Dynamic code analysis tools
|
|
|
- Carmella Warner
- 6 years ago
- Views:
Transcription
1 Dynamic code analysis tools Stewart Martin-Haugh (STFC RAL) Berkeley Software Technical Interchange meeting Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 1 / 16
2 Overview Introduction Sanitizer tools AddressSanitizer UndefinedBehaviorSanitizer Thread sanitizer Coverage Thoughts/discussion points Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 2 / 16
3 Introduction Dynamic analysis: any kind of testing that involves running your code and analysing in more detail than my code doesn t crash Within ATLAS our workhorses are FPEAuditor: checks for floating point exception in CPU register, generates WARNING or stack trace Valgrind: run Athena etc (takes several hours), read big log file CPU and memory profiling tools (not discussed today) FPEAuditor is so well-integrated it s easy to forget that it s an extra tool - has found countless bugs Valgrind is unwieldy, mainly because of Athena CPU/memory requirements, but still very useful Desire to spend less time running valgrind led me to start investigating other tools (jointly with Rolf Seuster, Scott Snyder and others) Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 3 / 16
4 Sanitizers Suite of Google open-source tools with names ending in Sanitizer Dynamic binary instrumentation to search for various types of error Several specialised tools instead of one big suite Aim for zero false-positive rate Enable via compilation options in gcc and clang -fsanitize=undefined, -fsanitize=address etc Can run in opt builds (this is encouraged by sanitizer authors) Very successful in open-source projects Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 4 / 16
5 AddressSanitizer demo setup gcc >= 4.9 cat boom.cpp i n t main ( i n t argc, char * * argv ) { i n t * array = new i n t [ ] ; i n t res = array [ argc ] ; delete [ ] array ; r e t u r n res ; } g++ fsanitize=address boom.cpp g Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 5 / 16
6 AddressSanitizer output 1 Message beginning with AddressSanitizer, then stack trace ================================================================= ==7552==ERROR: AddressSanitizer : heap buffer overflow on address 0 x ffd4 at pc 0x bp 0 x7fff248f7d80 sp 0 x7fff248f7d78 READ of size 4 at 0x ffd4 thread T0 #0 0x i n main / tmp / smh / boom. cpp :3 #1 0x7f4181b04d5c i n l i b c s t a r t m a i n ( / l i b 6 4 / l i b c. so.6+0 x1ed5c ) #2 0x ( / tmp / smh / a. out+0x ) 0x ffd4 i s located 4 bytes to the r i g h t of 400 byte region [ 0 x fe40, 0 x ffd0 ) a l l o c a t e d by thread T0 here : #0 0x7f418267e00f in operator new [ ] ( unsigned long ) ( / afs / cern. ch / a t l a s / o f f l i n e / e x t e r n a l / LCG 71san / gcc / / x86 64 slc6 / l i b 6 4 / libasan. so.1+0 x5800f ) #1 0x4007d0 i n main / tmp / smh / boom. cpp :2 #2 0x7f4181b04d5c i n l i b c s t a r t m a i n ( / l i b 6 4 / l i b c. so.6+0 x1ed5c ) Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 6 / 16
7 AddressSanitizer output 2 Memory layout SUMMARY: AddressSanitizer : heap buffer overflow / tmp / smh / boom. cpp : 3 main Shadow bytes around the buggy address : 0 x0c287fff9fa0 : fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0 x0c287fff9fb0 : fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0 x0c287fff9fc0 : fa fa fa fa fa fa fa fa x0c287fff9fd0 : x0c287fff9fe0 : =>0x 0 c f f f 9 f f 0 : [ fa ] fa fa fa fa fa 0x0c287fffa000 : fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c287fffa010 : fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c287fffa020 : fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c287fffa030 : fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c287fffa040 : fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend ( one shadow byte represents 8 a p p l i c a t i o n bytes ) : Addressable : 00 P a r t i a l l y addressable : Heap l e f t redzone : fa Heap r i g h t redzone : fb Freed heap region : fd Stack l e f t redzone : f1 Stack mid redzone : f2 Stack r i g h t redzone : f3 Stack p a r t i a l redzone : f4 Stack a f t e r r e t u r n : f5 Stack use a f t e r scope : f8 Global redzone : f9 Global i n i t order : f6 Poisoned by user Stewart : Martin-Haugh f7(stfc RAL) Dynamic code analysis tools 7 / 16
8 AddressSanitizer output thoughts Detailed Colourful A bit intimidating? Not easy for non-expert developers to interpret So far, not as googlable as Valgrind errors Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 8 / 16
