Questions tagged [compiler]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
71 views

Can I get viruses from compiling C# code?

I have found a tool that requires me to compile it with Visual Studio. I am not sure if I can do it without the risk of malicious software being installed during the compiling process. Is that ...
user avatar
  • 11
1 vote
0 answers
87 views

Compiler that adds machine info to binary

Wanted to ask if there is any compiler (any known programming language) that is actually encoding machine data into binary, so it is possible to detect the machine where the program has been compiled (...
user avatar
2 votes
1 answer
187 views

How do I compare the safety of a compiled program with optimization flag?

I would like to know how I can know which is the safest compilation line, that is: Having several compilation lines in, for example, GCC, how do I know which one is more secure? Hardening would be a ...
user avatar
  • 21
2 votes
1 answer
134 views

Does recompiling a binary from source code make it more secure/obscure?

Using standard hardening options like PIC, Stack Protection ... does a mere recompilation make a program more secure against attacks? You have the source code of a program, compile it two times with ...
user avatar
1 vote
1 answer
111 views

Are reproducible builds practically possible on major app stores?

'Reproducible builds' ensure that a published app matches the published open source code. This answer gives some great information on it. But numerous sources1,2 indicate reproducible builds are very ...
user avatar
  • 1,224
2 votes
0 answers
125 views

Compiler-induced information leaks/side-channels in cryptography implementations

In Cryptography Engineering Ferguson, Schneier and Kohno put a big emphasis on quality of code in order to prevent it from leaking information and from being vulnerable to memory corruption exploits. ...
user avatar
1 vote
1 answer
96 views

Build and execute code on a sandboxed environment?

Numerous websites allow us to build and execute C code from web browsers (repl.it, onlinegdb.com, ideone.com...). For my own application (education purposes) I would like to do the same on my web ...
user avatar
  • 347
1 vote
1 answer
181 views

What evidence does a compiled file leave behind?

I was wondering when people compile malware and use the compiled files for engagements or nefarious purposes, what evidence do they leave behind in the compiled Windows executables? I have heard that ...
user avatar
2 votes
1 answer
3k views

Program compiled with mingw32 is reported as infected

I'm using a Linux system and cross-compiling to Win32. The most trivial Windows source code ("Hello world" by Petzold), when compiled using i686-w64-mingw32-gcc (gcc version 7.3-win32 20180312), ...
user avatar
2 votes
2 answers
141 views

Does removing features from a library increase or reduce security risks?

Software libraries targetting resource constrained environments like embedded systems use conditional compilation to allow consumers to shave space and thus increase performance by removing unused ...
user avatar
  • 113
1 vote
1 answer
524 views

Are compilers safe?

I was wondering about how compilers like GCC compile themselves after each release but that got me thinking: Are compilers safe? Correct me if I'm wrong, but even if at one step along the way a ...
user avatar
  • 113
1 vote
1 answer
327 views

Avast antivirus virus alarm while programming [closed]

I was programming a function pointer in C on CodeBlocks. When I compiled and ran it, Avast showed an alert message and quarantined the .exe. Is there a solution? Or do I need to disable Avast while ...
user avatar
3 votes
1 answer
432 views

How is compiling a program from source more secure?

When downloading compiled binaries for programs it is very important to check GPG signatures, Authenticode, hashes, etc. However, I often see people who say that compiling the code from source is the ...
user avatar
4 votes
1 answer
3k views

Compiling with GCC retpoline flags

As of version 8 (later backported to 7.3), GCC has added retpoline support [0]. While I understand that it is intended[citation needed] for use in kernel patching for Spectre (ie: [1][2]), that does ...
user avatar
  • 361
0 votes
1 answer
141 views

Compiler Parameters to isolate a C++ program

Is there any set of compiler parameters that can be used to prevent a C++ program from having any access to most system functions, leaving it with access to read/write to stdin/stdout, but otherwise ...
user avatar
5 votes
1 answer
1k views

How does GCC's -mmitigate-rop work?

GCC 6 has a flag, -mmitigate-rop, which compiles binaries in a way that reduces the number gadgets exploitable by ROP. The GCC documentation explaining this feature is minimal: -mmitigate-rop Try ...
user avatar
  • 64k
2 votes
1 answer
3k views

Does Java anti-decompiler software really work as claimed?

BIS Guard's Java Antidecompiler is an application that you can purchase that claims: Java Antidecompiler protects java byte-code against decompilers, any binary viewers/editors, prevents reverse ...
user avatar
  • 33
0 votes
1 answer
150 views

Building software safely for malware-free distribution

I wrote a program. I want to publish a compiled executable for downloading by the public. How can I compile and distribute it without contact with my (presumably insecure and infected) operating ...
user avatar
0 votes
2 answers
191 views

What are the security trade-offs of using reproducible builds?

