I would like to ask about the available (free or not) Static and Dynamic code analysis tools that can be used to C++ applications ESPECIALLY COM and ActiveX.
I am currently using Visual Studio's /analyze compiler option, which is good and all but I still feel there is lots of analysis to be done.
I'm talking about a C++ application where memory management and code security is of utmost importance.
I'm trying to check for problems relating to security such as memory management, input validation, buffer overflows, exception handling... etc
I'm not interested in, say, inheritance depth or lines of executable code.
Without a doubt you want to use Axman. This is by far the best ActiveX/Com security testing tool available, and its open source. This was one of the leading tools used in the Month Of Browser Bugs by H.D. Moore, who is also the creator of Metasploit. I I have personally used Axman to find vulnerabilities and write exploit code.
Axman uses TypeLib to identify all of the components that makeup a COM . This is a type relfection, and it means that Source code is not required. Axman uses reflection to automatically generate fuzz test cases against a COM.
There is a security tool category called the fuzzers which were used in the recent Pwn2Own 2010 contest in Vancouver. The winning guy said that he's not going to tell software makers which bug he found but instead how to create a good fuzzer that will allow them to find the bugs. This was covered by computerworld.
Basically, it finds every place that the software can take input and tries to inject random data until the application crashes. Starting from there, the user attempts to understand what went wrong and develops an effective attack.
I don't know any particular fuzzers but there are many kinds of them for various uses (buffer overflows vs sql injections, 2 very different problems, 2 different fuzzers)
We use Coverity Prevent which is a very sophisticated static analysis tool that stores defects in a database that has a web interface. It works for C, C++, and Java.
We also use open source tools like Valgrind.
Start here are work your way you http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis
I don't mean to be rude when I say "google it". Personally (ymmv) I learn much more along the way from googling than just having someone give me "the" answer.
Also, when I look for tools, I will go to to SourceForge and look for - in this case - "static code analysis"
Btw, check out Valgrind
Related
Using RedGate's Reflector, you may easily get the full source for an application. But to reduce the chances of an algorithm being found out, there are obfuscators to reduce this likelihood.
My questions are:
How effective are obfuscators?
What is safer in terms of hiding your algorithms: C++ without .NET libraries or obfuscated .NET programs.
Are there any others way to make .NET source code even more secure?
If you definitely want to secure something, go for C++, as in the .NET World there is a powerful deobfuscator named de4dot (see here: https://github.com/0xd4d/de4dot) that deobfuscates what most obfuscators on the market produce, event the ones it does not explicitely know.
However, this will only raise the bar, as even in the c++ world, there are powerful tools also (IDA: http://www.hex-rays.com/products/ida/index.shtml).
There are other solutions, like mixed code assemblies where you can have the part you want to hide in native code and the rest in managed. see here for more: Mixed (Native and Managed) Assemblies
"What is safer in terms to get source code: c++ program without .net libraries or .net obfuscated program." Without .net ofc...
Obfuscated .net .java still easy to decompile. There are pro obfuscators, which makes the code not recompilable those are slow down the hack process a bit.
Have you have heard if something can be closed that can be opened?
even if is writen is Assembly...
Usually beginner programmers are scared about this kind of theft. I would suggest to first create a software part, which worth to be stolen for others ( not for you )
Because .NET is designed to be self-descriptive, using an obfuscator will only hinder their progress. Although decompilers will have reduced readability, anyone understanding MSIL will have a better chance. Even C++ applications will be decompilable at some stage, as the program ultimately gets executed step by step in memory. C++ applications will take longer to work it out, but if a hacker knows Assembler (which they probably would if they are decompiling your application to gain access to the algorithm), its just a matter of time.
Obfuscation is really to make it as difficult as possible in a reasonable timespan, rather than making it impossible. The same principal lies with encryption. Encryption isn't impossible to break, it just takes so long that the context may not be of any use in 70-80 years time.
There are 2 alternatives I can think of apart from the ones covered here:
Host the algorithm at a remote location
Host the algorithm in a hardware component - very very expensive
The first option would be more suited if you have a network connection available. The processing is done on a separate server and the algorithm is not exposed to the public. This is how activation codes work nowadays. A serial code of some sort is generated, encrypted with a public key encryption and sent to a source which will decrypt and validate the data. The response is also encrypted and sent back.
