{"id":11743,"date":"2026-02-24T17:33:48","date_gmt":"2026-02-24T16:33:48","guid":{"rendered":"https:\/\/republify.se\/?post_type=product&p=11743"},"modified":"2026-02-24T17:46:46","modified_gmt":"2026-02-24T16:46:46","slug":"secure-coding-in-c-and-c-plus-plus","status":"publish","type":"product","link":"https:\/\/republify.se\/index.php\/produkt\/secure-coding-in-c-and-c-plus-plus\/","title":{"rendered":"Secure coding in C and C++"},"content":{"rendered":"
\n
\n
\n
\n
\n

Day 1<\/strong><\/h2>\n<\/div>\n
\n
\n
    \n
  • Cyber security basics\n
      \n
    • What is security?<\/li>\n
    • Threat and risk<\/li>\n
    • Cyber security threat types \u2013 the CIA triad<\/li>\n
    • Cyber security threat types \u2013 the STRIDE model<\/li>\n
    • Consequences of insecure software<\/li>\n<\/ul>\n<\/li>\n
    • Memory management vulnerabilities\n
        \n
      • Assembly basics and calling conventions\n
          \n
        • x64 assembly essentials<\/li>\n
        • Registers and addressing<\/li>\n
        • Most common instructions<\/li>\n
        • Calling conventions on x64\n
            \n
          • Calling convention \u2013 what it is all about<\/li>\n
          • Calling convention on x64<\/li>\n
          • The stack frame<\/li>\n
          • Stacked function calls<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
          • Buffer overflow\n
              \n
            • Memory management and security<\/li>\n
            • Vulnerabilities in the real world<\/li>\n
            • Buffer security issues<\/li>\n
            • Buffer overflow on the stack\n
                \n
              • Buffer overflow on the stack \u2013 stack smashing<\/li>\n
              • Exploitation \u2013 Hijacking the control flow<\/li>\n
              • Lab \u2013 Buffer overflow 101, code reuse<\/li>\n
              • Exploitation \u2013 Arbitrary code execution<\/li>\n
              • Injecting shellcode<\/li>\n
              • Lab \u2013 Code injection, exploitation with shellcode<\/li>\n
              • Case study \u2013 Stack BOF in FriendlyName handling of the Wemo Smart Plug<\/li>\n<\/ul>\n<\/li>\n
              • Buffer overflow on the heap\n
                  \n
                • Unsafe unlinking<\/li>\n
                • Case study \u2013 Heap BOF in WinRAR<\/li>\n<\/ul>\n<\/li>\n
                • Pointer manipulation\n
                    \n
                  • Modification of jump tables<\/li>\n
                  • Overwriting function pointers<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
                  • Best practices and some typical mistakes\n
                      \n
                    • Unsafe functions<\/li>\n
                    • Dealing with unsafe functions<\/li>\n
                    • Lab \u2013 Fixing buffer overflow<\/li>\n
                    • Using std::string in C++<\/li>\n
                    • Unterminated strings<\/li>\n
                    • Manipulating C-style strings in C++<\/li>\n
                    • Malicious string termination<\/li>\n
                    • Lab \u2013 String termination confusion<\/li>\n
                    • String length calculation mistakes<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

