiplied. In the implementation using Math.floor(), all the values between 0 and 0.99.. will result as a 0. In the implementation using Math.round(), only the values between 0 and 0.49.. will result as a 0.

It appears that this is a common mistake as you can see it on Google Code Hosting and GitHub.

The test I put in place here is very basic. It exists some advanced work such as the Diehard tests. I also found a very creative randomness visualization on random-walk.com.

Why we need strong p4ssw0rds

2011-05-03T06:46:00.000+02:00

Back in February 2011, Rick Redman from Korelogic came to present his Supercharged Password Cracking Techniques at the Austin OWASP chapter monthly meeting.

With these techniques, he was able to crack large password database in a very short time using a tool called John The Ripper. In this article, I want to present what are these techniques and what we can do to secure our identities online.

In December 2010, the media group Gawker (Gizmodo.com, Lifehacker.com) was attacked and their 750,000-password database was stolen. The passwords were encrypted with the algorithm DES, but it did not prevent them from being cracked. More recently, the Sony's Playstation Network was also being attacked. More than 75 million passwords, emails, credit card numbers and other personal data have been compromised.

The top left shows the 250 most commonly used passwords from the Gawker database. I built this word cloud with wordle.net. On the right, it is an extract of the password dictionary used by John The Ripper. I built this with a JS library called stratus. If you are currently using one of these passwords for your bank account, you should probably change it quickly!

These decrypted real user passwords not only revealed what are the commonly used passwords but also showed that many people are using the same patterns to build their passwords. Knowing these patterns, it is possible to crack passwords in a much shorter time than using a basic brute force technique.

Here is how you can customize John The Ripper (JTR) to crack encrypted passwords. Please note that I am using an unofficial build of JTR available here. First, you need to create a file containing the passwords to crack. In our example, this file is called pwd2crack.txt and here is the file content:

user1:d0763edaa9d9bd2a9516280e9044d885
user2:a8e003b1180fd689f558657079d05f5a

The file contains the passwords for 2 users: user1 and user2. The passwords are hashed using the MD5 algorithm.

To run John The Ripper, you can use the following command:

>john --wordlist=password.lst --format=raw-MD5 pwd2crack.txt
Loaded 2 password hashes with no different salts (Raw MD5 [raw-md5 SSE2 16x4])
monkey           (user1)
guesses: 1  time: 0:00:00:00 100.00% (ETA: Mon May  2 22:42:22 2011)  c/s: 469428  trying: trinity - hallo

As you can see, JTR was able to crack user1's password almost instantly because "monkey" was in its list of passwords. But JTR was unable to crack user2's password. You can try the default command using the built-in logic to guess the passwords.

>john --format=raw-MD5 pwd2crack.txt
Loaded 2 password hashes with no different salts (Raw MD5 [raw-md5 SSE2 16x4])
Remaining 1 password hash
guesses: 0  time: 0:00:00:04 (3)  c/s: 195765  trying: 39of - 3ayo
guesses: 0  time: 0:00:00:15 (3)  c/s: 2965K  trying: beteng95 - betel197
guesses: 0  time: 0:00:00:43 (3)  c/s: 5430K  trying: swoji1x - swojsem
guesses: 0  time: 0:00:00:55 (3)  c/s: 5817K  trying: ahabh9 - ahabu2
guesses: 0  time: 0:00:01:08 (3)  c/s: 6052K  trying: luk12ay - luk11io
Session aborted

After running this command for a few minutes, my computer got really hot and JTR was still not able to crack user2's password. While JTR is running, press the space bar to print in the console the progress of the operation.

One of the common patterns for password is to add a date at the end of the password, especially the current year. You can configure JTR to use its password dictionary with "2011" at the end of each entry by adding the following to the file john.ini or john.conf.

[List.External:CustomWithYear2011]
void filter() {
 /* calculate word length */
 int length;
 length = 0;
 while (word[length]) length++;

 word[length] = '2';
 word[length+1] = '0';
 word[length+2] = '1';
 word[length+3] = '1';
 word[length+4] = 0;
}

This function, written in C, alters the password to hash before it is compared to the one in pwd2crack.txt. Then you can call JTR with this customization.

>john.exe --format=raw-MD5 --wordlist=password.lst --external=CustomWithYear2011 pwd2crack.txt
Loaded 2 password hashes with no different salts (Raw MD5 [raw-md5 SSE2 16x4])
Remaining 1 password hash
monkey2011       (user2)
guesses: 1  time: 0:00:00:00 100.00% (ETA: Mon May  2 22:06:09 2011)  c/s: 25600  trying: freedom2011 - barney2011

This time JTR was able to crack the second password: monkey2011.

