F = T ∇ Sτ

In spite of its age, C programming language is still very popular, especially for developing system or low-level software like drivers, compilers, virtual machines etc. And as any software, it have to be tested. Let me show brief introduction in unit-testing for C modules. There are many unit-testing frameworks for C, and one of the most well-known is cmockery . But I'll show the usage of much more simpler "framework" - FCTX . The main advantage of it is that it consists of just one header file, so it can be easily used for test tasks, small projects and examples. For calculating code coverage I use gcov / lcov tools. Gcov is included in GCC, so you don't have to install it. Lcov is a graphical front-end for Gcov and should be installed from the repository: $ sudo apt-get install lcov As a sample code for testing I'll use a simple hash function from Robert Sedgwicks Algorithms in C book: #include "hash.h" unsigned int RSHash(char* str, uns...

The short answer - yes . The reasons are below: There are well-knows systems (like YouTube) that shows Python suitability: YouTube Architecture The most performance problems are related with not a language speed, but with communication and databases speed. Let me show the example from my own experience: I've worked on project that process a huge amount of data (about inserting 100-200k records a day, and selecting from about 100-200 million records 10-20 times per second). The bottleneck was a database, not the language speed. All indexes were pretty complex, and selecting can take up to 30-90 seconds which was inappropriate. We had to change architecture: use data pool, caches, AMQP (with RabbitMQ server), and after that we don't know any problems at all with performance. Right tools means everything. For example, if you have to serve enormous web-requests, just use the suitable webserver like Tornado . Especially it is useful for serving Comet -based web applications. A...

Novice security researchers can reach an impasse analyzing the such-like JS-code (it generates an alert): (É=[Å=[],µ=!Å+Å][µ[È=-~-~++Å]+({}+Å) [Ç=!!Å+µ,ª=Ç[Å]+Ç[+!Å],Å]+ª])() [µ[Å]+µ[Å+Å]+Ç[È]+ª](Å)  I would like to remove the veil of secrecy, and explain how it works. It uses several JS-rules: implicit type conversion; arrays indexing; string and arithmetic operations (unary and binary); JSON-based object creation; referencing the global object ( window ) using some functions with invalid or empty parameters; accessing properties by bracket notation. Let me show it in action via JavaScript Shell : [] //explicit empty array declaration ![] //implicit conversion to the Boolean value false []+![] //implicit conversion to the String value false ([]+![])[3] //get a char by index 3 s a=[],++a //implicit conversion to the Integer value 1 ([]+![])[a=[],++a] //use several implicit conversion, get a char by index 1 a {} //explicit empty object creatio...

I'm now in Vancouver, BC, handling all the issues related with immigration. My laptop went out of order right before the departure, so I can't be online all the time I want. But anyway I'll try to get a new one as soon as possible and continue working. I'm publishing all the materials related to the immigration and settling down in Vancouver at my microblog on the Tumblr (in Russian): http://nuald.tumblr.com/

Link: https://addons.mozilla.org/en-US/thunderbird/addon/14781/ Now it's compatible with Thunderbird 3.x. The language for checking is correlated with the Spell Checker language. Sorry for delay, but my work load can't give me enough time to support it well. Future plans: Support inline highlighting. Backend is almost ready, but there are some problems with frontend - I just don't know how to properly modify DOM of the opened message compose window. Looks like I have to use/hook some JS-events, but my current research gives nothing. Move to After The Deadline server instead of LT server-mode. LT is integrated to AtD server (see the News section on http://www.languagetool.org/ ). However, there is a problem with the current AtD server - it doesn't work locally now: http://openatd.trac.wordpress.org/ticket/217 . Until they fix the problem, I can't recommend to use it. Implement pure JS-based Grammar Checker engine. See below the notes. All of these require...

Shellcode can be seen as a list of instructions that has been developed in a manner that allows it to be injected in an application during runtime. Each security researcher face the shellcodes during their work, and in this article I'll show how to detect shellcodes using Python (via libemu Python binding). Few words about libemu : libemu is a small library written in C offering basic x86 emulation and shellcode detection using GetPC heuristics. Intended use is within network intrusion/prevention detections and honeypots. The information on the site is not actual in some places, so I'll give direct and clear instruction how to get and install libemu. Clone the git repository: $ git clone git://git.carnivore.it/libemu.git Firstly, configure, make and install libemu itself (without binding): $ autoreconf -v -i $ ./configure --prefix=/opt/libemu $ make $ sudo make install If you set up prefix as shown above, you have to add the library path to /etc/ld.so.conf file...

In previous article I've shown the using of windows/browser/ms10_018_ie_behaviors exploit. In many cases trying exploits one by one is not acceptable, so the auxiliary modules have been created. One of these - server/browser_autopwn : This module uses a combination of client-side and server-side techniques to fingerprint HTTP clients and then automatically exploit them. After successful attack it creates Meterpreter session, so you can gain a full access to target. Meterpreter is a set of tools for interacting with processes, networking, and the file system of the target. In this article we will dump the SAM hash of the target system and decrypt it using ophcrack . Let's go directly to the actions (set the LHOST parameter according to your environment): $ msfconsole                 _                  _   ...