9 AddressSanitizer Can find memory errors (more types than Valgrind, see backup) but not uninitialised values Fast-ish: only a factor of two slower than running normally 30 ATLAS bugs found over 3 months, 16 ROOT bugs found over two years (David Obdurachmanov from CMS) Why aren t we running it as a matter of course? 1. Not ABI-compatible - need to recompile everything, including entire LCG stack (may get fixed in future) 2. Always crashes on first error 3. GCC implementation cannot blacklist known issues (clang can) 1. indicates a deficiency of our build system (should be easier after CMake migration) 2. can be frustrating if the bug is in external code Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 9 / 16
10 Undefined behaviour sanitizer Looks for various classes of undefined behaviour Signed/unsigned integer overflow (see entertaining GCC discussion) Shift (<< and >>) errors Passing wrong value to bool/enum Does not stop execution on first error Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 10 / 16
11 Undefined behaviour sanitizer Crystal-clear error messages (line number, explanation) ALFA GeometryReader.h:132:16: runtime error: load of value , which is not a valid value for type egeosourcetype HepMcParticleLink.h:72:51: runtime error: left shift of by 16 places cannot be represented in type int GaudiKernel/ToStream.h:372:25: runtime error: load of value 190, which is not a valid value for type bool BunchGroupSet.cxx:38:23: runtime error: shift exponent 99 is too large for 32-bit type int FlexBinChunk.icc:264:110: runtime error: signed integer overflow: cannot be represented in type int Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 11 / 16
12 Undefined behaviour sanitizer (ubsan) UBSan is particularly powerful since there is no other way to catch these kinds of error An error from UBSan means one of two things (assuming no bug within UBSan) 1. The code is calculating nonsense 2. The code is accidentally working but may break with a new compiler/platform UBSan now runs regularly in debug platform for devval Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 12 / 16
13 ThreadSanitizer Checks for data races Reputedly much faster than Helgrind - Valgrind tool for data races Tried compiling Intel Threaded Building Blocks and TBB examples with ThreadSanitizer Generate 403 warnings while compiling examples, hangs somewhere Generate 40 warnings using suppression files, compilation still hangs May or may not end up being useful for us Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 13 / 16
14 Code coverage Static analysis tools have 100% code coverage, but do not catch 100% of problems (100% coverage, 10% depth) Dynamic analysis tools have test-dependent code coverage, can catch more problems (X% coverage, Y% depth) How can we measure code coverage effectively? How good is our RTT test coverage? Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 14 / 16
15 Wishlist asan running regularly for a full build of some sort ubsan running in RTT and continuous integration tests tsan properly evaluated for AthenaMT Working clang build (more sanitizer options) Developer education for ubsan and asan More effort available to follow up on issues found Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 15 / 16
16 Backup: AddressSanitizer (asan) issue types found ASan Valgrind Heap out-of-bounds Y Y Stack out-of-bounds Y N Global out-of-bounds Y N Use after free Y Y Use after return Y N Uninitialised memory read N Y Initialisation order issues Y N Leaks N Y Slowdown 2x 10x Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 16 / 16
New features in AddressSanitizer. LLVM developer meeting Nov 7, 2013 Alexey Samsonov, Kostya Serebryany
New features in AddressSanitizer LLVM developer meeting Nov 7, 2013 Alexey Samsonov, Kostya Serebryany Agenda AddressSanitizer (ASan): a quick reminder New features: Initialization-order-fiasco Stack-use-after-scope
C/C++ toolchain. Static and dynamic code analysis. Karel Kubíček. Masaryk University. Brno, Czech Republic
C/C++ toolchain Static and dynamic code analysis Karel Kubíček Masaryk University Brno, Czech Republic April 20, 2018 Questions Who uses C/C++? Karel Kubíček C/C++ toolchain April 20, 2018 2 / 12 Questions
Praktische Aspekte der Informatik
Praktische Aspekte der Informatik Moritz Mühlhausen Prof. Marcus Magnor Optimization valgrind, gprof, and callgrind Further Reading Warning! The following slides are meant to give you a very superficial
WESTFÄLISCHE WILHELMS-UNIVERSITÄT MÜNSTER. Debugging C++ living knowledge WWU Münster
MÜNSTER Debugging C++ René Milk 15th October 2014 Debugging Stages MÜNSTER Debugging C++ 2 /19 Coding Testing Instrumentation Tools Bug prevention? MÜNSTER Debugging C++ 3 /19 defensive coding compile
Advanced Debugging and the Address Sanitizer
Developer Tools #WWDC15 Advanced Debugging and the Address Sanitizer Finding your undocumented features Session 413 Mike Swingler Xcode UI Infrastructure Anna Zaks LLVM Program Analysis 2015 Apple Inc.