You can get more details about these techniques on the Korelogic website.

Here are a few tips I would recommend:

The passwords protecting your most valuable accounts should not be shared with other website
Use password that are strong and easy to remember
If available, use 2-factor authentication (eg: Paypal, Google, World of Warcraft)

If you are responsible of a website, you can:

Raise your users awareness (password strength indicator, trainings)
Use a strong hash algorithm to store the passwords (BlowFish)
Integrate a second factor of authentication

Get in a hot air balloon ride with Google Street View and Maps API

2011-04-10T04:12:00.000+02:00

I have wanted to experiment the Google Maps API for a long time. So today I used it to create an animation replaying a hot air balloon trip I did in 2009 in Santa Rosa, California.

Before I got into the balloon, I started the Google MyTracks application on my phone. It records your GPS coordinates and altitude periodically. I used this data, Google Street View and Maps API to create the following animation.

It is fairly easy to start programming with this API. The Google Code Playground was a very useful resource of API examples. You can find the implementation details in the source code of this page. The following summarizes the main points of the implementation. The animation is in a DIV element:

The first thing I do in the script is to obtain a JS reference to this object:

  var mapDiv = document.getElementById("map-canvas");

Then I instantiate the StreetViewPanorama class with some GPS coordinates:

streetViewPanorama = new google.maps.StreetViewPanorama(
    mapDiv, {
        position: new google.maps.LatLng(
            latitude, 
            longitude,  
            pov: { /*pov stands for point of view*/
                heading:20, /*in degrees, relative to the north*/ 
                pitch:0,   
                zoom:4},
            /* hide all controls */  
            addressControl: false,  
            zoomControl: false,  
            scrollwheel: false,  
            panControl: false,  
            linksControl: false
    });

To update the point of view, I call the following method every few milliseconds.

streetViewPanorama.setPov({ heading:20, pitch:0, zoom:4 } );

After the hot air balloon takes off, the animation switches to Google Maps.

  var map = new google.maps.Map(mapDiv, {
    center: new google.maps.LatLng(latitude, longitude),
    zoom: 20 ,  
    mapTypeId: google.maps.MapTypeId.SATELLITE,  
    disableDefaultUI: true
  });

To move the map and simulate the balloon movement, I call the following methods with new coordinates:

map.panTo( new google.maps.LatLng(latitude, longitude ));
map.setZoom( newZoom );

The animation is quite shaky. I could actually get a better result using the Google Earth API, but this will be for a later post ;-)

Analyzing data from Twitter feeds

2011-04-05T07:36:00.000+02:00

On average 1 billion tweets are being posted per week. This gigantic amount of data represents a great opportunity to analyze live trends and opinions... if you can filter out the data you are looking for.

I attended a very interesting conference at SXSW that enticed me to try this out. The idea is to pull some data from social media websites (Twitter in this example) and analyze them.

I hacked a little program to download tweets, to store them in a database and to run some basic analysis on these data. It is using twitter4j and sqlite4java. The source code is available upon request.

My original plan was to download all tweets posted during the SXSW conference containing the word SXSW. Unfortunately, Twitter limits their search results to 1500 tweets per day, so I was not able to download them all. That's why I decided to narrow my search to all tweets posted during the time of the final keynote and at the Austin Convention Center using the GPS coordinates. With these new filters, I was able to retrieve 2600 tweets in 2 days.

First, I counted the numbers of occurrence for each word. After excluding all the common punctuations, prepositions, articles and numbers, I looked at the most common words used in these tweets:

The words that are tweeted the most are the users' location (i.e. Austin, Convention, Center), followed by the particulars of the keynote speaker-- Blake Mycoskie.

Only a few words are being tweeted repeatedly. Out of the 4840 words my program counted, 97% of them were used 20 times or less as you can see below.

The vocabulary diversity chart above demonstrates that the words occurring more than 20 times are representative of the tweeting trend at that time and place.

At this point, it was still very hard to determine what is the trend/opinion specific to the keynote. The program was still processing many tweets that are not related to the content of the keynote itself. So I decided to add another filter to select only the tweets that contain at least one of the following word: Blake, Mycoskie, TOMS or shoes. I also used a dictionary of the 5000 most commonly used words from the Princeton university to filter out the results.

With this new filters, the following words stood out:

great amazing giving story june 1for1

This may be a little simplistic but as a conclusion I would say that the attendees of the keynote speech:
- enjoyed the speech (great, amazing, story)
- understood the concept of TOMS business and were willing to share it (giving, 1for1)
- were excited to share the coming announcement on June 7th (june).

