Questions tagged [compiler]
The compiler tag has no usage guidance.
43
questions
1
vote
0
answers
44
views
How can I jump to an address after executing a donut shellcode?
I'm looking to execute a shellcode by packaging it inside an executable.
I generate an executable (open the calculator)
I output a shellcode from the executable with donut.
donut.exe -i opencalc.exe ...
- 11
2
votes
1
answer
412
views
Is there a secure way to embed a private key in compiled code that is released in compiled form to the general public?
It occurred to me that if I could compile a private key in source code, I could prove that log information came exclusively from the application for a given version.
I could do this by releasing the ...
- 123
1
vote
1
answer
104
views
Is switching my C/C++ compiler for security testing generally reliable?
If I am shipping a program to my customers which is compiled with GCC, but I want to test the security of the program using Clang, is this generally okay, or will I miss certain security bugs because ...
- 1,189
1
vote
1
answer
278
views
Vulnerabilities in Build-time Libraries Could be a Security Threat
If a dependency that is used in development environment or at build time has a security vulnerability, could it cause a security threat for the application? I'm looking for an example to understand ...
- 121
1
vote
1
answer
454
views
Can I get viruses from compiling C# code?
I have found a tool that requires me to compile it with Visual Studio. I am not sure if I can do it without the risk of malicious software being installed during the compiling process. Is that ...
- 11
1
vote
0
answers
132
views
Compiler that adds machine info to binary
Wanted to ask if there is any compiler (any known programming language) that is actually encoding machine data into binary, so it is possible to detect the machine where the program has been compiled (...
- 119
2
votes
1
answer
322
views
How do I compare the safety of a compiled program with optimization flag?
I would like to know how I can know which is the safest compilation line, that is:
Having several compilation lines in, for example, GCC, how do I know which one is more secure? Hardening would be a ...
- 21
2
votes
1
answer
388
views
Does recompiling a binary from source code make it more secure/obscure?
Using standard hardening options like PIC, Stack Protection ...
does a mere recompilation make a program more secure against attacks?
You have the source code of a program, compile it two times with ...
- 21
5
votes
2
answers
377
views
Are reproducible builds practically possible on major app stores?
'Reproducible builds' ensure that a published app matches the published open source code. This answer gives some great information on it.
But numerous sources1,2 indicate reproducible builds are very ...
- 1,320
3
votes
0
answers
190
views
Compiler-induced information leaks/side-channels in cryptography implementations
In Cryptography Engineering Ferguson, Schneier and Kohno put a big emphasis on quality of code in order to prevent it from leaking information and from being vulnerable to memory corruption exploits.
...
- 454
1
vote
1
answer
207
views
Build and execute code on a sandboxed environment?
Numerous websites allow us to build and execute C code from web browsers (repl.it, onlinegdb.com, ideone.com...). For my own application (education purposes) I would like to do the same on my web ...
- 367
1
vote
1
answer
287
views
What evidence does a compiled file leave behind?
I was wondering when people compile malware and use the compiled files for engagements or nefarious purposes, what evidence do they leave behind in the compiled Windows executables? I have heard that ...
- 992
2
votes
1
answer
5k
views
Program compiled with mingw32 is reported as infected
I'm using a Linux system and cross-compiling to Win32. The most trivial Windows source code ("Hello world" by Petzold), when compiled using i686-w64-mingw32-gcc (gcc version 7.3-win32 20180312), ...
- 21
2
votes
2
answers
182
views
Does removing features from a library increase or reduce security risks?
Software libraries targetting resource constrained environments like embedded systems use conditional compilation to allow consumers to shave space and thus increase performance by removing unused ...
- 113
1
vote
1
answer
1k
views
Are compilers safe?
I was wondering about how compilers like GCC compile themselves after each release but that got me thinking:
Are compilers safe?
Correct me if I'm wrong, but even if at one step along the way a ...
- 113
1
vote
1
answer
595
views
Avast antivirus virus alarm while programming [closed]
I was programming a function pointer in C on CodeBlocks. When I compiled and ran it, Avast showed an alert message and quarantined the .exe.
Is there a solution? Or do I need to disable Avast while ...
- 11
3
votes
1
answer
798
views
How is compiling a program from source more secure?
When downloading compiled binaries for programs it is very important to check GPG signatures, Authenticode, hashes, etc.
However, I often see people who say that compiling the code from source is the ...
- 193
5
votes
1
answer
4k
views
Compiling with GCC retpoline flags
As of version 8 (later backported to 7.3), GCC has added retpoline support [0]. While I understand that it is intended[citation needed] for use in kernel patching for Spectre (ie: [1][2]), that does ...
- 373
0
votes
1
answer
245
views
Compiler Parameters to isolate a C++ program
Is there any set of compiler parameters that can be used to prevent a C++ program from having any access to most system functions, leaving it with access to read/write to stdin/stdout, but otherwise ...
- 544
5
votes
1
answer
1k
views
How does GCC's -mmitigate-rop work?
GCC 6 has a flag, -mmitigate-rop, which compiles binaries in a way that reduces the number gadgets exploitable by ROP. The GCC documentation explaining this feature is minimal:
-mmitigate-rop
Try ...
- 67.1k
2
votes
1
answer
4k
views
Does Java anti-decompiler software really work as claimed?
BIS Guard's Java Antidecompiler is an application that you can purchase that claims:
Java Antidecompiler protects java byte-code against decompilers, any binary viewers/editors, prevents reverse ...