Also, digitally signing your application and your dependencies will also assist as hackers could not plug-in components very easily. If they tried to use a DLL in place of one of your old ones (to fake a call to a service and return "success"), your code would check the digital signature before using the DLL.
So in summary, obfuscating will slow down the process but not prevent it. The only way I can think of is to host that algorithm at a secure location and send requests to it. Yes there is the problem of the hosting scenario, DoS etc, but your algorithm is protected, which is what you wanted.
Try something link this. However it will only obfuscate the strings. To obfuscate function calls, variables and other elements, look for commercial products and services for that purpose.
How effective are obfuscators?
I find ConfuserEx's name, constants, and control flow protection quite effective making .NET code difficult to read.
Using unicode for the Name protection can render class/method/etc names into unreadable unicode.
The constants protection encode constant strings like debug log string which provide excellent hints for hacker to guess what the code is doing.
The control flow scramble your code into a lot of switch-cases.
See below for an example of ConfuserEx'ed C# code:
What is safer in terms of hiding your algorithms: C++ without .NET libraries or obfuscated .NET programs.
If .NET assembly is not obfuscated, then it's like giving away the source code.
Comparing obfuscated .NET and native x86/x64 code, IMO, the difficulty to read them is about the same. Native x86 code can be disassembled into quite readable C code using software like IDA-Pro. Also there are people who can read and understand x86 language really fast.
Are there any others way to make .NET source code even more secure?
There is this Microsoft .NET Native(still in early stage with limitations) that compiles C# code into native x86/x64 code. This is not actually a protection but just people read x86 code slower.
My teacher recommended us to use notepad++ and cygwin for our programming needs. Are there any better solutions anyone can recommend out there to program and compile?
Myriad of various IDE's.... Eclipse CDT, Visual Studio Express, Code::Blocks, DevCPP....
And yes, Notepad++ and Cygwin with gcc would be a very viable option if you only need to compile single files for your homework.
Use a IDE
An integrated development environment (IDE) (also known as integrated design environment, integrated debugging environment or interactive development environment) is a software application that provides comprehensive facilities to computer programmers for software development. An IDE normally consists of:
a source code editor
a compiler and/or an interpreter
build automation tools
a debugger
A few of them to choose from
http://netbeans.org/index.html
http://www.codeblocks.org/
http://www.eclipse.org/cdt/
In my opinion, a very important tool for beginners is a debugger. A lot of question can be answered by yourself if you have a look into the debugger. You can use the gdb but it is hard to use and understand for beginners. So I would recommend to use Visual C++ 2010 Express which has an excellent and easy to use debugger.
Disclaimer:
The following are personal opinions, related to my personal taste on
the subject. Anyone in the programmer community has its own taste and
preferences an can agree or not. Here I just want to tell you about
some rationals. Consider products and related names as "examples."
My Answer
There are mainly three ways to write code:
The manual one
The assisted one
The automated one.
Think to them as:
Driving your car alone
Driving with a navigator
Driving with an autopilot.
Here "driving alone" means "use a generic text editor, a command-line based compiler and a command-line based debugger. The editor may eventually have a clue about the language syntax (thus differentiating different language structural elements, like keyword, literals, operators etc.) but knowing really nothing about what you are coding.
This is what notepad++ does. It makes coding harder, but for very simple things makes you really learn how to "drive".
A "navigator" is a basic IDE like Devc++, or like CodeBlocks: they have the notion of "project", manage the relation between files and manage the invocation of the compiler and debugger, managing the mapping on their output respect to your sources.
You write your own code, but the "road to compile" is told by the "navigator" you have to trust.
An "autopilot" is a more complex IDE (like VisualStudio, Netbeans, Eclipse ...) that can also "manage the code" providing code analysis for either syntax and semantics, context sensitive auto-completion, code generation for common tasks.
They can give you some code you have to complete and connect together.
They make you faster in producing code, testing it, debugging it, but you must have more trust in them or know how they "suggest".
They can be productive, but you have to "configure" them to suite your needs.