From reproducible-builds.org: Reproducible builds are a set of software development practices that create a verifiable path from human readable source code to the binary code used by computers. In ...
user avatar
0 votes
1 answer
194 views

Lynis Indicates Compilers

On a droplet, when Lynis reports that compilers have been found, I've been unable to determine which compilers it means exactly. I'd like to remove these. How can I? There is another thread, but the "...
user avatar
  • 144
2 votes
2 answers
724 views

Should programs check for symlinks before creating files?

We received a bug report (phrased as a security issue) for a program, which stated that when the program creates files on disk, it does not first verify if a symbolic link exists at the file path to ...
user avatar
1 vote
1 answer
132 views

Extreme buffer size consequences

What are the consequences of allocating and then populating an extremely large buffer in C? Can a stack have a maximum size and if so what are the security mechanisms that enforce this.
user avatar
  • 131
0 votes
1 answer
215 views

Are Optimization Flags Harmful?

There seems to be a consensus, that -D_FORTIFY_SOURCE=2 -O1 is a hardening measure that should be applied as compiler option. This was also a recommendation in the Dovecot Pentest Report. What I'm ...
user avatar
40 votes
3 answers
6k views

What security measure one should implement before executing user uploaded files?

I want to make a little programming puzzle on my website. There's going to be a task. The user will be asked to upload a C++ source file with their solution. The file should be compiled, run with some ...
user avatar
  • 503
-2 votes
1 answer
766 views

How to secure batch script with compiler (not compressor) in Windows?

Batch script, a.k.a. bat or cmd, is good - easy to learn, easy to code, easy to use, easy to distrubute. However it lets coders down when they need to achieve something complex in batch script. The ...
user avatar
  • 103
2 votes
5 answers
6k views

How do I harden compilers (as suggested by Lynis)?

This article suggests to restrict compilers to root, but does not say how, and I couldn't find anything useful by searching the Web. ii g++ 4:5.3.1-1ubuntu1 ...
user avatar
  • 1,721
5 votes
4 answers
2k views

Should I compile as root?

When I am compiling software for local installation, what factors should I take into consideration when deciding whether to compile as root or to compile under my regular user account? ./configure ...
user avatar
2 votes
0 answers
154 views

Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)

I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry). The developer documentation says that JDK 7 is needed, however there are ...
user avatar
8 votes
1 answer
643 views

Are there any type safe languages with deterministic compilers?

This article about BIND9 concludes with the statement: The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in this ...
user avatar
1 vote
2 answers
181 views

Can pre-compiled binaries be different than if someone builds from source himself?

Given that I have an "acceptable" source code of some program (Tor was mentioned in a previous version of this question), where "acceptable" means that I trust this source code and want to use it for ...
user avatar
  • 1,843
7 votes
2 answers
2k views

How do compilers detect buffer overflow?

I just started researching about security at the systems level and challenges, especially with respect to low level languages such as C/C++ and Objective-C. I have understood buffer overflow and how ...
user avatar
4 votes
2 answers
697 views

Are compiler options relevant to C# security? If so, which options?

It is normal to list some extra-secure compiler options to prevent attacks on C and C++. However, I have not found any similar recommendations for C#. Are compiler options simply not relevant to C# ...
user avatar
  • 2,010
79 votes
10 answers
18k views

Would it be good secure programming practice to overwrite a "sensitive" variable before deleting it?

Is it good secure programming practice to overwrite sensitive data stored in a variable before it is deleted (or goes out of scope)? My thought is that it would prevent a hacker from being able to ...
user avatar
  • 3,147
3 votes
1 answer
167 views

code optimization and security?

My background is in compilers/code optimization, and I'm wondering whether there might be any interesting applications of extremely aggressive runtime code specialization towards improving security ...
user avatar
  • 133
-1 votes
1 answer
3k views

Compilation Error "fatal error: openssl rc4.h: No such file or directory" [closed]

I am trying to compile the following exploit http://pastebin.com/pxy4GiFQ to use it against one of my lab machines. I am trying to compile it inside KALI machine and get the following error: root@...
user avatar
1 vote
1 answer
4k views

Exploit Compilation Problem [closed]

I am trying to compile the following exploit: http://www.exploit-db.com/exploits/10613/ But get the following error: local.c:12:22: fatal error: asm/page.h: No such file or directory compilation ...
user avatar
0 votes
1 answer
114 views

What's the point of storing an copy of args? (the /gs flag)

When you add the /gs argument to microsoft's compiler, it would place a copy of args below the buffer variable. So, what's the point of keeping a copy of arg?
user avatar
  • 1,675
7 votes
2 answers
2k views

In Visual Studio, what are the risks of simply opening an untrusted project? What are the mitigations?

I'm looking at the source code of some potentially hostile code. As usual, VS 2012 is giving me the security warning: "You should only open projects from a trustworthy source" ... "ask me for every ...
user avatar