                       <\/p>\n

                      Day 2<\/strong><\/h2>\n
                      \n
                      \n
                        \n
                      • Memory management hardening\n
                          \n
                        • Securing the toolchain\n
                            \n
                          • Securing the toolchain in C and C++<\/li>\n
                          • AddressSanitizer (ASan)\n
                              \n
                            • Using AddressSanitizer (ASan)<\/li>\n
                            • Lab \u2013 Using AddressSanitizer<\/li>\n<\/ul>\n<\/li>\n
                            • Stack smashing protection\n
                                \n
                              • Detecting BoF with a stack canary<\/li>\n
                              • Argument cloning<\/li>\n
                              • Stack smashing protection on various platforms<\/li>\n
                              • SSP changes to the prologue and epilogue<\/li>\n
                              • Lab \u2013 Effects of stack smashing protection<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
                              • Runtime protections\n
                                  \n
                                • Runtime instrumentation<\/li>\n
                                • Address Space Layout Randomization (ASLR)\n
                                    \n
                                  • ASLR on various platforms<\/li>\n
                                  • Lab \u2013 Effects of ASLR<\/li>\n
                                  • Circumventing ASLR \u2013 NOP sleds<\/li>\n<\/ul>\n<\/li>\n
                                  • Non-executable memory areas\n
                                      \n
                                    • The NX bit<\/li>\n
                                    • Write XOR Execute (W^X)<\/li>\n
                                    • NX on various platforms<\/li>\n
                                    • Lab \u2013 Effects of NX<\/li>\n
                                    • NX circumvention \u2013 Code reuse attacks\n
                                        \n
                                      • Return-to-libc \/ arc injection<\/li>\n<\/ul>\n<\/li>\n
                                      • Return Oriented Programming (ROP)\n
                                          \n
                                        • Protection against ROP<\/li>\n
                                        • Case study \u2013 Systematic exploitation of a MediaTek buffer overflow<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
                                        • Common software security weaknesses\n
                                            \n
                                          • Security features\n
                                              \n
                                            • Authentication<\/li>\n
                                            • Password management\n
                                                \n
                                              • Inbound password management\n
                                                  \n
                                                • Storing account passwords<\/li>\n
                                                • Password in transit<\/li>\n
                                                • Lab \u2013 Is just hashing passwords enough?<\/li>\n
                                                • Dictionary attacks and brute forcing<\/li>\n
                                                • Salting<\/li>\n
                                                • Adaptive hash functions for password storage<\/li>\n
                                                • Password policy\n
                                                    \n
                                                  • NIST authenticator requirements for memorized secrets<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
                                                  • Outbound password management\n
                                                      \n
                                                    • Hard coded passwords<\/li>\n
                                                    • Best practices<\/li>\n
                                                    • Lab \u2013 Hardcoded password<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
                                                    • Code quality\n
                                                        \n
                                                      • Code quality and security<\/li>\n
                                                      • Data handling\n
                                                          \n
                                                        • Type mismatch<\/li>\n
                                                        • Lab \u2013 Type mismatch<\/li>\n
                                                        • Initialization and cleanup\n
                                                            \n
                                                          • Constructors and destructors<\/li>\n
                                                          • Initialization of static objects<\/li>\n
                                                          • Lab \u2013 Initialization cycles<\/li>\n
                                                          • Array disposal in C++<\/li>\n
                                                          • Lab \u2013 Mixing delete and delete[]<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
                                                          • Memory and pointers\n
                                                              \n
                                                            • Memory and pointer issues<\/li>\n
                                                            • Pointer handling pitfalls<\/li>\n
                                                            • Null pointers\n
                                                                \n
                                                              • NULL dereference<\/li>\n
                                                              • NULL dereference in pointer-to-member operators<\/li>\n<\/ul>\n<\/li>\n
                                                              • Pointer usage in C and C++\n
                                                                  \n
                                                                • Use after free<\/li>\n
                                                                • Lab \u2013 Use after free<\/li>\n
                                                                • Lab \u2013 Runtime instrumentation<\/li>\n
                                                                • Double free<\/li>\n
                                                                • Case study \u2013 UAF and double free in netfilter<\/li>\n
                                                                • Smart pointers<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

                                                                  Day 3<\/strong><\/h2>\n<\/div>\n
                                                                    \n
                                                                  • Common software security weaknesses\n
                                                                      \n
                                                                    • Input validation\n
                                                                        \n
                                                                      • Input validation principles<\/li>\n
                                                                      • Denylists and allowlists<\/li>\n
                                                                      • What to validate \u2013 the attack surface<\/li>\n
                                                                      • Where to validate \u2013 defense in depth<\/li>\n
                                                                      • When to validate \u2013 validation vs transformations<\/li>\n
                                                                      • Validation with regex<\/li>\n
                                                                      • Regular expression denial of service (ReDoS)<\/li>\n
                                                                      • Lab \u2013 ReDoS<\/li>\n
                                                                      • Dealing with ReDoS<\/li>\n
                                                                      • Injection\n
                                                                          \n
                                                                        • Code injection\n
                                                                            \n
                                                                          • OS command injection\n
                                                                              \n
                                                                            • Lab \u2013 Command injection<\/li>\n
                                                                            • OS command injection best practices<\/li>\n
                                                                            • Avoiding command injection with the right APIs<\/li>\n
                                                                            • Lab \u2013 Command injection best practices<\/li>\n
                                                                            • Case study \u2013 Shellshock<\/li>\n
                                                                            • Lab \u2013 Shellshock<\/li>\n
                                                                            • Case study \u2013 Command injection in Zyxel IKE packet decoder<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
                                                                            • Process control\n
                                                                                \n
                                                                              • Library injection<\/li>\n
                                                                              • Lab \u2013 Library hijacking<\/li>\n
                                                                              • Library injection best practices<\/li>\n<\/ul>\n<\/li>\n
                                                                              • Integer handling problems\n
                                                                                  \n
                                                                                • Representing signed numbers<\/li>\n
                                                                                • Integer visualization<\/li>\n
                                                                                • Integer promotion<\/li>\n
                                                                                • Integer overflow<\/li>\n
                                                                                • Lab \u2013 Integer overflow<\/li>\n
                                                                                • Signed \/ unsigned confusion<\/li>\n
                                                                                • Case study \u2013 Signed\/unsigned confusion DoS in DrayTek Vigor routers<\/li>\n
                                                                                • Lab \u2013 Signed \/ unsigned confusion<\/li>\n
                                                                                • Integer truncation<\/li>\n
                                                                                • Lab \u2013 Integer truncation<\/li>\n
                                                                                • Case study \u2013 WannaCry<\/li>\n
                                                                                • Best practices\n
                                                                                    \n
                                                                                  • Upcasting<\/li>\n
                                                                                  • Precondition testing<\/li>\n
                                                                                  • Postcondition testing<\/li>\n
                                                                                  • Best practices in C++<\/li>\n
                                                                                  • Lab \u2013 Integer handling best practices in C++<\/li>\n
                                                                                  • Case study \u2013 Integer check failure in Skia<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
                                                                                  • Files and streams\n
                                                                                      \n
                                                                                    • Path traversal<\/li>\n
                                                                                    • Lab \u2013 Path traversal<\/li>\n
                                                                                    • Path traversal best practices<\/li>\n
                                                                                    • Lab \u2013 Path canonicalization<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
                                                                                    • Wrap up\n
                                                                                        \n
                                                                                      • Secure coding principles\n
                                                                                          \n
                                                                                        • Principles of robust programming by Matt Bishop<\/li>\n
                                                                                        • Secure design principles of Saltzer and Schroeder<\/li>\n<\/ul>\n<\/li>\n
                                                                                        • And now what?\n
                                                                                            \n
                                                                                          • Software security sources and further reading<\/li>\n
                                                                                          • C and C++ resources<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

