dev-cpp-users — Dev-C++ users discussion list

Re: [Dev-C++] ?

[David M. <ci...@ya...>]

May I see the code you are trying to compile and/or the errors you are having?
  ----- Original Message ----- 
  From:   Just Jef 
  To: dev...@li...   
  Sent: Sunday, August 17, 2003 12:10   PM
  Subject: [Dev-C++] ?
  

    I am having problems following the Help files and trying to write my   first program?
   
  Any thoughts ....
   
  It dosen't like my library and linking ....
   
  Thanx Jef
   



---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software

[Dev-C++] ?

[Just J. <ju...@sh...>]

I am having problems following the Help files and trying to write my first program?

Any thoughts ....

It dosen't like my library and linking ....

Thanx Jef

RE: [Dev-C++] bit extraction problem

[Per W. <pw...@ia...>]

One alternative is to count the number of digits, and take the log.

One decimal digit consumes 1/log(2) binary digits,
or approx 3.322 bits. However, it is still only possible to get close to
the true limit - since the log of a number needs at least as many
value-digits as the number for an exact result :-)

Another approach - which is exact - is to perform the decimal->binary
conversion in own code, and for each added decimal digit check if the
binary number overflows. For a positive number decimal input number, the
resulting binary should increase for each iteration. If the input number
is negative, it is simple to check for overflow by negating the result
twice and check that the original value was returned.

For a traditional machine with two-complement handling, a negation at the
end will not overflow. However, I'm not sure if that is true for all
strange machines out there, that uses other ways of encoding negative
numbers. Maybe it is possible to negate a number twice and check if
original value is returned. Anyway, right now, 2-complement rulez :-)

/Per W

On Sun, 17 Aug 2003, Ioannis Vranos wrote:

> > -----Original Message-----
> > From: dev...@li...
> > [mailto:dev...@li...] On Behalf
> > Of Dawood Vora
> > Sent: Sunday, August 17, 2003 10:07 AM
> > To: Dev C++
> > Subject: [Dev-C++] bit extraction problem
> >
> >
> > bit extraction problem
> >
> > Below is a program to extract the layout of the bits from an integer.
> > It works fine, if the input number is within the range of
> > long type of int.
> > It is suppose to give me a message, if the input number is
> > either greater
> > than the max limits of long or lower than the min limits of
> > long.  But it
> > does not.  Apparently the offending line is : "cin>>x;"  If x
> > is not able
> > to accommodate any input number it simply stores the number 2
> > as per my
> > system.  Does anybody know, how to solve this problem.
>
>
> Read the number as a string so as to be sure that it fits however large the
> "value" is. Then make some trick to see if it is within
> numeric_limits<long>::max(), numeric_limits<long>::min() (defined in
> <limits> which are the equivalent of LONG_MIN and LONG_MAX defined in
> <climits>).
>
>
>
>
>
>
> Ioannis Vranos
>
> * Programming pages: http://www.noicys.freeurl.com
> * Alternative URL 1: http://run.to/noicys
> * Alternative URL 2: http://www.noicys.cjb.net
>
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
> _______________________________________________
> Dev-cpp-users mailing list
> Dev...@li...
> TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users
>

RE: [Dev-C++] bit extraction problem

[Ioannis V. <iv...@em...>]

> -----Original Message-----
> From: dev...@li... 
> [mailto:dev...@li...] On Behalf 
> Of Dawood Vora
> Sent: Sunday, August 17, 2003 10:07 AM
> To: Dev C++
> Subject: [Dev-C++] bit extraction problem
> 
> 
> bit extraction problem
> 
> Below is a program to extract the layout of the bits from an integer.
> It works fine, if the input number is within the range of 
> long type of int.
> It is suppose to give me a message, if the input number is 
> either greater 
> than the max limits of long or lower than the min limits of 
> long.  But it 
> does not.  Apparently the offending line is : "cin>>x;"  If x 
> is not able 
> to accommodate any input number it simply stores the number 2 
> as per my 
> system.  Does anybody know, how to solve this problem.


Read the number as a string so as to be sure that it fits however large the
"value" is. Then make some trick to see if it is within
numeric_limits<long>::max(), numeric_limits<long>::min() (defined in
<limits> which are the equivalent of LONG_MIN and LONG_MAX defined in
<climits>).






Ioannis Vranos
 
* Programming pages: http://www.noicys.freeurl.com
* Alternative URL 1: http://run.to/noicys
* Alternative URL 2: http://www.noicys.cjb.net

Re: [Dev-C++] How do I store HUGE numbers.

[Per W. <pw...@ia...>]

GMP isn't just big integers - it also contains code for big real numbers.