This post is the result of a few long nights of coding and analyzing. There are a lot more advanced works publicly available. You may be interested in the following links:

How to automate tasks in Photoshop with JavaScript

2011-03-29T06:58:00.000+02:00

I recently learned it is possible to control Adobe Photophop in JavaScript, so I tried it out! From this article, I hope you will learn how to get started with Photoshop scripting.

Photoshop is able to record your manual actions into a JavaScript. To enable this feature:

copy the file ScriptingListenerJS.8LI from C:\Program Files\Adobe\Adobe Photoshop CS5\Scripting\Utilities to C:\Program Files\Adobe\Adobe Photoshop CS5\Plug-ins\Automate
restart Photoshop
start manipulating Photoshop

A file ScriptingListenerJS.txt should be created on your Desktop. I opened an image and resized it, here is the script generated:

// =======================================================
var idOpn = charIDToTypeID( "Opn " );
    var desc1 = new ActionDescriptor();
    var idnull = charIDToTypeID( "null" );
    desc1.putPath( idnull, new File( "C:\\codebazaar\\3x3gifmaker\\input\\IMG_5032.JPG" ) );
executeAction( idOpn, desc1, DialogModes.NO );

// =======================================================
var idImgS = charIDToTypeID( "ImgS" );
    var desc2 = new ActionDescriptor();
    var idWdth = charIDToTypeID( "Wdth" );
    var idPxl = charIDToTypeID( "#Pxl" );
    desc2.putUnitDouble( idWdth, idPxl, 3000.000000 );
    var idscaleStyles = stringIDToTypeID( "scaleStyles" );
    desc2.putBoolean( idscaleStyles, true );
    var idCnsP = charIDToTypeID( "CnsP" );
    desc2.putBoolean( idCnsP, true );
    var idIntr = charIDToTypeID( "Intr" );
    var idIntp = charIDToTypeID( "Intp" );
    var idBcbc = charIDToTypeID( "Bcbc" );
    desc2.putEnumerated( idIntr, idIntp, idBcbc );
executeAction( idImgS, desc2, DialogModes.NO );

A script helps to automate repetitive tasks in Photoshop. You can use the generated code as a starting point to do so.

Adobe also offers an API. For example, I built a script executing the following operations:

ask the user to select a folder
open all the images present in the selected folder
resize all the images
copy/cut and paste all the images into different layers
build a GIF animation

The complete script is available for download here.

To run the script:

open Adobe Extended Toolkit
in the dropdown menu at the top left of the window, select Adobe Photoshop
in the menu, select File, then Open and select the script to execute
in the menu, select Debug, Run (or press F5)
Photoshop will ask to select a folder containing the images to process
then you can see Photoshop executing all the tasks coded in the script

This is a screenshot of Adobe Extended Toolkit. It allows you to set breakpoints, view the local variables as you are debugging and inspect the call stack

I did not find how to automatically set the time interval between each animation frame, so I manually had to do this step and save the animation (File, Save for Web & Device, Save).

The following image has been generated by the script.

The API allows to write a code that is more concise and easier to read than the code generated by Photoshop. In some cases I was not always able to find what method to use from the API to execute a specific action, so I recorded some of these actions and incorporated the generated code into my script.

Here are some web sites I found useful:

Also, if you don't get dizzy by looking at this animation, you can try this one made in HTML 5.

Monkey see, GreaseMonkey do!

2010-11-04T01:07:00.000+01:00

GreaseMonkey has been around for quite a while, but it is not known as much as it should! Originally, it started as a browser extension for Firefox but the userscripts are now natively supported in Chrome.

In this video tutorial, I will talk about:

What GreaseMonkey is
How I used it
Fews tips regarding the development of userscript

The userscript I use as example is available here: http://userscripts.org/scripts/show/87653. userscript.org hosts about 60,000 userscripts as I am writing this! You can search the best rated or the most downloaded userscripts. The nature of the scripts that are available on this website is very diverse. It ranges from providing cheats on popular Facebook games to enhancing the look of your everyday news website.

Two Factor Authentication without the Overhead of Traditional OTP

2010-09-03T04:09:00.000+02:00

My colleagues and I published a paper where we discussed our design of a two-factor authentication taylored to lower the cost without compromising the security.