- 33
0
votes
1
answer
188
views
Building software safely for malware-free distribution
I wrote a program. I want to publish a compiled executable for downloading by the public.
How can I compile and distribute it without contact with my (presumably insecure and infected) operating ...
- 103
1
vote
2
answers
269
views
What are the security trade-offs of using reproducible builds?
From reproducible-builds.org:
Reproducible builds are a set of software development practices that create a verifiable path from human readable source code to the binary code used by computers.
In ...
- 1,094
0
votes
1
answer
302
views
Lynis Indicates Compilers
On a droplet, when Lynis reports that compilers have been found, I've been unable to determine which compilers it means exactly. I'd like to remove these. How can I?
There is another thread, but the "...
- 144
2
votes
2
answers
1k
views
Should programs check for symlinks before creating files?
We received a bug report (phrased as a security issue) for a program, which stated that when the program creates files on disk, it does not first verify if a symbolic link exists at the file path to ...
1
vote
1
answer
202
views
Extreme buffer size consequences
What are the consequences of allocating and then populating an extremely large buffer in C? Can a stack have a maximum size and if so what are the security mechanisms that enforce this.
- 131
0
votes
1
answer
271
views
Are Optimization Flags Harmful?
There seems to be a consensus, that
-D_FORTIFY_SOURCE=2 -O1
is a hardening measure that should be applied as compiler option. This was also a recommendation in the Dovecot Pentest Report.
What I'm ...
- 963
40
votes
3
answers
6k
views
What security measure one should implement before executing user uploaded files?
I want to make a little programming puzzle on my website. There's going to be a task. The user will be asked to upload a C++ source file with their solution. The file should be compiled, run with some ...
- 503
-2
votes
1
answer
1k
views
How to secure batch script with compiler (not compressor) in Windows?
Batch script, a.k.a. bat or cmd, is good - easy to learn, easy to code, easy to use, easy to distrubute. However it lets coders down when they need to achieve something complex in batch script. The ...
- 103
2
votes
5
answers
8k
views
How do I harden compilers (as suggested by Lynis)?
This article suggests to restrict compilers to root, but does not say how, and I couldn't find anything useful by searching the Web.
ii g++ 4:5.3.1-1ubuntu1 ...
- 1,811
5
votes
4
answers
3k
views
Should I compile as root?
When I am compiling software for local installation, what factors should I take into consideration when deciding whether to compile as root or to compile under my regular user account?
./configure
...
- 303
2
votes
0
answers
180
views
Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)
I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry).
The developer documentation says that JDK 7 is needed, however there are ...
- 51k
9
votes
1
answer
723
views
Are there any type safe languages with deterministic compilers?
This article about BIND9 concludes with the statement:
The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in this ...
- 51k
1
vote
2
answers
210
views
Can pre-compiled binaries be different than if someone builds from source himself?
Given that I have an "acceptable" source code of some program (Tor was mentioned in a previous version of this question), where "acceptable" means that I trust this source code and want to use it for ...
- 1,843
7
votes
2
answers
3k
views
How do compilers detect buffer overflow?
I just started researching about security at the systems level and challenges, especially with respect to low level languages such as C/C++ and Objective-C. I have understood buffer overflow and how ...
- 315
4
votes
2
answers
850
views
Are compiler options relevant to C# security? If so, which options?
It is normal to list some extra-secure compiler options to prevent attacks on C and C++. However, I have not found any similar recommendations for C#. Are compiler options simply not relevant to C# ...
- 2,040
81
votes
10
answers
19k
views
Would it be good secure programming practice to overwrite a "sensitive" variable before deleting it?
Is it good secure programming practice to overwrite sensitive data stored in a variable before it is deleted (or goes out of scope)? My thought is that it would prevent a hacker from being able to ...
- 3,185
3
votes
1
answer
205
views
code optimization and security?
My background is in compilers/code optimization, and I'm wondering whether there might be any interesting applications of extremely aggressive runtime code specialization towards improving security ...
- 133
-1
votes
1
answer
4k
views
Compilation Error "fatal error: openssl rc4.h: No such file or directory" [closed]
I am trying to compile the following exploit http://pastebin.com/pxy4GiFQ to use it against one of my lab machines.
I am trying to compile it inside KALI machine and get the following error:
root@...
- 751
1
vote
1
answer
4k
views
Exploit Compilation Problem [closed]
I am trying to compile the following exploit:
http://www.exploit-db.com/exploits/10613/
But get the following error:
local.c:12:22: fatal error: asm/page.h: No such file or directory
compilation ...
- 751
0
votes
1
answer
138
views
What's the point of storing an copy of args? (the /gs flag)
When you add the /gs argument to microsoft's compiler, it would place a copy of args below the buffer variable.
So, what's the point of keeping a copy of arg?
- 2,077
7
votes
2
answers
2k
views
In Visual Studio, what are the risks of simply opening an untrusted project? What are the mitigations?
I'm looking at the source code of some potentially hostile code. As usual, VS 2012 is giving me the security warning: "You should only open projects from a trustworthy source" ... "ask me for every ...
- 51k
3
votes
2
answers
887
views
Are .NET project GUID's visible when compiling?
I know if a person has a GUID from a machine that person can figure out if other guid belongs to that machine.
In a .NET project (csproj and the visual studions solution file) GUIDs are generated. If ...
user5575