DEBUGGING: DYNAMIC PROGRAM ANALYSIS
DEBUGGING: DYNAMIC PROGRAM ANALYSIS WS 2017/2018 Martina Seidl Institute for Formal Models and Verification System Invariants properties of a program must hold over the entire run: integrity of data no
Programming in C. Lecture 9: Tooling. Dr Neel Krishnaswami. Michaelmas Term
Programming in C Lecture 9: Tooling Dr Neel Krishnaswami Michaelmas Term 2017-2018 1 / 24 Undefined and Unspecified Behaviour 2 / 24 Undefined and Unspecified Behaviour We have seen that C is an unsafe
CSC 405 Introduction to Computer Security Fuzzing
CSC 405 Introduction to Computer Security Fuzzing Alexandros Kapravelos akaprav@ncsu.edu Let s find some bugs (again) We have a potentially vulnerable program The program has some inputs which can be controlled
How we implemented TDD in Embedded C & C++
How we implemented TDD in Embedded C & C++ Work for Cornwall, England. based in Provide an embedded software development service. Introduced Lean/Agile practices in 2009 and have delivered approximately
Fast dynamic program analysis Race detection. Konstantin Serebryany May
Fast dynamic program analysis Race detection Konstantin Serebryany May 20 2011 Agenda Dynamic program analysis Race detection: theory ThreadSanitizer: race detector Making ThreadSanitizer
TI2725-C, C programming lab, course
Valgrind tutorial Valgrind is a tool which can find memory leaks in your programs, such as buffer overflows and bad memory management. This document will show per example how Valgrind responds to buggy
Copyright 2015 MathEmbedded Ltd.r. Finding security vulnerabilities by fuzzing and dynamic code analysis
Finding security vulnerabilities by fuzzing and dynamic code analysis Security Vulnerabilities Top code security vulnerabilities don t change much: Security Vulnerabilities Top code security vulnerabilities
Identifying Memory Corruption Bugs with Compiler Instrumentations. 이병영 ( 조지아공과대학교
Identifying Memory Corruption Bugs with Compiler Instrumentations 이병영 ( 조지아공과대학교 ) blee@gatech.edu @POC2014 How to find bugs Source code auditing Fuzzing Source Code Auditing Focusing on specific vulnerability
Program Analysis Tools
CMPT 473 Software Quality Assurance Program Analysis Tools Nick Sumner Fixing bugs is costly Why? 2 Fixing bugs is costly The longer broken code exists, the more code depends upon it. 3 Fixing bugs is
Improving Linux Development with better tools. Andi Kleen. Oct 2013 Intel Corporation
Improving Linux Development with better tools Andi Kleen Oct 2013 Intel Corporation ak@linux.intel.com Linux complexity growing Source lines in Linux kernel All source code 16.5 16 15.5 M-LOC 15 14.5 14
Fuzzing. compass-security.com 1
Fuzzing compass-security.com 1 Fuzzing Finding bugs by bombarding target with nonconform data Think: Flip a few bits in a PDF, then start Acrobat with that PDF Just more automated Steps: Create input corpus
Improving Linux development with better tools
Improving Linux development with better tools Andi Kleen Oct 2013 Intel Corporation ak@linux.intel.com Linux complexity growing Source lines in Linux kernel All source code 16.5 16 15.5 M-LOC 15 14.5 14
CSCI-243 Exam 1 Review February 22, 2015 Presented by the RIT Computer Science Community
CSCI-243 Exam 1 Review February 22, 2015 Presented by the RIT Computer Science Community http://csc.cs.rit.edu History and Evolution of Programming Languages 1. Explain the relationship between machine
Bruce Merry. IOI Training Dec 2013
IOI Training Dec 2013 Outline 1 2 Outline 1 2 What is GDB? Tool that peeks inside your program Helps examine what is happening Helps trace crashes Integrated into Eclipse, some other IDEs GDB vs debug
Red Hat Enterprise Linux C++ Toolchains: 10 Tips to Drive Your Development
attacks much harder Red Hat Enterprise Linux C++ Toolchains: 10 Tips to Drive Your Development Matt Newsome Senior Engineering Manager, Tools v1.0 % bit.ly/dtstalks bit.ly/dtstalks RED HAT ENTERPRISE LINUX
C++ Undefined Behavior What is it, and why should I care?
