Using Fortify SCA (not outdated "HP Fortify") on Qt code - c++

I've been trying to research this for a while and my limited experience with compiling is hindering my ability to figure it out.
Basically, I have some code which is being written in Qt Creator, then built with these build steps:
qmake.exe [project name].pro -spec win32-msvc "CONFIG+=qtquickcompiler"
jom.exe in C:\eclipseworkspace\[project directory]
I'd like to use the Fortify SCA (Static Code Analyzer) to automatically scan this code for vulnerabilities, but most of its user-friendly features are designed towards Java. I haven't given up, though, because Fortify does claim to be able to scan C++ code that uses 3rd Party Compilers (which I assume Qt falls into that category).
(Page 37 of this document)
As a preliminary step to running Qt Creator on my actual code, I've wanted to see if I can at least get it to run on any Qt sample project, to see what the steps to do that would be.
I'm using Qt 5.12.7
on a Windows 10 OS
with the MSVC2017 32bit compiler,
but I feel any correlation between Qt and Fortify that works will be enough to set me off in the right direction.
Or perhaps my optimism is misplaced and I just don't understand the limitations of what I want to do. Either way, it'd be nice to know.

I have found this to be easiest on Linux. I think this solution translates to Windows.
You must inject the sourceanalyzer into your compiler command.
For example, I run cmake to configure my projects.
export CC="sourceanalyzer -b <your_project_name_here> gcc"
export CXX="sourceanalyzer -b <your_project_name_here> g++"
cmake <bunch of my cmake definitions> <path_to_src>
# I do a clean to remove what sourceanalyzer picks up during configuration time tests.
sourceanalyzer -b <your_project_name_here> -clean
sourceanalyzer -b <your_project_name_here> -scan -f scanResults.fpr

Related

Configure kit for Qt automatically

SO!
Let's say I have a number of settings (GCC compiler 9.3.0 built from source, as the distribution I have to use has a very old one, along with environment setup) for a new Kit in QtCreator.
I have managed to setup an environment for compilation and execution of compiled binaries, and made a script to make it work (like qmake -nocache -recursive/make/sudo make install, direct execution of g++, and other stuff).
One thing that script can't do at the moment, is that it cannot create a kit for QtCreator with new compilers and environment being set as required, so after running a script, its user has to go through setting it up himself through GUI, which is bad, because this can cause misconfiguration.
This thing I'm trying to create is going to be used by around ~200 people in my company, so leaving readme.txt with instructions just doesn't go well enough for me - I don't want running around fixing missing "{" and "}" in Environment description in created Kits, and other stuff.
Are there ways to create Kits for QtCreator automatically from command line? Maybe, there's some files to edit?
I've looked into this one a few years back (I wanted to do something similar for registering Buildroot toolchains automatically in QtCreator), and I was unable to find an off the shelf solution. So i think there are 2 ways to implement this:
a) Implementing a command line utility the manipulate the ~/.config/QtProject/qtcreator/{toolchains,profiles}.xml files. Maybe by (re)using the existing C++ implementation within QtCreator, or just re-implement it ie. in Python. Back than I didn't start to work on this as there was no real business need.
b) Switching to qbs, as qbs has support for setting up toolchains from the command line ( see: https://doc.qt.io/qbs/cli-setup-toolchains.html)
If you decide to go with solution a), please let me know and maybe we can partner up to implement it.
Check out the command line sdktool bundled with QtCreator:
The SDK tool can be used to set up Qt versions, tool chains, devices
and kits in Qt Creator.
There still is a lot of knowledge about Qt Creator internals required
to use this tool!
I haven't tried it yet, but I did find the executable under Tools/QtCreator/libexec/qtcreator subdirectory of the Qt Creator installation directory. ./sdktool --help works for me under Linux.

VSCode c++ configuring for vc toolchain

I'm trying to start a work in vscode , latest C++ plugin version supports ms debugger, so as I'm mostly working under windows it was a signal to try this.
c++ tools plugin from MS and cmake tools were installed.
my test project was however not built . the problem is clear , but I need an advice from experienced vscode users how to solve this right.
cmake doesn't see vc compiler.
(after using QtCreator) I expected that vscode could detect vc installation... however that's not so. ok, I have a two ways:
fill environment variables INCLUDE/LIB/PATH with a headers, libs and binaries
just run vcvarsall.bat x64
Second way is a simple and reliable. so final question is:
how to run .bat at the begining of vscode start?
(I don't mean write another bat/cmd, prepare the environment and run vscode inside the same script after that)
Although the question is fairly old, I'll try to give a useful answer, in case others stumble across, just like I did.
I believe what you are trying to achieve is not possible. Code inherits the environment it was started with. If you did not launch it from a developer command prompt, you will not be able build and debug. (Building might be possible if every task first starts the vcvarsall.bat, but that slows things down by a lot. Debugging I think will still not work.)
If you are willing to, you can check out vector-of-bools CMake Tools extension which does build automation as well as automatic MSVC detection. It builds using CMake (thus you need to write your build scripts using CMake), but it will take care of building just by pressing F7, like what most VS users are familiar with.