/Per W

On Sun, 17 Aug 2003, Hossein Haeri wrote:

> Dear Per,
>
> > Have you looked at the GNU MP library (GMP).
> > http://www.swox.com/gmp/
>
> Thank you for informing me about a new link.
>
> > It has good documentation, a large number of functions, and is well
> > tested.
>
> Oh yeah! It seems so (and I'm sure that's actually the case).
> But, maybe it is not that bad to let my library to be tested.
> Anyway, if David needs a reliably tested library, there is
> another one that is so reliable in comparison with mine. I don't
> have a direct link to it, but it is (likely to be) named BigInt
> (or some variation of it) , and it is somewhere whithin the boost
> huge repository. It is best to search for it in:
>
> http://www.boost.org
>
> Regards,
> --Hossein
>
> --
> __________________________________________________________
> Sign-up for your own personalized E-mail at Mail.com
> http://www.mail.com/?sr=signup
>
> CareerBuilder.com has over 400,000 jobs. Be smarter about your job search
> http://corp.mail.com/careers
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
> _______________________________________________
> Dev-cpp-users mailing list
> Dev...@li...
> TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users
>

Re: [Dev-C++] How do I store HUGE numbers.

[Hossein H. <ult...@em...>]

Dear Per,

> Have you looked at the GNU MP library (GMP).
> http://www.swox.com/gmp/

Thank you for informing me about a new link.

> It has good documentation, a large number of functions, and is well
> tested.

Oh yeah! It seems so (and I'm sure that's actually the case).
But, maybe it is not that bad to let my library to be tested.
Anyway, if David needs a reliably tested library, there is
another one that is so reliable in comparison with mine. I don't
have a direct link to it, but it is (likely to be) named BigInt
(or some variation of it) , and it is somewhere whithin the boost
huge repository. It is best to search for it in:

http://www.boost.org

Regards,
--Hossein

-- 
__________________________________________________________
Sign-up for your own personalized E-mail at Mail.com
http://www.mail.com/?sr=signup

CareerBuilder.com has over 400,000 jobs. Be smarter about your job search
http://corp.mail.com/careers

Re: [Dev-C++] complier solution -- well maybe

[Per W. <pw...@ia...>]

At least my installation adds the system("pause") command. I don't
remember adding the line myself to the template, but then again, I
sometimes do edit the templates, and I'm known to be forgetful :-)

/Per W

On Sun, 17 Aug 2003, Michael D. Smith wrote:

> When you start a new console operation, it has include stdio, main, the {}
> and return already there. Why not have the pause by default. It's a console
> operation and you can safely assume no one will not need to do SOME
> debugging so why not?
>
> But then they would be asking how to make it stop :)
>
> ms
>
> Slap it on the side. Works with my TV set.
>  From the original My Favorite Martian comic book
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
> _______________________________________________
> Dev-cpp-users mailing list
> Dev...@li...
> TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users
>

Re: [Dev-C++] Compiler

[Per W. <pw...@ia...>]

Why bother about the most portable single-line solution?

When I develop a console app, I want it to behave as a console app, i.e.
not require some extra input in the end.

I add the system("pause"); command during testing, just to allow the
program to be run from the editor. When I stop compiling with debug, I
don't want the pause anymore.

For a portable solution, the code should try and figure out if it was run
from the command line or from the desktop.

/Per W

On Sun, 17 Aug 2003, Hossein Haeri wrote:

> Dear Alireza (or Alex, don't know which!),
>
> Amongst all the group-given solutions to your problem, the most
> portable is to use std::cin. (I presume that you are using C++,
> and not C.) Use it this way:
>
> #include <iostream>
>
> int main()
> {
>   ...
>   cin.get();//The last line of main() body
> }
>
> Regards,
> --Hossein
>
> --
> __________________________________________________________
> Sign-up for your own personalized E-mail at Mail.com
> http://www.mail.com/?sr=signup
>
> CareerBuilder.com has over 400,000 jobs. Be smarter about your job search
> http://corp.mail.com/careers
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
> _______________________________________________
> Dev-cpp-users mailing list
> Dev...@li...
> TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users
>

Re: [Dev-C++] How do I store HUGE numbers.

[Hossein H. <ult...@em...>]

Dear David,

> Cool,
> It looks like it is exactly what I want.

Thanks.

> I would apeciate it if you would tell me when you complete
> it.

Well, I don't really know. But, I hope to finish it whithin the
few next weaks (if no disaster jumps in).

Do you want to test the version using boost::shared_ptr<>,
meanwhile?

> Thanks in Advance
You'r welcome freind, no need to thanks!