Now: since everything is a matter of "trust", and you cannot trust what you don't know yet, and is a matter of "knowing yuur needs" (but a learner may not yet have an idea abut them)
starting with "beasts" like VisualStudio (that mess arout 50% of your computer registry, pretend you to download GIGABYTES from the Internet and installs GIGABYTES of whatever MS library) is clueless: before you will start using all of that, will take years, and VS itself will be changed 2 or three times) or Eclipse (that has the more powerful syntax and semantic analizer, but requires lot of "arcane configuration" you don't even know since you didn't make the first step in programming) may be an excess. At least until your programs will stay in a couple of pages.
starting win notepad++ and GCC (or Mingw) is just a matter of dowload few megabytes, set a PATH, and you go. Fastest way to turn the key on.
when things become more complex, and require some help in organize them, simple IDE like CodeBloks or Codelite are more than effective at "to the point". I will avoid Dev-C++: it's OLD, and doesn't support the "state of art of the C++ language". You an live with them for all your scolarity
when going to more professional kind of projects, and your experience in "using tools" is better, things like Eclipse, or NetBeans may become more "effective". I will in any case avoid VisualStudio: it's not that "effective". But it is the best to develop in Microsoft environments producing MS oriented applications, especially in the ".Net" world. Something you will not see before 2/3 years of experience.
If you're learning you can download VStudio Express. I believe it's free. Easier to use than notepad and cygwin. This isn't a biased opinion. I'm a Linux C++ developer most days but acknowledge the fact that it might be easier to learn using VStudio.
If you are using linux, you can use kate and g++ for editing and compiling c++ files.
If you are using windows, I think your teacher's recommendations are good. Althought there are various IDE's for C++, it is better to use a simple editor that doesn't have code completion and compilation feature while learning a programming language for the first time. IDE's are nice but not good for learners I think.
It's probably a good idea to go with your teacher's suggestion, since you might also need some help in the future, either from him or your colleagues. Another advantage is that, being in school, you'll probably develop using more than one programming language. Notepad++ has support for almost everything you can think of, so you can use it not only for this course. That way you'll have an advantage because you'll learn shortcuts, etc...
If you plan on doing a lot of programming in the future, I highly recommend putting the effort into learning VIM. Nothing else can touch it in terms of speed and power. It has built-in shell access and it is programmable. It is like having God in your text editor. The major down-side is the steep learning curve.
Also, you want to use Git in-case you screw-up and want to go back to a previous point. It lets you periodically check-point your code so you can always go back. For example, maybe you delete something, then later on decide you want to use that code after all. If you've been check-pointing with Git, you can get it back.
Graphical differs sometimes come in handy too.
I started coding in C++ using Turbo C++(the default program available on college computers, I told them it was prehistoric), but then I found Visual Studio Express and never looked back since that day.
Also since i could not install Visual Studio on College computers, I put a portable version of DevC++ on my pen drive to use there.
Eventually I got the College to install Visual Studio Express editions on all Lab Computers (Once I managed to convince them that it was free with no Licensing issues)
For a beginner, go with a text editor and a compiler. Helps you in understanding what actually goes on.
You could use Dev-C++, which is a good compiler for C and C++, if you want lightweight.
Otherwise Visual Studio probably.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
Questions asking us to recommend or find a tool, library or favorite off-site resource are off-topic for Stack Overflow as they tend to attract opinionated answers and spam. Instead, describe the problem and what has been done so far to solve it.
Closed 9 years ago.
Improve this question
I just posted this as part of a reply to a question about the "best" bug-tracking software...
Well, a tool on its own is just a tool. And while all speak of a toolchain, most just mean a loose collection of tools. Why not look for a problem tracker that "plays well with other children"? That is to say, interfaces well with your IDE, your build tool, your version control system ...
In fact, I think I'll go now and ask a question about the best linked toolchain ...
So, any comments? I would prefer replies for developing C/C++ on Linux and using FOSS (but don't let that prevent you posting Windows based answers if you think that it would help someone else). We don't need a complete chain, but maybe a few groups of linked tools are still better than totally separate "links" in the chain)
I use
Eclipse - for coding and debugging, also its plug-ins for
Doxygen for auto code-documentation
Splint and CppCheck for static code analysis
CppUnit for automated testing
Bugzilla, et all for bug tracking
CVS, Subversion, etc, for version control
Hudson - for automated builds, with plug-ins for
Doxygen for auto code-documentation
CppCheck for static code analysis
CppUnit for automated testing
Bugzilla, et all for bug tracking
CVS, Subversion, etc, for version control
I seem to be missing a tool for project management which interfaces with other "links" in the toolchain. How complete can we make it, end to end, and is there a "best" chain (or, at least, one with the most links)?