LLVM 3.8: implementing a pass with ad IDE (Xcode)

I'm a newbie in both LLVM developing and cpp.
I wanted to ask if there was a way to develop a pass for LLVM in Xcode having all the typical features available in an IDE like autocomplete and syntax code highlighting.
Right now I am just writing c++ code, checking everything I need on the documentation, but, as you can imagine, this is really slowing me down and it's really error prone...
Don't know if this can help, but my LLVM folder is structured this way:
"llvm_3.8_source/" root folder of llvm3.8 source files
"llvm_3.8_source/build" root folder of my llvm3.8 build
Thanks
Yes, it is possible.
LLVM uses CMake as a build-system generator. CMake supports such things as old good makefiles, ninja, xcode, and visual studio.
You can simply create Xcode-project using the following commands from terminal:
cd llvm_build
cmake -G Xcode path/to/llvm/sources
open LLVM.xcodeproj
First you will see lots of errors and 'red' marks. It's because some parts of LLVM sources are generated during compilation.
All files will be generated as soon as you attempt to build project first time and all the 'red' marks will gone.
You can read this article to get a bit more info on the topic:
Getting started with LLVM/Clang on OS X

OS X Eclipse C++ Launch Failed - Binary Not Found

I am quite troubled as this shouldn't be causing me such a headache. I've downloaded the most recent Eclipse Indigo and all CDT C++ plugins for MAC OS X 10.7.1/
Upon restarting after installing the above CDT plugins, I've developed a simple 'hello world' c++ application and have tried running the application, "Launch failed. Binary not found." error message. I've read multiple fixes but none have worked. I tried adding the -arch i386 flag to the linker and compiler commands, still no luck.
Has anyone successfully gotten Eclipse C++ running on 10.7.1?????? This blows my mind. I can simply write the same program in VIM and compile it just fine via the terminal and execute just fine. ECLIPSE DOESN'T WANT TO PLAY ALONG.
I will be deeply indebted to anyone who can help!!!!!
EDIT: compiler output
**** Build of configuration Debug for project HelloWorld ****
make all Building file: ../main.cpp
Invoking: GCC C++ Compiler g++ -I/Developer/SDKs/MacOSX10.6.sdk/usr/include -O0 -g3 -Wall -c -fmessage-length=0 -arch i386 -MMD -MP -MF"main.d" -MT"main.d" -o "main.o" "../main.cpp"
Finished building: ../main.cpp
Building target: libHelloWorld
Invoking: MacOS X C++ Linker g++ -arch i386 -dynamiclib -o "libHelloWorld" ./main.o
Finished building target: libHelloWorld
**** Build Finished ****
I am using Eclipse Juno with CDT on a 2007 Macbook running Snow Leopard. I have the two symptoms:
No Binaries folder in Project Explorer, and
The 'Launch failed. Binary not found' error.
I have spent hours searching on Google for an answer, long enough to ascertain that these two symptoms are indicative of any number of problems which have been reported for not quite a decade without adequate resolution. That is a problem right there because after a decade there should have been more than enough input data to provide one troubleshooting procedure somewhere which walks the user step by step through the elimination of all possible causes.
Instead, for hours I have read about a multitude of people, many of whom have resolved their particular problem but all of them seeming to have had to do something slightly different to get there.
This should not be that difficult to resolve. Particularly in cases such as mine [but I am not the only one] when the Console view displays a Build with no errors yet the user can copy the binary file [which Eclipse bizarrely says it can not find] to the Desktop and run it without any problems from either Finder or a bash terminal session.
All of this seems to be pointing rather emphatically toward the lack of adequate indicators in the Mach0 64 binary parser which should be designed to tell us exactly what it needs which it is not seeing.
Admittedly, this is exacerbated in the case of MacBooks like mine which are running a 64bit OS [Snow Leopard] on a 64bit CPU which the manufacturer, unfortunately, hamstrung with a 32-bit bootup kernel. But, be forewarned, I have already tried the -arch i386 g++ switch, and the relinking of g++ to g++-4.0 without any change in the symptoms.
ADDENDUM ADDED 10/07/2012:
I am adding this checklist in the hope of clarifying a Way for the undoubtedly many others who will ask this question in the years to come. This Way reflects what I found to be necessary when using Eclipse Juno with a Mac running Snow Leopard:
1) Go to Preferences->C/C++->New CDT Project Wizard, and under Preferred Toolchains, make sure all the Executable project types are set to MacOSX GCC.
2) This is a biggie. I was able to get a Binaries folder in Project Explorer, and hence be able to run the project after building it, by using a Project name which does not contain dots ['.']. This I learned from another answer here, edited a few hours after my previous message. This requirement is easy to miss, hence a common one particularly if you are Eclipse experienced but only with other languages, because tutorials for other language plugins [such as with PyDev or for Java] frequently have you create Projects with dots in the name. If you have developed that habit with other languages, break it when using CDT for C/C++. Be forewarned, however, that it is not enough to just do a Right-Click and Rename an existing project name this time not using dots. The simplest Way is to delete your old project and create a new one with a name without dots.
3) There are many websites cautioning you to make sure you either use the -arch i386 compiler switch or change the links for /usr/bin/gcc and /usr/bin/g++ to point to gcc-4.0 and g++-4.0 instead of gcc-4.2 and g++-4.2. I created a bash script to ease switching back and forth and investigated if this was necessary. It was not, at least not with my Macbook. Based on what I read at one site from a Mach-O developer, I suspect that the current version of Mach-0 64 goes both ways. Which is a good segue to ...
4) In the Project Properties, not Preferences, go to C/C++ Build->Settings and under Binary Parsers make sure Mach-O 64 Parser is checked. Make sure this, and not the deprecated Mach-O parser, is checked.