Regards,
--Hossein
-- 
__________________________________________________________
Sign-up for your own personalized E-mail at Mail.com
http://www.mail.com/?sr=signup

CareerBuilder.com has over 400,000 jobs. Be smarter about your job search
http://corp.mail.com/careers

RE: [Dev-C++] opinion on as it could be the list

[P.D. v. Z. <pa...@my...>]

There already is a Dev-C++ forum, hosted at SourceForge, but I find this
forum seriously flawed. It has no required membership, so tons of the
same posts (and troll posts) turn up way too frequently, oftentimes by
anonymous posters. Furthermore it doesn't support "sticky posts", so
it's not possible to keep a FAQ or other important information at the
top of the list at all times.
It would indeed be better if a different forum is used, but that would
only work if it became the "official" forum.


-----Original Message-----
From: dev...@li...
[mailto:dev...@li...] On Behalf Of Rhuan
Paulo Lopes Barros
Sent: Sunday, August 17, 2003 5:53 AM
To: dev...@li...
Subject: [Dev-C++] opinion on as it could be the list


I do not know if the remaining portion of the staff goes to agree to me,
but=20
this list in email form is very bad to read the messages sent the list.

F=F3rum would have to be one type phpBB, it would be much more easy to
answer=20
the messages, and a suggestion would not crowd the box of entrance of
its=20
email alone.  if sufficiently people to agree we poderiamos to speak
with=20
the staff of the Dev-c++ on the subject!  or if they not to agree could=20
create thus in same a forum.  it are that we teriamos much more
advantages=20
in our communication!=20

 --------
Rhuan Barros, 16 anos,
Brasil - Rio Grande do Sul - Porto Alegre,
T=E9cnico em Inform=E1tica
ICQ 45268878
 --------=20

=20


--=20
POP. Nem parece internet gr=E1tis.=20

Seja POP voc=EA tamb=E9m!
Acesse: http://www.pop.com.br/pop_discador.php e baixe o POPdiscador.


-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01
/01
_______________________________________________
Dev-cpp-users mailing list
Dev...@li...
TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
https://lists.sourceforge.net/lists/listinfo/dev-cpp-users

RE: [Dev-C++] Compiler

[Per W. <pw...@ia...>]

Yes, such a switch would be invaluable - some other tools have it - but we
would still need a faq, since the mejority of newcomers wouldn't know
about it...

/Per W

On Sun, 17 Aug 2003, Ioannis Vranos wrote:

> Ehehe, may be I shall put an answer for that question in the unsubscribe
> faq. :-) A more convenient solution would be an explicit "Pause after run"
> option in Dev-C++.
>
>
>
>
>
>
> Ioannis Vranos
>
> * Programming pages: http://www.noicys.freeurl.com
> * Alternative URL 1: http://run.to/noicys
> * Alternative URL 2: http://www.noicys.cjb.net
>
> > -----Original Message-----
> > From: dev...@li...
> > [mailto:dev...@li...] On Behalf
> > Of Smurf, Papa
> > Sent: Saturday, August 16, 2003 8:49 PM
> > To: dev...@li...
> > Subject: RE: [Dev-C++] Compiler
> >
> >
> > You guys should do a FAQ for these kinds of questions ;)
> > Like what someone did for unsubscribing.
> >
> > -----Original Message-----
> > From: dev...@li...
> > [mailto:dev...@li...]On Behalf Of alireza
> > goshtaei
> > Sent: Saturday, August 16, 2003 7:30 PM
> > To: dev...@li...
> > Subject: [Dev-C++] Compiler
> >
> >
> > Dear friend
> > everytime I run the program in DEV-C++ the wondows
> > console is closed so fast so I can't see the result.
> > how come can I fix this problem ?
> > thanks
> > alex
>
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
> _______________________________________________
> Dev-cpp-users mailing list
> Dev...@li...
> TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users
>

Re: [Dev-C++] Compiler

[Hossein H. <ult...@em...>]

Dear Alireza (or Alex, don't know which!),

Amongst all the group-given solutions to your problem, the most
portable is to use std::cin. (I presume that you are using C++,
and not C.) Use it this way:

#include <iostream>

int main()
{
  ...
  cin.get();//The last line of main() body
}

Regards,
--Hossein

-- 
__________________________________________________________
Sign-up for your own personalized E-mail at Mail.com
http://www.mail.com/?sr=signup

CareerBuilder.com has over 400,000 jobs. Be smarter about your job search
http://corp.mail.com/careers

Re: [Dev-C++] bit extraction problem

[w.y. <yok...@ve...>]

Dawood Vora wrote:
> 
>      string bits;
>      long x;
>      unsigned long y = 1;
> 
>      cin>>x;
>      if ((x >= INT_MIN) && (x <= INT_MAX)){