Edit: Let's not forget requirements tracking and project planning & tracking - end Edit
And has anyone every diagrammed the relationship between various tools (i.e., which interfaces to which, and in which direction; which can export in the import format of another, etc)?
G'day,
In my experience, I have found that trying to come up with a "definitive" tool chain can cause problems.
One of the worst is that it tends to force people into the "everything looks like a nail" approach to projects. That is, You've done the work to select the tools you think are suitable and you now have your tool suite.
In my experience, it is very difficult to get people to change their "canonical set" of tools for other projects once that tool set has been selected and annointed as such.
I've been doing this for over twenty years now in a variety of projects that ranged from on-board submarine sonar simulators to air-traffic control display systems to helicopter control systems. Even within the same company, different projects need different tool sets to address the various problems that are going to be encountered.
You might think that once you've selected a tool for a particular purpose then you can re-use that tool for all projects, e.g. your selection of BugZilla for bug tracking. But what if there is no suitable SMTP server available because you've got a distributed team and your mail server is internal, locked down, secure, for example.
I'd suggest that it would be better to establish a suite of possible tools from which you can select your project's tool suite from. For example, adding Trac or FogBuzz as a possible bug tracking mechanism.
A lot of things can affect your choice of tools. Off the top of my head I've got:
geographical distribution of teams,
internal lock down, i.e. no public access, of servers e.g. email, source repository, test platform, etc,
having to interface to some existing system because of a desire to reuse aspects of that system, e.g. previous teams had had VisualSourceSafe inflicted upon them,
customer insistence on the use of a particular platform,
the management team for a new project having requirements that differ from the previous management team for regular management type reports,
etc.
Having a suite of possibilities minimises the effect of "trying to squeeze a square peg into a round hole".
Anyway, you might find that you're able to trim down your suite of possibilities after a while because you can demonstrate a successful approach and so get enough traction within the company for the support of doing things the way you've previously done them.
HTH
I think the Unix philosophy militates against these kinds of tightly integrated toolchains. It's no accident that Eclipse, the first thing you mention, came from the Java world. Unix (and by extension, Linux) tends to believe less in things called "plugins" and more in sets of tools that share data stored in flat text files.
By "project management" I'm not sure if you mean something like Make or something to keep track of your team's progress. If you mean something like Make, the Unix world sorely needs a reusable Make that supports "smart recompilation" and will work with multiple compilers. The closest thing is Glenn Fowler's nmake, but that's not very close.
Regarding integrate toolsets more generally,
The best set of tools I've seen are the Advanced Software Technology tools built at AT&T. There's a most excellent book Practical Reusable Unix Software, free to download, which describes the state of play circa 1995. Since then the toolset has only gotten better and richer, but to get an overview of what the hell is going on, you really need the book. These guys started with the Unix group at Bell Labs, and what they've created is not so much a toolchain but a way of life. Joe Bob says check it out.
The other ubiquitous element in many Unix toolchains is (and this is likely to make you laugh or puke) Emacs. Although Emacs Lisp is not anyone's favorite way to write plugins or extensions, sheer accumulation over time has made Emacs into a very rich, powerful programming environment—and it talks to all sorts of other tools. I'm into simplicity, not complexity, so I try to keep to shallow water, but if you're serious about investigating toolchains for Unix, it's something to know about.
I'm looking forward to seeing more answers to your question.
Well its not FOSS but Rational supplies a complete tool chain (except for the compilers!),
You get IDEs, Class diagrams, use cases, requirements tracking, test tools, problem logging tools which integrate well all for a few thousand (or hundreds of) dollars.
None (aprt from the modeling tools) is best of breed, but, they are all pretty good and integrate well with each other.
Disclaimer:-
My "toolset" of choice is vim,make, ddd, gmail and a moleskin notebook for modeling.
When programming in C++ in Visual Studio 2008, why is there no functionality like that seen in the refactor menu when using C#?