C++ Undefined Behavior What is it, and why should I care? Marshall Clow Qualcomm marshall@idio.com http://cplusplusmusings.wordpress.com (intermittent) Twitter: @mclow ACCU 2014 April 2014 What is Undefined
Fuzzing AOSP. AOSP for the Masses. Attack Android Right Out of the Box Dan Austin, Google. Dan Austin Google Android SDL Research Team
Fuzzing AOSP For the Masses AOSP for the Masses Attack Android Right Out of the Box Dan Austin, Google Dan Austin Google Android SDL Research Team Exploitation: Find the Needle Needles are Interesting
CS2141 Software Development using C/C++ Debugging
CS2141 Software Development using C/C++ Debugging Debugging Tips Examine the most recent change Error likely in, or exposed by, code most recently added Developing code incrementally and testing along
Use Dynamic Analysis Tools on Linux
Use Dynamic Analysis Tools on Linux FTF-SDS-F0407 Gene Fortanely Freescale Software Engineer Catalin Udma A P R. 2 0 1 4 Software Engineer, Digital Networking TM External Use Session Introduction This
How to cross compile with LLVM based tools. Peter Smith, Linaro
How to cross compile with LLVM based tools Peter Smith, Linaro Introduction and assumptions What we are covering Today About me What is cross compilation? How does cross compilation work with Clang and
Last week. Data on the stack is allocated automatically when we do a function call, and removed when we return
Last week Data can be allocated on the stack or on the heap (aka dynamic memory) Data on the stack is allocated automatically when we do a function call, and removed when we return f() {... int table[len];...
o Code, executable, and process o Main memory vs. virtual memory
Goals for Today s Lecture Memory Allocation Prof. David August COS 217 Behind the scenes of running a program o Code, executable, and process o Main memory vs. virtual memory Memory layout for UNIX processes,
Scientific Programming in C IX. Debugging
Scientific Programming in C IX. Debugging Susi Lehtola 13 November 2012 Debugging Quite often you spend an hour to write a code, and then two hours debugging why it doesn t work properly. Scientific Programming
Chapter 1 GETTING STARTED. SYS-ED/ Computer Education Techniques, Inc.
Chapter 1 GETTING STARTED SYS-ED/ Computer Education Techniques, Inc. Objectives You will learn: Java platform. Applets and applications. Java programming language: facilities and foundation. Memory management
CSci 4061 Introduction to Operating Systems. Programs in C/Unix
CSci 4061 Introduction to Operating Systems Programs in C/Unix Today Basic C programming Follow on to recitation Structure of a C program A C program consists of a collection of C functions, structs, arrays,
Programming in C and C++
Programming in C and C++ Types, Variables, Expressions and Statements Neel Krishnaswami and Alan Mycroft Course Structure Basics of C: Types, variables, expressions and statements Functions, compilation
Higher-Performance R Programming with C++ Extensions
Higher-Performance R Programming with C++ Extensions Part 5: Rcpp Packaging and Debugging Dirk Eddelbuettel June 28 and 29, 2017 University of Zürich & ETH Zürich Zürich R Courses 2017 1/39 Overview Zürich
A Novel Approach to Explain the Detection of Memory Errors and Execution on Different Application Using Dr Memory.
