Collaborate Disseminate
Source control is often the first step when starting a new project (or it should be, we’d hope!). Breaking changes down into smaller chunks and managing the changes between them makes it easier to share work between developers and to catch and revert mistakes after they happen. As project complexity …read more
Continue reading Tracking Binary Changes: Learn the DIFF-erent Ways of the ELF
[Tim Schumacher] got a Crazepony Mini quadcopter and has been reprogramming it “bare metal” — that is to say he’s programming the STM32 without using an operating system or do-it-all environment. His post on the subject is a good reference for working with the STM32 and the quadcopter, too.
If …read more
Let’s be honest, no one likes to see their program crash. It’s a clear sign that something is wrong with our code, and that’s a truth we don’t like to see. We try our best to avoid such a situation, and we’ve seen how compiler warnings and other static code analysis tools can help us to detect and prevent possible flaws in our code, which could otherwise lead to its demise. But what if I told you that crashing your program is actually a great way to improve its overall quality? Now, this obviously sounds a bit counterintuitive, after all …read more
Continue reading Crash your code – Lessons Learned From Debugging Things That Should Never Happen™
I found many vulnerabilities but almost all of them require gcc which is not available on most of my target machines.
I was wondering if it’s possible to run dirtycow without gcc installed or what is the alternative to do it… Continue reading dirtycow exploit without gcc
A little while back, we were talking about utilizing compiler warnings as first step to make our C code less error-prone and increase its general stability and quality. We know now that the C compiler itself can help us here, but we also saw that there’s a limit to it. While it warns us about the most obvious mistakes and suspicious code constructs, it will leave us hanging when things get a bit more complex.
But once again, that doesn’t mean compiler warnings are useless, we simply need to see them for what they are: a first step. So today …read more
Continue reading Warnings On Steroids – Static Code Analysis Tools
If there’s one thing C is known and (in)famous for, it’s the ease of shooting yourself in the foot with it. And there’s indeed no denying that the freedom C offers comes with the price of making it our own responsibility to tame and keep the language under control. On the bright side, since the language’s flaws are so well known, we have a wide selection of tools available that help us to eliminate the most common problems and blunders that could come back to bite us further down the road. The catch is, we have to really want it …read more
Continue reading Warnings Are Your Friend – A Code Quality Primer
As far as I remember,
most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more).
Did the situation improve with Debian Squeeze or the upcoming Debian Buster ?
By comparison, … Continue reading the state of ASLR, PIE, SSP on Debian in 2018?
Shared libraries are our best friends to extend the functionality of C programs without reinventing the wheel. They offer a collection of exported functions, variables, and other symbols that we can use inside our own program as if the content of the shared library was a direct part of our code. The usual way to use such libraries is to simply link against them at compile time, and let the linker resolve all external symbols and make sure everything is in place when creating our executable file. Whenever we then run our executable, the loader, a part of the operating …read more
Continue reading It’s All In The Libs – Building A Plugin System Using Dynamic Loading
I am learning Buffer Overflow, so the question might seem silly but here it is.
I started with this very simple buggy program
int main(int argc, char *argv[])
{
char buf[128];
printf(“You entered value %s\n”, argv[1]);
strcpy(buf,ar… Continue reading Unable to understand $EIP changes with Buffer Overflow
When we compile c program with gcc, we have to inlude “-z execstack” option to enable stack overflow attack.
The question I want to ask is how does gcc implement this .
Without this option, how does gcc guard the stack?
Plea… Continue reading How does gcc compiler guard stack for stack overflow?