Collaborate Disseminate
What do Heartbleed, WannaCry, and million dollar iPhone bugs have in common? Continue reading The Internet Has a Huge C/C++ Problem and Developers Don’t Want to Deal With It
I’ve got this simple code
vuln.c
#include <stdio.h>
#include <string.h>
int main(int argc, char** argv)
{
char buffer[500];
strcpy(buffer, argv[1]);
printf(“%s”, buffer);
return 0;
}
I am trying to perform … Continue reading How does this simple buffer overflow work?
If C uses shared libraries, is it possible to write a program that will modify the fopen function to execute a malicious code? How can the OS protect the user from this?
Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate how privileged escalation w… Continue reading Privilege Escalation: C functions setuid(0) with system() not working in Linux
I’m trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__(“movl %esp, %eax”), I put the address and shellcode in the buffer.
Does a custom library affected by a buffer overflow need to be compiled with protections even if it is linked against an executable which already has protections?
Continue reading Buffer Overflow protections in custom library
I have written my own encrypting software. By XOR I encrypt the password to its end amount to not let there be a off by one calculation for the password, and then I XOR each letter after that. So my thinking is, no one charac… Continue reading Peer Review for Encryption Design [on hold]
I want to use libsodium library with cooja in order to use the hash function for skymotes. I have tried to link it but every time I get error sodium.h no such file or directory.
Continue reading How to link crypto libraries with COOJA [on hold]
I have two pieces of code snips, which should be investigated on fulfilling the constant-time requirement. If it is not fulfilled, the code should be revised.
First:
unit8_t a[128]
unit8_t data[128]
if(k) //k is a secret … Continue reading Constant-time code
I have a dll file signed with my private key, here is the signature info in Windows Explorer:
Now, using the public key found in the certificate, how can I verify the integrity of the file?
I am shipping the exe to the client and nee… Continue reading How to programatically verify a file signature?