A Novel Approach to Explain the Detection of Memory Errors and Execution on Different Application Using Dr Memory. Yashaswini J 1, Tripathi Ashish Ashok 2 1, 2 School of computer science and engineering,
Limitations of the stack
The heap hic 1 Limitations of the stack int *table_of(int num, int len) { int table[len+1]; for (int i=0; i
Deploying Dynamic Analyses and Preventing Compiler Backdoors with Multi-Version Execution
Deploying Dynamic Analyses and Preventing Compiler Backdoors with Multi-Version Execution Luís Pina l.pina@imperial.ac.uk Joint work with Cristian Cadar, Anastasios Andronidis John Regehr Imperial College
Memory Analysis tools
Memory Analysis tools PURIFY The Necessity TOOL Application behaviour: Crashes intermittently Uses too much memory Runs too slowly Isn t well tested Is about to ship You need something See what your code
[0569] p 0318 garbage
![[0569] p 0318 garbage](/thumbs/74/69959549.jpg "[0569] p 0318 garbage")
A Pointer is a variable which contains the address of another variable. Declaration syntax: Pointer_type *pointer_name; This declaration will create a pointer of the pointer_name which will point to the
CS 103 Lab The Files are *In* the Computer
CS 103 Lab The Files are *In* the Computer 1 Introduction In this lab you will modify a word scramble game so that instead of using a hardcoded word list, it selects a word from a file. You will learn
Valgrind. Philip Blakely. Laboratory for Scientific Computing, University of Cambridge. Philip Blakely (LSC) Valgrind 1 / 21
Valgrind Philip Blakely Laboratory for Scientific Computing, University of Cambridge Philip Blakely (LSC) Valgrind 1 / 21 Part I Valgrind Philip Blakely (LSC) Valgrind 2 / 21 Valgrind http://valgrind.org/
Thread Sanitizer and Static Analysis
Developer Tools #WWDC16 Thread Sanitizer and Static Analysis Help with finding bugs in your code Session 412 Anna Zaks Manager, Program Analysis Team Devin Coughlin Engineer, Program Analysis Team 2016
CSE 374 Programming Concepts & Tools
CSE 374 Programming Concepts & Tools Hal Perkins Fall 2017 Lecture 8 C: Miscellanea Control, Declarations, Preprocessor, printf/scanf 1 The story so far The low-level execution model of a process (one
Software security, secure programming
Software security, secure programming Lecture 4: Protecting your code against software vulnerabilities? (overview) Master on Cybersecurity Master MoSiG Academic Year 2017-2018 Preamble Bad news several
Code: analysis, bugs, and security
Code: analysis, bugs, and security supported by Bitdefender Marius Minea marius@cs.upt.ro 4 October 2017 Course goals improve skills: write robust, secure code understand program internals learn about
logistics: ROP assignment
bug-finding 1 logistics: ROP assignment 2 2013 memory safety landscape 3 2013 memory safety landscape 4 different design points memory safety most extreme disallow out of bounds usually even making out-of-bounds
Finding Bugs Using Xcode Runtime Tools
Session Developer Tools #WWDC17 Finding Bugs Using Xcode Runtime Tools 406 Kuba Mracek, Program Analysis Engineer Vedant Kumar, Compiler Engineer 2017 Apple Inc. All rights reserved. Redistribution or
Survey. Motivation 29.5 / 40 class is required
Survey Motivation 29.5 / 40 class is required Concerns 6 / 40 not good at examination That s why we have 3 examinations 6 / 40 this class sounds difficult 8 / 40 understand the instructor Want class to
Undefined Behaviour in C
Undefined Behaviour in C Report Field of work: Scientific Computing Field: Computer Science Faculty for Mathematics, Computer Science and Natural Sciences University of Hamburg Presented by: Dennis Sobczak
High Performance Computing MPI and C-Language Seminars 2009
High Performance Computing - Seminar Plan Welcome to the High Performance Computing seminars for 2009. Aims: Introduce the C Programming Language. Basic coverage of C and programming techniques needed
Performance analysis basics
Performance analysis basics Christian Iwainsky Iwainsky@rz.rwth-aachen.de 25.3.2010 1 Overview 1. Motivation 2. Performance analysis basics 3. Measurement Techniques 2 Why bother with performance analysis
System Assertions. Andreas Zeller
System Assertions Andreas Zeller System Invariants Some properties of a program must hold over the entire run: must not access data of other processes must handle mathematical exceptions must not exceed
Static analysis, test coverage, and other 12+ letter words A tour of ways to find and prevent bugs in PostgreSQL
Static analysis, test coverage, and other 12+ letter words A tour of ways to find and prevent bugs in PostgreSQL Peter Eisentraut peter@eisentraut.org @petereisentraut PGCon 2014 Compiler Warnings Compiler
Black Hat Webcast Series. C/C++ AppSec in 2014
Black Hat Webcast Series C/C++ AppSec in 2014 Who Am I Chris Rohlf Leaf SR (Security Research) - Founder / Consultant BlackHat Speaker { 2009, 2011, 2012 } BlackHat Review Board Member http://leafsr.com
CS C Primer. Tyler Szepesi. January 16, 2013
January 16, 2013 Topics 1 Why C? 2 Data Types 3 Memory 4 Files 5 Endianness 6 Resources Why C? C is exteremely flexible and gives control to the programmer Allows users to break rigid rules, which are
C++ for Java Programmers
Basics all Finished! Everything we have covered so far: Lecture 5 Operators Variables Arrays Null Terminated Strings Structs Functions 1 2 45 mins of pure fun Introduction Today: Pointers Pointers Even
CS16 Week 2 Part 2. Kyle Dewey. Thursday, July 5, 12
CS16 Week 2 Part 2 Kyle Dewey Overview Type coercion and casting More on assignment Pre/post increment/decrement scanf Constants Math library Errors Type Coercion / Casting Last time... Data is internally
But first, encode deck of cards. Integer Representation. Two possible representations. Two better representations WELLESLEY CS 240 9/8/15
Integer Representation Representation of integers: unsigned and signed Sign extension Arithmetic and shifting Casting But first, encode deck of cards. cards in suits How do we encode suits, face cards?