5) At this point, after you build your project, several things should be evident in the Project Explorer:
6) There should now be a Binaries folder under project's folder.
7) Within that Binaries folder should now be your executable file. It should have [x86_64/le] next to it if, like me, your Mac is effectively 32bit. Now is not the best time to get into the confusing topic of whether your Mac is effectively 32bit or 64bit. If you do not know, and a lot folks don't because Apple does make it confusing, check out the little app which can be downloaded from http://www.ahatfullofsky.comuv.com/English/Programs/SMS/SMS.html which will tell you What Is Truth. It is free, but the 'price' is that you have to scroll pass the ads at the top of the page reflecting the programmer's political disposition.
For those of you that are new to programming/eclipse/IDEs and get the same error but the solutions above don't work, I solved my "Launch Failed. Binary Not Found." error by doing the following: Simply be sure to build your project ("Project" > "Build All") before attempting to run or debug. I was thinking that the IDE would do the building when I clicked debug or run, but that is not the case (obviously, in retrospect). Newbie lesson learned. Once you build you should see a "Binaries" and "Debug" folder under the root directory of the project.
I was using OS X 10.7.3, if it matters, though I assume the mistake I made is fundamental and any eclipse distro would give the same error.
on mac:
Make sure you have xcode installed. Test it by writing "info g++" you must see proper information about the compiler.
Build your project.
Go to the folder of your project. You should see an executable file in Debug or realise folder, depending to your building configurations. If you d-click on the executable file you should see the result on the terminal.
Back to Ecliipse, from Run/Run Configurations... and then browse to the folder that you have the executable file - one you already found - you can also change build configurations as you wish in that window. And make build automatic for each run.
Run again it should work.
Good luck !
I had the same problem, then I found a solution on this site.
Let me explain shortly;
Create your c++ project,
Have a look at project properties(⌘I),
Select Mach-O parser under binary properties,
Write your codes down,
Do not forget building your project (⌘B) before run.
You should change the settings for your project to build an executable instead of a dynamic library:
Invoking: MacOS X C++ Linker g++ -arch i386 -dynamiclib -o "libHelloWorld" ./main.o`
Go to project properties -> C/C++ Build -> Settings -> Build artifact, and select Executable in the first drop down list.
I am using Eclipse Oxygen and the following fixed my problem:
Right-click on your project and go to properties. Navigate to C/C++ Build > Tool Chain Editor and select MacOSX GCC in the Current toolchain, and Apply and Close.
Build your project with CMD+B and then run it.
I was having the same problem. The answer can be hard to find as the "binary not found" issue has cropped up several times before, with different causes and solutions (selecting the 64-bit parser, etc.).
It turns out that, in my case, the fix was simple: you have to do a manual build, just once, for every new project you create. After that, works as usual.
Details: using a fresh fresh install of Eclipse Indigo Service Release 1 on Mac OS 10.7.2.
If your project name contains a "." (dot), the binary file will not be generated on building project.
Remove all the "."(dots) from the project name and rebuilt it or try creating a new project.
Happy coding!
If you can successfully built but when try to run it getting error:
Possible solution could be adding new configuration with full path to your binary output file
(Run->Run Configuration...->Main->C++ Application):
I solved a similar problem with Eclipse by creating a "Launch Configuration". I am using the Indigo release of Eclipse on OSX Lion with CDT (C/C++ dev environment). I found the option to create a new launch configuration in Project->Properties->Run/Debug Settings.
I encountered this problem after creating and building an empty "Hello World Ansi C Autotools Project". The build process created a working executable as src/a.out. I could run a.out successfully from the terminal but Eclipse did not understand that this was an executable for my project until I created a launch configuration pointing to it. Once I did that I was able to run a.out as usual using the green run button.
I had the same problem, even when i had set the artifact to executable. It was because the shared lib setting was ticked and this causes a dylib to be made even though you have specified an executable.
I go this to run by setting the Builder Type to Internal Builder on the C/C++ Build tab, in the project properties dialog.
No matter which approach to take to solve this issue on your workspace, this problem seemed to have become native to the project that I had created. Neither using the arguments or making sure the gcc version for linking did not work. I did find an intuitive solution. Here it is:to the "...binary not available..." error.
Do the following:(remember the following steps are after you have taken either of the above routes and none of those have solved the issue.
1.) delete everything - the project and the files.
2.) create new project and source files
I had the similar issue but code was different. In File.h file make sure
virtual ~Destructor () {}; //Don't forget Curly braces {}
Above statement shows destructor initialized () and defined with curly braces { } . In my code I forgot to define Destructor.
Hope this helps
I was having the same problem, so I fiddled around a littpe bit and found out that if I clicked on the "profile" button (green play icon with a little clock under it), to the right of the "run" button, my program would Run the next time I clicked on the Run button.
I actually dont know what that did, but it allowed me to run the code.
if anybody knows why this helped, and whether it is an actual solution or not dont hesitate to relpy!