                                                                                             <\/p>\n<\/div>\n

                                                                                            \n
                                                                                            \n

                                                                                            Kursen levereras i samarbete med<\/h3>\n

                                                                                            \"\"<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

                                                                                            Your application written in C and C++ works as intended, so you are done, right? But did you consider feeding in incorrect values? 16Gbs of data? A null? An apostrophe? Negative numbers, or specifically -1 or -2^31<\/sup>? Because that’s what the bad guys will do \u2013 and the list is far from complete.<\/strong><\/p>\n

                                                                                            Handling security needs a healthy level of paranoia, and this is what this course provides: a strong emotional engagement by lots of hands-on labs and stories from real life, all to substantially improve code hygiene. Mistakes, consequences, and best practices are our blood, sweat and tears.<\/p>\n

                                                                                            All this is put in the context of C and C++, and extended by core programming issues, discussing security pitfalls of these languages.<\/strong><\/p>\n

                                                                                            So that you are prepared for the forces of the dark side.\u00a0So that nothing unexpected happens.\u00a0Nothing.<\/em><\/p>\n","protected":false},"featured_media":11746,"comment_status":"open","ping_status":"closed","template":"","meta":{"wds_primary_product_brand":0,"wds_primary_product_cat":0},"product_brand":[],"product_cat":[77,57,31],"product_tag":[],"class_list":{"0":"post-11743","1":"product","2":"type-product","3":"status-publish","4":"has-post-thumbnail","6":"product_cat-c-technical","7":"product_cat-secure-coding","8":"product_cat-security","10":"first","11":"instock","12":"taxable","13":"shipping-taxable","14":"purchasable","15":"product-type-simple"},"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/republify.se\/index.php\/wp-json\/wp\/v2\/product\/11743","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/republify.se\/index.php\/wp-json\/wp\/v2\/product"}],"about":[{"href":"https:\/\/republify.se\/index.php\/wp-json\/wp\/v2\/types\/product"}],"replies":[{"embeddable":true,"href":"https:\/\/republify.se\/index.php\/wp-json\/wp\/v2\/comments?post=11743"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/republify.se\/index.php\/wp-json\/wp\/v2\/media\/11746"}],"wp:attachment":[{"href":"https:\/\/republify.se\/index.php\/wp-json\/wp\/v2\/media?parent=11743"}],"wp:term":[{"taxonomy":"product_brand","embeddable":true,"href":"https:\/\/republify.se\/index.php\/wp-json\/wp\/v2\/product_brand?post=11743"},{"taxonomy":"product_cat","embeddable":true,"href":"https:\/\/republify.se\/index.php\/wp-json\/wp\/v2\/product_cat?post=11743"},{"taxonomy":"product_tag","embeddable":true,"href":"https:\/\/republify.se\/index.php\/wp-json\/wp\/v2\/product_tag?post=11743"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}