Here is the abtract: "This paper describes a simple security architecture that supports two factor authentication for accessing Internet resources. Instead of utilizing the complex traditional OTP frameworks, which can be cumbersome to both deploy and use, we present a software architecture based on a shared knowledge between a token and a remote Internet resource; such as a web server. The confidentiality of this shared knowledge is protected by the smart card embedded in the token. The approach is explained in the context of initial token setup and a practical use-case for two factor online authentication. Despite its simplicity, this software optimization provides a comparable level of security for asserting the identity of users."

We presented it at the 13th IASTED International Conference on Software Engineering and Applications 2009 in Cambridge, MA. The full paper is also available on actapress.com, but it is not free :/

We are featured on the GWT blog!

2010-09-03T03:50:00.000+02:00

I met Patrick Chanezon, Google developer advocate, at the Google Hackathon in SXSW 2010. As a former engineer at Sun, he has a clear understanding of the world of smart card. I showed him my team's work, where we married GWT and smart cards in an innovative application.

Here is a video where Patrick interviewed me to talk about my company Gemalto, my team's work and explained how GWT helps us to meet our various project requirements.

In addition to the video, our team was invited to guest blog on the Google GWT blog to share more application design and programming tips.

Video tutorial for JNI

2010-08-22T23:37:00.000+02:00

JNI (Java Native Interface) allows the communication between a JAVA program and a native program (C, C++). The objective of this first blog post is to give you a quick introduction to this technology. Hopefully, after reading this post and watching the video, you should be able to:

set up your own environment with Eclipse and Visual Studio
create a program using JNI
debug while switching between JAVA and native code
avoid memory leaks
understand the risk of JVM crash

I used Eclipse and Microsoft Visual Studio for this demonstration. Eclipse is a popular development IDE for JAVA. You can download it for free on http://www.eclipse.org/. Visual Studio Express is the free version of Visual Studio and it is available here: http://www.microsoft.com/express/.

The example is using two classes Bean and JniExample. JniExample loads the native library (JniExampleLibrary.dll) and exposes the native methods implemented in the DLL. The bean is used to demonstrate how to exchange data through JNI.

We used javah.exe to generate the header file declaring the native methods in the DLL as defined in JniExample.java. The command line is:

javah -d C:\codebazaar\JniExample\cpp\JniExample codebazaar.example.JniExample

We also used javap.exe to generate the method signatures. The command line is:

javap -s codebazaar.example.JniExample

As your program may evolve, I recommend you to save these commands as external tools in eclipse.

To debug the library and the JAVA, in Visual Studio go to Debug, select Attach to Process, find javaw.exe and click on the Attach button.

As in any native code, you need to pay a special attention to memory leak. In the case of JNI, the JVM takes care of most of the job. Any instance passed to or returned by the DLL will be freed by the JVM. You need to free a buffer only if it has been allocated outside the JVM.

Finally, we demonstrated how to get the JVM crash... That was the easy part :D If you are considering communicating with a native library from your web application, you need to realize that a problem in the native library might take the whole server down. As this is not great in term of avaibility, you may consider running the native library on a separate web server.

I uploaded all the source code used. But you can view it directly from here:

package codebazaar.example;

public class Bean {
//public members
public String dataString; 
public byte[] dataByteArray;

public Bean() {}

//getters and setters
public String getDataString() {
return dataString;
}

public void setDataString(String dataString) {
this.dataString = dataString;
}

public byte[] getDataByteArray() {
return dataByteArray;
}

public void setDataByteArray(byte[] dataByteArray) {
this.dataByteArray = dataByteArray;
} 

@Override
public String toString(){
String ret = "string = " + dataString;

ret += " / byteArray =";
if ( dataByteArray != null ) {
for ( byte b : dataByteArray) {
ret += " " + b;
}
}

return  ret; 
}
}

package codebazaar.example;

public class JniExample {
static {
System.loadLibrary("JniExampleLibrary");
}

// native methods
/**
* this method calls printSomething
*/
public native void callJavaMethod();

/**
* this method creates an instance of Bean and returns it
*/
public native Bean createAndReturnBean();

/**
* this method takes an instance of Bean as parameter and changes the value of its members
*/
public native void modifyBean(Bean bean);

/**
* this method will the JVM when invoked 
*/
public native void crashTheJvm();

public void printSomething() {
System.out.println("Thanks for watching this video");
}

public void runExample1() {
System.out.println("starting runExample1...");
callJavaMethod();
}

public void runExample2() {
System.out.println("starting runExample2...");

Bean bean = createAndReturnBean();
System.out.println("returned= " + bean.toString());
}

public void runExample3() {
System.out.println("starting runExample3...");

Bean bean = new Bean();
bean.setDataString("hello");

byte[] byteArray = new byte[] { 0x01, 0x02, 0x03 };
bean.setDataByteArray(byteArray);

