Source Code Auditing Tools

Source Code Auditing Tools
Many source code auditing tools are freely available on the Internet. Some of the more common ones include ITS4, RATS (Rough Auditing Tool for Security), Flawfinder, and Splint (Secure Programming Lint). 

 The command line for RATS example here examined:

# ./rats -i -w 1 -d rats-c.xml find.c

Many programming languages allow the programmer to ignore the values returned by functions.This is a dangerous practice because function return values are often used to indicate error conditions.Assuming that all functions complete successfully is another common programming problem that leads to crashes.

In example:

If you are writing a Java program to construct 2 parameters, as such:

public static string getWord(String num, int mon){

 ...... Pre & post conditions
.... Statements 


return num; }

BugScam - IDC utillity ( Scripting language for IDA )

Ever considered how in the world you are going to analyse your binary file when doing Computer Forensics ? - well here's a solution to the given GUI, of IDA - which has it's own scripting language called IDC. 

IDC has a feature to apply BugScam to it, and BugScam handles all the analysis of the code and break it down to read-able code. You might not have a clue what this mov, esp, esi, 0x41, means.
But it will help you understand when using BugScam. Great resource avaliable here...


http://www.openrce.org/downloads/details/69/Bugscam

References 

Hex Blog www.hexblog.com
Hex-Rays forum www.hex-rays.com/forum
“IDA Plug-in Writing in C/C++ Tutorial” (Steve Micallef) http://binarypool.com/idapluginwriting/
IDAPython plug-in code.google.com/p/idapython/
IdaRub plug-in www.metasploit.com/users/spoonm/idarub/ ida-x86emu plug-in sourceforge.net/projects/ida-x86emu/ OpenRCE forums www.openrce.org/forums/

PDF forensics tool

Dear Readers,

 Time is going fluently, and I'm reading a lot atm.
to also contribute with something from my learning experience, I decided to do a few updates meanwhile.. 

Buckkel up! - because I'm going to soon also release something new which I have learned within the scope of this book. Though, I'm not done with reading  -
Gray Hat Hacking The Ethical Hackers Handbook, 3rd Edition

Ever wanted to know if you were infected by some third-party malicious PDF file? - pdf-parser, is a great utillity to reference and check for such things. You might not be able to read Opcode, but this helps to break the things down.. Dider Stevens, wrote a great Python script:

http://blog.didierstevens.com/programs/pdf-tools/