Stitched Together: Transitioning CMS to a Hierarchical Threaded Framework
Stitched Together: Transitioning CMS to a Hierarchical Threaded Framework CD Jones and E Sexton-Kennedy Fermilab, P.O.Box 500, Batavia, IL 60510-5011, USA E-mail: cdj@fnal.gov, sexton@fnal.gov Abstract.
A brief introduction to C programming for Java programmers
A brief introduction to C programming for Java programmers Sven Gestegård Robertz September 2017 There are many similarities between Java and C. The syntax in Java is basically
Lecture 2: C Programm
0 3 E CS 1 Lecture 2: C Programm ing C Programming Procedural thought process No built in object abstractions data separate from methods/functions Low memory overhead compared to Java No overhead of classes
CSE 333 Midterm Exam Sample Solution 7/28/14
Question 1. (20 points) C programming. For this question implement a C function contains that returns 1 (true) if a given C string appears as a substring of another C string starting at a given position.
Practical Malware Analysis
Practical Malware Analysis Ch 4: A Crash Course in x86 Disassembly Revised 1-16-7 Basic Techniques Basic static analysis Looks at malware from the outside Basic dynamic analysis Only shows you how the
CS61, Fall 2012 Section 2 Notes
CS61, Fall 2012 Section 2 Notes (Week of 9/24-9/28) 0. Get source code for section [optional] 1: Variable Duration 2: Memory Errors Common Errors with memory and pointers Valgrind + GDB Common Memory Errors
Malloc Lab & Midterm Solutions. Recitation 11: Tuesday: 11/08/2016
Malloc Lab & Midterm Solutions Recitation 11: Tuesday: 11/08/2016 Malloc 2 Important Notes about Malloc Lab Malloc lab has been updated from previous years Supports a full 64 bit address space rather than
C++ Support Classes (Data and Variables)
C++ Support Classes (Data and Variables) School of Mathematics 2018 Today s lecture Topics: Computers and Programs; Syntax and Structure of a Program; Data and Variables; Aims: Understand the idea of programming
Lecture 3: C Programm
0 3 E CS 1 Lecture 3: C Programm ing Reading Quiz Note the intimidating red border! 2 A variable is: A. an area in memory that is reserved at run time to hold a value of particular type B. an area in memory
CSE 303, Winter 2006, Final Examination 16 March Please do not turn the page until everyone is ready.
CSE 303, Winter 2006, Final Examination 16 March 2006 Please do not turn the page until everyone is ready. Rules: The exam is closed-book, closed-note, except for one side of one 8.5x11in piece of paper.