I use Rename constantly and you really miss it when it's not there. I'm sure you can get plugins that offer this, but why isn't it integrated in to the IDE when using C++? Is this due to some gotcha in the way that C++ must be parsed?
The syntax and semantics of C++ make it incredibly difficult to correctly implement refactoring functionality. It's possible to implement something relatively simple to cover 90% of the cases, but in the remaining 10% of cases that simple solution will horribly break your code by changing things you never wanted to change.
Read http://yosefk.com/c++fqa/defective.html#defect-8 for a brief discussion of the difficulties that any refactoring code in C++ has to deal with.
Microsoft has evidently decided to punt on this particular feature for C++, leaving it up to third-party developers to do what they can.
I'm not sure why it is like this, but third-party tools exist that help. For example, right now I'm evaluating Visual Assist X (by Whole Tomato). We're also using Visual Studio 2005.
devexpress provides Add-in Refactor! for C++ for VS2005 and VS2008.
Don't feel hard-done-by, it isn't available in VB.Net either :)
C++ is a HARD language to parse compared with C# (VB too unless you've "Option Explicit" and "Option Strict" switched on, it's difficult to tell exactly what any line of code is doing out of a MUCH larger context).
At a guess it could have something to do with the "difficulty" of providing it.
P.S. I marked my answer as community wiki because I know it's not providing any useful information.
Eclipse does few c++ refactorings including 'rename'. Check out this question here on StackOverflow.
It is also possible to use Microsoft compiler with Eclipse. Check out here.
Try Eclipse and see if it fits for you.
There is a lot of fud and confusion around this issue. This amazing youtube video should clear up why C++ refactoring is hard: https://www.youtube.com/watch?v=mVbDzTM21BQ
tl;dr Google refactors their entire 100 million line C++ codebase by using a compiler (Clang + LLVM) that allows access to its intermediate format.
Bottom line, third parties are screwed here, there is no realistic way for them to refactor VS C++ unless MS outputs intermediate results the same way. If you think of it from the programming problem perspective this is obvious: in order to refactor VS C++ you have to be able to compile C++ the exact same way VS does with the same bugs, limitations, flaws, hacks, shortcuts, workarounds, etc. The usual suspects like Coderush and Resharper do not have the budget for that kind of insanity although apparently they are trying but it has been years...
http://www.jetbrains.com/resharper-cpp/
Update 2016: Resharper now does a decent job at C++ refactor. Limitations are purely for large / gigantic projects.
MS has finally done this: https://channel9.msdn.com/Shows/C9-GoingNative/GoingNative-33-C-Refactoring-in-Visual-Studio-2015#time=04m37s
They have started doing this about 10 years ago, I remember watching ms channel9 long ago.
I've been using Visual Assist X with visual studio for about one year and a half. It's an incredible tool that helps you a lot with ordinary C++ code, but it doesn't perform very well on templated code. For instance, you if have a sophisticated policy-based template design, it won't know how to rename your variables, and the project won't compile anymore.
Install plugin which enables you that functionality: https://visualstudiogallery.msdn.microsoft.com/164904b2-3b47-417f-9b6b-fdd35757d194
I'd like to point out that Qt Creator (a C++ IDE which is compatible with VC++ libraries and build system) provides symbol renaming that works very well:
You can rename symbols in all files in a project. When you rename a class, you can also change filenames that match the class name.
Qt Creator - Refactoring: Renaming Symbols
Qt Creator's rename functionality gives you a list of the symbol references it found and an opportunity to exclude any of them before performing the replace. So if it gets a symbol reference wrong, you can exclude it.
So C++ symbol renaming is possible. Coming to VS from Qt Creator I feel your pain, to the point where I've considered converting preexisting VS projects of considerable size to use Qt Creator instead.
I don't buy the argument that this is specifically hard in C++. In addition to the fact that it already works very well in Qt Creator, there's the fact that the compiler and linker can find and match symbols: If that wasn't possible you couldn't build your application.
In fact, languages like Python that are dynamically typed also have renaming tools. If you can create such a tool for a language where there are no explicit references to variable type you can definitely do it for C++.
Case in point:
... Rope, a python refactoring library... I tried it for a few renames, and that definitely worked as expected.
Stack Overflow - What refactoring tools do you use for Python?