System.out.println("before: " + bean.toString());
modifyBean(bean);
System.out.println("after: " + bean.toString());
}

public void runExample4() {
System.out.println("starting runExample4...");
crashTheJvm();
}
}

package codebazaar.example;

public class Main {

/**
* @param args
*/
public static void main(String[] args) {
System.out.println("Starting JavaMain...");

JniExample jniExample = new JniExample();
jniExample.runExample1();
jniExample.runExample2();
jniExample.runExample3();
jniExample.runExample4();
}

}

/* DO NOT EDIT THIS FILE - it is machine generated */
#include 
/* Header for class codebazaar_example_JniExample */

#ifndef _Included_codebazaar_example_JniExample
#define _Included_codebazaar_example_JniExample
#ifdef __cplusplus
extern "C" {
#endif
/*
* Class:     codebazaar_example_JniExample
* Method:    callJavaMethod
* Signature: ()V
*/
JNIEXPORT void JNICALL Java_codebazaar_example_JniExample_callJavaMethod
(JNIEnv *, jobject);

/*
* Class:     codebazaar_example_JniExample
* Method:    createAndReturnBean
* Signature: ()Lcodebazaar/example/Bean;
*/
JNIEXPORT jobject JNICALL Java_codebazaar_example_JniExample_createAndReturnBean
(JNIEnv *, jobject);

/*
* Class:     codebazaar_example_JniExample
* Method:    modifyBean
* Signature: (Lcodebazaar/example/Bean;)V
*/
JNIEXPORT void JNICALL Java_codebazaar_example_JniExample_modifyBean
(JNIEnv *, jobject, jobject);

/*
* Class:     codebazaar_example_JniExample
* Method:    crashTheJvm
* Signature: ()V
*/
JNIEXPORT void JNICALL Java_codebazaar_example_JniExample_crashTheJvm
(JNIEnv *, jobject);

#ifdef __cplusplus
}
#endif
#endif

#include "codebazaar_example_JniExample.h"
#include 

JNIEXPORT void JNICALL Java_codebazaar_example_JniExample_callJavaMethod (JNIEnv * env, jobject obj) {
jclass jniExampleCls = env->GetObjectClass(obj);

jmethodID mid = env->GetMethodID(jniExampleCls, "printSomething", "()V");

env->CallVoidMethod(obj, mid);
}

JNIEXPORT jobject JNICALL Java_codebazaar_example_JniExample_createAndReturnBean  (JNIEnv *env, jobject obj) {
jclass beanClass = env->FindClass("codebazaar/example/Bean");
jmethodID constructorMethodId = env->GetMethodID(beanClass, "", "()V"); 
jobject bean = env->NewObject(beanClass, constructorMethodId);

jstring newString = env->NewStringUTF("this bean has been created in Java_codebazaar_example_JniExample_createAndReturnBean");

jmethodID setStringMid = env->GetMethodID(beanClass, "setDataString", "(Ljava/lang/String;)V");

env->CallVoidMethod(bean, setStringMid, newString );

return bean;
}

JNIEXPORT void JNICALL Java_codebazaar_example_JniExample_modifyBean  (JNIEnv *env, jobject obj, jobject bean) {
jclass beanCls = env->GetObjectClass(bean);

jmethodID setStringMid = env->GetMethodID(beanCls, "setDataString", "(Ljava/lang/String;)V");

// set the bean member "dataString"
jstring newString = env->NewStringUTF("world");
env->CallVoidMethod(bean, setStringMid, newString );

// set the bean member "dataByteArray"
jbyteArray newByteArray = env->NewByteArray(5);
jbyte buffer[5] = {5,4,3,2,1};
env->SetByteArrayRegion( newByteArray, 0, 5, buffer);

jmethodID setByteArrayMid = env->GetMethodID(beanCls, "setDataByteArray", "([B)V");

env->CallVoidMethod(bean, setByteArrayMid, newByteArray );
}


JNIEXPORT void JNICALL Java_codebazaar_example_JniExample_crashTheJvm (JNIEnv *env, jobject obj) {
//stack overflow - http://en.wikipedia.org/wiki/Stack_overflow
double x[1000000];
}

UPDATE 04/02/11:
If you encounter the following error:

java.lang.UnsatisfiedLinkError: ${path here}/library.dll: This application has failed to start because the application configuration is incorrect. Reinstalling the application may fix this problem

I would recommend you to use Dependency Walker to verify your DLL can find all its dependencies. If you are missing msvcr90.dll, you may be missing the Microsoft Redistributable Merge Modules.