Machine-Level Programming V: Unions and Memory layout
Machine-Level Programming V: Unions and Memory layout Slides adapted from Bryant and O Hallaron Bryant and O Hallaron, Computer Systems: A Programmer s Perspective, Third Edition 1 FAQ Call conventions
The type of all data used in a C (or C++) program must be specified
The type of all data used in a C (or C++) program must be specified A data type is a description of the data being represented That is, a set of possible values and a set of operations on those values
Programming Assignment Multi-Threading and Debugging 2
Programming Assignment Multi-Threading and Debugging 2 Due Date: Friday, June 1 @ 11:59 pm PAMT2 Assignment Overview The purpose of this mini-assignment is to continue your introduction to parallel programming
6.S096: Introduction to C/C++
6.S096: Introduction to C/C++ Frank Li, Tom Lieber, Kyle Murray Lecture 4: Data Structures and Debugging! January 17, 2012 Today Memory Leaks and Valgrind Tool Structs and Unions Opaque Types Enum and
Week 5, continued. This is CS50. Harvard University. Fall Cheng Gong
This is CS50. Harvard University. Fall 2014. Cheng Gong Table of Contents News... 1 Buffer Overflow... 1 Malloc... 6 Linked Lists... 7 Searching... 13 Inserting... 16 Removing... 19 News Good news everyone!
Chapter 1 INTRODUCTION SYS-ED/ COMPUTER EDUCATION TECHNIQUES, INC.
hapter 1 INTRODUTION SYS-ED/ OMPUTER EDUATION TEHNIQUES, IN. Objectives You will learn: Java features. Java and its associated components. Features of a Java application and applet. Java data types. Java
valgrind overview: runtime memory checker and a bit more What can we do with it?
Valgrind overview: Runtime memory checker and a bit more... What can we do with it? MLUG Mar 30, 2013 The problem When do we start thinking of weird bug in a program? The problem When do we start thinking
Debugging. Erwan Demairy Dream
1 Debugging Erwan Demairy Dream 2 Where are we? Tools Requirements Global architecture UML Local architecture Implementation Compilation Link Editor Compiler Linker Tests Debug Profiling Build IDE Debugger
EL2310 Scientific Programming
Lecture 11: Memory, Files and Bitoperations (yaseminb@kth.se) Overview Overview Lecture 11: Memory, Files and Bit operations Main function; reading and writing Bitwise Operations Lecture 11: Memory, Files
ECE 250 / CS 250 Computer Architecture. C to Binary: Memory & Data Representations. Benjamin Lee
ECE 250 / CS 250 Computer Architecture C to Binary: Memory & Data Representations Benjamin Lee Slides based on those from Alvin Lebeck, Daniel Sorin, Andrew Hilton, Amir Roth, Gershon Kedem Administrivia
Simple Overflow. #include <stdio.h> int main(void){ unsigned int num = 0xffffffff;
Simple Overflow 1 #include int main(void){ unsigned int num = 0xffffffff; printf("num is %d bits long\n", sizeof(num) * 8); printf("num = 0x%x\n", num); printf("num + 1 = 0x%x\n", num + 1); }
Debugging / Profiling
The Center for Astrophysical Thermonuclear Flashes Debugging / Profiling Chris Daley 23 rd June An Advanced Simulation & Computing (ASC) Academic Strategic Alliances Program (ASAP) Center at Motivation
CNIT 127: Exploit Development. Ch 1: Before you begin. Updated
CNIT 127: Exploit Development Ch 1: Before you begin Updated 1-14-16 Basic Concepts Vulnerability A flaw in a system that allows an attacker to do something the designer did not intend, such as Denial
Programs in memory. The layout of memory is roughly:
Memory 1 Programs in memory 2 The layout of memory is roughly: Virtual memory means that memory is allocated in pages or segments, accessed as if adjacent - the platform looks after this, so your program
Memory Corruption 101 From Primitives to Exploit
Memory Corruption 101 From Primitives to Exploit Created by Nick Walker @ MWR Infosecurity / @tel0seh What is it? A result of Undefined Behaviour Undefined Behaviour A result of executing computer code
VARIABLES AND TYPES CITS1001
VARIABLES AND TYPES CITS1001 Scope of this lecture Types in Java the eight primitive types the unlimited number of object types Values and References The Golden Rule Primitive types Every piece of data
Operating Systems. 18. Remote Procedure Calls. Paul Krzyzanowski. Rutgers University. Spring /20/ Paul Krzyzanowski
Operating Systems 18. Remote Procedure Calls Paul Krzyzanowski Rutgers University Spring 2015 4/20/2015 2014-2015 Paul Krzyzanowski 1 Remote Procedure Calls 2 Problems with the sockets API The sockets
CS 392/681 Lab 6 Experiencing Buffer Overflows and Format String Vulnerabilities
CS 392/681 Lab 6 Experiencing Buffer Overflows and Format String Vulnerabilities Given: November 13, 2003 Due: November 20, 2003 1 Motivation Buffer overflows and format string vulnerabilities are widespread
Updating the Compiler?