Well in spite of comments by all you experts I totally disagree that refactoring support issue has something to do with C++ language semantics or any language semantics for that matter. Except the compiler builder themselves don't choose to implement one in first case due to their own reasons or constraints whatsoever they maybe.
And offense not to be taken but I am sorry to say Mr jsb the above link you provided to support your case (i.e of yosefk) about C++ defect is totally out of question. Its more like you providing direction to "Los angeles" when someone asked for of "San Franisco".
In my opinion raising refactoring difficulty issue for certain language is more like raising a finger on language integrity itself. Especially for languages which is sometimes just pain.... when it comes to their variable declaration and use. :) Okay! tell me how come you loose track of some node within a node tree ... eh? So what it is do with any language be it as simple as machine level code. You know you VS compiler can easily detect if some variable or routine is dead code. Got my point?
About developing third party tool. I think compiler vendors can implement it far more easily and effectively if they ever wanted to then a third party tool which will have to duplicate all the parsing database to handle it. Nowadays compiler can optimize code very efficiently at machine code level and I am hearing here that its difficult to tell how some variable is used previously. You haven't paid any real attention to inner working of compiler I suppose. What database it keep within.
And sure its the almost same database that IDE use for all such similar purposes. In previous time compiler were just a separate entity and IDE just a Text Editor with some specialization but as times goes by the gap between compiler and IDE Editor become less and its directly started working on similar parsed database. Which makes it possible to handle all those intellisense and refactoring or other syntax related issues more effectively. With all precompile things and JIT compiling this gap is almost negligent. So it almost make sense to use same database for both purpose or else your memory demand go higher due to duplication.
You all are programmers - I am not! And you guys seems to be having difficulty visualizing how refactoring can be implemented for C++ or any language that I can't comprehend. Its just all about for something you have to put more effort for some less depending on how heavy is a person you trying push.
Anyway way VS a nice IDE especially when it comes to C#.
There are plenty of logging/trace systems for letting your program output data or strings or state as it runs. Most of these let you print arbitrary strings which you can view live or after your program runs.
I noticed an ad here on SO for Smartinspect which seems to take this to a higher level, giving stack traces for each log, fancier options like plotting graphs and data values which change over time, and a lot of polish to the basic idea of a simple list of output text strings.
Since I use C++, Smartinspect won't even work for me.
A little googling finds tons of logging frameworks, but nothing that seems to do anything more than text dumps. Are their fancier tools (similar to Smartinspect?) that do more? Commercial or open source is fine, and multiplatform is a big plus.
I know this is not the answer you are most probably looking for but I would suggest that such a framework will be very hard (if not impossible) to find for C++. Doing something like dumping the stack cannot be done in a portable way as it can in a language like Java, which not only shares a common runtime accross all platforms, but provides powerful introspection capabilities too.
I don't program in Java, but my guess is that it can provide a stack-trace in the same way as Python: the stack is probably just another object in the runtime which can be inspected and manipulated.
C++ on the other hand has none of these niceities: its meant to be a close-to-the-metal language that basically adds object-orientism to C (I'm sure others will come up with much more elanorate explanations of C++'s benefit's over C but thats another discussion).
In short, C++ is not rich enough at the level required to provide the kind of features you require in a generic way. There may be some platform-specific code that could get some of this info at defined points for you out there, but it certainly wont be standards compliant, cross-platform C++.
With regards to graphs etc, that sounds much more like post-processing, which you should either be able to find something for, or more likely, you can perhaps output your log messages in a format which can be interpreted by some of these existing tools.
Other things you could look at would be integrating with syslogd, for which again, there may be richer analysis tools for (this would provide you with a capability along the lines of the one advertised for SmartInspect - that is TCP/IP based logging).
NB: a lot of what I said here about C++ comes from previous experiences trying to find decent frameworks in C++ to do tweaky, introspective type things (such as proper mock objects etc).
I wrote a article about dumping the stack in C/C++ with Windows and Unix/Linux at DDJ some years ago. Maybe it helps you:
See http://www.ddj.com/architect/185300443
If you can restrict yourself to a certain platform you can add stack traces to your logs manually. We use e.g. the glibc functionality to get stack traces on Linux to attach stack traces into our exception class. There is similar functionalyty available on Windows, but as mentioned these infrastructures are not portable.