import com.sun.jna.Memory;
import com.sun.jna.platform.win32.Crypt32Util;
import com.sun.jna.platform.win32.WinCrypt;

import java.lang.ref.WeakReference;
import java.lang.reflect.Field;
import java.util.Arrays;

public class JNACryptProtectDataSecurityIssue {
	public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, ClassNotFoundException {
		Field fldMemory_HEAD = Memory.class.getDeclaredField("HEAD");
		fldMemory_HEAD.setAccessible(true);
		Field fldLinkedReference_next = Class.forName("com.sun.jna.Memory$LinkedReference").getDeclaredField("next");
		fldLinkedReference_next.setAccessible(true);
		Field fldLinkedReference_prev = Class.forName("com.sun.jna.Memory$LinkedReference").getDeclaredField("prev");
		fldLinkedReference_prev.setAccessible(true);
		System.out.println("-----");
		byte[] data = new byte[] { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, };
		byte[] encrypted = Crypt32Util.cryptProtectData(data, WinCrypt.CRYPTPROTECT_UI_FORBIDDEN);
		byte[] decrypted = Crypt32Util.cryptUnprotectData(encrypted, WinCrypt.CRYPTPROTECT_UI_FORBIDDEN);
		System.out.println("-----");
		{
			Object head = fldMemory_HEAD.get(null);
			Object next = head;
			do {
				Object curr = next;
				Memory memory = (Memory) ((WeakReference<?>) curr).get();
				byte[] array = memory.getByteArray(0, (int) memory.size());
				if (Arrays.equals(array, encrypted)) {
					System.out.println("!!! encrypted data found !!!");
				}
				if (Arrays.equals(array, data)) {
					System.out.println("!!! decrypted data found !!!");
				}
				next = fldLinkedReference_next.get(curr);
			} while (next != null);
		}
		System.out.println("-----");
	}
}

-----
-----
-----

-----
-----
!!! encrypted data found !!!
!!! decrypted data found !!!
-----