Anybody tried to compile Go on Windows?, It appears to now support generating PE Format binaries

http://code.google.com/r/hectorchu-go-windows/source/list
If you could compile it successfully, I like to know the procedures of how to.
Assuming you are using Hector's source tree:
Install MinGW and MSYS, along with MSYS Bison and any other tools you think you'll find useful (vim, etc).
Install ed from the GNUWin32 project.
Install Python and Mercurial.
Clone the [hectorchu-go-windows mercurial repository](https://hectorchu-go-windows.googlecode.com/hg/ hectorchu-go-windows) to C:\Go.
Run an MSYS shell (or rxvt). The rest of these are bash commands...
mkdir $HOME/bin
export PATH=$HOME/bin:$PATH
export GOROOT=C:\\Go
export GOARCH=386
export GOOS=mingw
cd /c/Go/src
./all.bash
Correct errors as it spits them out at you, repeat step 10 until it starts building.
It's the same idea as on Linux or MacOS, basically.
However, I still stand by what I said in my comment above: this isn't necessarily going to generate anything that actually works yet. You'd be better served by waiting until this effort has merged into the main Go tree before tackling it, unless your interest is in assisting with the porting effort.
Update: there is now a mostly-functional pre-built windows port available, for those not interested in building the compiler themselves. However, given the rate of change of the project, the lack of formal releases (other than the hg "release" tag), and the possibility of Hector's changes being merged into the main branch soon, keeping up with development via source builds is likely to produce better results over time.
Just FYI, there is seems official one now.
http://code.google.com/p/go-windows/
Hector said he was only able to get as far as being able to compile and run an empty main. See issue 107:
http://code.google.com/p/go/issues/detail?id=107
There is still a lot of work to do in porting that, especially since the code has lots of dependencies on ptrace and syscall, not to mention the different threading models between Linux/BSD and Windows.
Update:
There's a new thread on golang-nuts (started 26.03.2010) with a link to a recent build and some current building instructions (using MinGW+MSYS).