New answers tagged

0

Not a vulnerability list by itself, but SEI CERT C Coding Standard lists many “dangerous” code patterns which can be a source of vulnerabilities. The book The Art of Software Security Assessment is a little old by now but still contains a lot of valuable advice.


0

These CWE lists will help you a lot: Weaknesses in software written in C Weaknesses in software written in C++


2

I would assemble the code and then analyze it using emulation. Example assembly taken from the link: mov rax, QWORD PTR [rbp-16] ; Move i (=9) to RAX movabs rdx, -3689348814741910323 ; Move some magic number to RDX (?) mul rdx ; Multiply 9 by magic number mov rax, rdx ; Take only the upper 64 bits of ...


1

As part of ASLR, operating systems use code relocation tables embedded in an executable to change the location where an executable image is located. If you remove the relocation tables (or generate an executable without it to begin with) the operating system will not be able to relocate the executable image, however other images also loaded to the same ...


-1

I guess newByte[two.length + 1] = 1; look like iterate some value in variable two


0

You can identify if a function is protected by the presence of __stack_chk_fail. It doesn't matter if it's user-custom code or it is statically compiled from libraries. gets is a very problematic function by design. It's impossible to protect it from buffer overflows For example: int main() { char buf[2000]; gets(buf); } In this case, the stack ...


0

The answer of @igor says about algorithm failures of IDA. Beside, I think you can use a function which is not type-able in the type system of the decompilation target language of IDA (I believe it's a subset of C), e.g. int foo(void *f, int i) { return ((int (*)(void*, int))(f))(foo, i); } clang -c test.c then IDA decompilers gives something likes ...


1

You can check "graceful failures" for some common problems that can prevent decompilation and try to induce them deliberately. However, most of them can be worked around with a bit of effort so don’t expect them to stop a motivated person.


Top 50 recent answers are included