Updating the Compiler? Take Advantage of The New Development Toolchain Andreas Jaeger Product Manager aj@suse.com Programming Languages C C++ Fortran And Go 2 Why new compiler? Faster applications Support
Topics Introduction to Microprocessors
Topics 22440 Introduction to Microprocessors C-Language Review (I) Important: : You will not learn how to code in C in this one lecture! You ll still need some sort of C reference. C Syntax Important Tidits
Lecture 08 Control-flow Hijacking Defenses
Lecture 08 Control-flow Hijacking Defenses Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides adapted from Miller, Bailey, and Brumley Control Flow Hijack: Always control + computation
IntFlow: Integer Error Handling With Information Flow Tracking
mpomonis@cs.columbia.edu IntFlow Columbia University 1 / 29 IntFlow: Integer Error Handling With Information Flow Tracking Marios Pomonis Theofilos Petsios Kangkook Jee Michalis Polychronakis Angelos D.
CS 241 Honors Memory
CS 241 Honors Memory Ben Kurtovic Atul Sandur Bhuvan Venkatesh Brian Zhou Kevin Hong University of Illinois Urbana Champaign February 20, 2018 CS 241 Course Staff (UIUC) Memory February 20, 2018 1 / 35
Chapter 1 Getting Started
Chapter 1 Getting Started The C# class Just like all object oriented programming languages, C# supports the concept of a class. A class is a little like a data structure in that it aggregates different
CS 31: Intro to Systems Pointers and Memory. Martin Gagne Swarthmore College February 16, 2016
CS 31: Intro to Systems Pointers and Memory Martin Gagne Swarthmore College February 16, 2016 So we declared a pointer How do we make it point to something? 1. Assign it the address of an existing variable
C++ Undefined Behavior
C++ Undefined Behavior What is it, and why should I care? A presentation originally by Marshal Clow Original: https://www.youtube.com/watch?v=uhclkb1vkay Original Slides: https://github.com/boostcon/cppnow_presentations_2014/blob/master/files/undefined-behavior.pdf
Quiz 0 Review Session. October 13th, 2014
Quiz 0 Review Session October 13th, 2014 Topics (non-exhaustive) Binary. ASCII. Algorithms. Pseudocode. Source code. Compiler. Object code. Scratch. Statements. Boolean expressions. Conditions. Loops.
INITIALISING POINTER VARIABLES; DYNAMIC VARIABLES; OPERATIONS ON POINTERS
INITIALISING POINTER VARIABLES; DYNAMIC VARIABLES; OPERATIONS ON POINTERS Pages 792 to 800 Anna Rakitianskaia, University of Pretoria INITIALISING POINTER VARIABLES Pointer variables are declared by putting
Introduction to Computer Systems
Introduction to Computer Systems Today:! Welcome to EECS 213! Lecture topics and assignments Next time:! Bits & bytes! and some Boolean algebra Fabián E. Bustamante, 2007 Welcome to Intro. to Computer
Outline. Computer programming. Debugging. What is it. Debugging. Hints. Debugging
Outline Computer programming Debugging Hints Gathering evidence Common C errors "Education is a progressive discovery of our own ignorance." Will Durant T.U. Cluj-Napoca - Computer Programming - lecture
Lecture Notes on Types in C
Lecture Notes on Types in C 15-122: Principles of Imperative Computation Frank Pfenning, Rob Simmons Lecture 20 April 2, 2013 1 Introduction In lecture 18, we emphasized the things we lost by going to
Dynamic Race Detection with LLVM Compiler
Dynamic Race Detection with LLVM Compiler Compile-time instrumentation for ThreadSanitizer Konstantin Serebryany, Alexander Potapenko, Timur Iskhodzhanov, and Dmitriy Vyukov OOO Google, 7 Balchug st.,
Introduction to Programming (Java) 2/12
Introduction to Programming (Java) 2/12 Michal Krátký Department of Computer Science Technical University of Ostrava Introduction to Programming (Java) 2008/2009 c 2006 2008 Michal Krátký Introduction
The type of all data used in a C++ program must be specified
The type of all data used in a C++ program must be specified A data type is a description of the data being represented That is, a set of possible values and a set of operations on those values There are