Try this out and examine the output carefully:

        cout << "sizeof(int) = " << sizeof(int) << endl;
        cout << "sizeof(long) = " << sizeof(long) << endl;
        cout << "sizeof(long long) = " << sizeof(long long) << endl;
        
        cout << "\nINT_MIN, INT_MAX = " << INT_MIN << ", "
		<< INT_MAX << endl;
        cout << "LONG_MIN, LONG_MAX = " << LONG_MIN << ", "
		<< LONG_MAX << endl;
        
        cout << "\n(hex)INT_MIN, INT_MAX = " << hex << INT_MIN
		<< ", " << INT_MAX << endl;
        cout << "(hex)LONG_MIN, LONG_MAX = " << LONG_MIN << ", "
		<< LONG_MAX << endl;

        cout << "\nLONG_LONG_MIN, LONG_LONG_MAX = " << dec
		<< LONG_LONG_MIN << ", " << LONG_LONG_MAX << endl;
        cout << "   (hex) = " << hex << LONG_LONG_MIN << ", "
		<< LONG_LONG_MAX << endl;

[Dev-C++] complier solution -- well maybe

[Michael D. S. <for...@hi...>]

When you start a new console operation, it has include stdio, main, the {} 
and return already there. Why not have the pause by default. It's a console 
operation and you can safely assume no one will not need to do SOME 
debugging so why not?

But then they would be asking how to make it stop :)

ms

Slap it on the side. Works with my TV set.
 From the original My Favorite Martian comic book

Re: [Dev-C++] Compiler

[<or...@vp...>]

Ioannis Vranos wrote:

> Ehehe, may be I shall put an answer for that question in the unsubscribe
> faq. :-) A more convenient solution would be an explicit "Pause after run"
> option in Dev-C++.

Agreed, and it MUST be turned on by default. That would save us 5 mails 
a week.
People don't read any faq nowadays. Just always ask...

--
Greetings,
   Balázs

[Dev-C++] bit extraction problem

[Dawood V. <da...@ku...>]

bit extraction problem

Below is a program to extract the layout of the bits from an integer.
It works fine, if the input number is within the range of long type of int.
It is suppose to give me a message, if the input number is either greater 
than the max limits of long or lower than the min limits of long.  But it 
does not.  Apparently the offending line is : "cin>>x;"  If x is not able 
to accommodate any input number it simply stores the number 2 as per my 
system.  Does anybody know, how to solve this problem.

#include <cstdlib>
#include <iostream>
#include <climits>
using namespace std;

#define BYTE 8

int main()
{
     string bits;
     long x;
     unsigned long y = 1;

     cin>>x;
     if ((x >= INT_MIN) && (x <= INT_MAX)){
         int i = 1;
         while (i++ <= BYTE*sizeof(x)) {
           if (x&y)
               bits = '1' + bits;
           else
               bits = '0' + bits;
           y<<=1;
         }
     cout<<"the bit layout in x :";
     cout<<bits<<'\n';
     }
     else
         cout<< "input number either too large or too small\n";

    system("PAUSE");
    return 0;

}

Re: [Dev-C++] Compiler

[Daniel K. O. <dan...@ya...>]

And why the hell don't you guys include a template for console programs 
that shows how to pause before exiting? Oh wait... never mind...




Daniel K. O.


Ioannis Vranos wrote:

>Ehehe, may be I shall put an answer for that question in the unsubscribe
>faq. :-) A more convenient solution would be an explicit "Pause after run"
>option in Dev-C++.
>
>
>
>
>
>
>Ioannis Vranos
>  
>

RE: [Dev-C++] Compiler

[Ioannis V. <iv...@em...>]

Ehehe, may be I shall put an answer for that question in the unsubscribe
faq. :-) A more convenient solution would be an explicit "Pause after run"
option in Dev-C++.






Ioannis Vranos
 
* Programming pages: http://www.noicys.freeurl.com
* Alternative URL 1: http://run.to/noicys
* Alternative URL 2: http://www.noicys.cjb.net

> -----Original Message-----
> From: dev...@li... 
> [mailto:dev...@li...] On Behalf 
> Of Smurf, Papa
> Sent: Saturday, August 16, 2003 8:49 PM
> To: dev...@li...
> Subject: RE: [Dev-C++] Compiler
> 
> 
> You guys should do a FAQ for these kinds of questions ;)
> Like what someone did for unsubscribing. 
> 
> -----Original Message-----
> From: dev...@li...
> [mailto:dev...@li...]On Behalf Of alireza
> goshtaei
> Sent: Saturday, August 16, 2003 7:30 PM
> To: dev...@li...
> Subject: [Dev-C++] Compiler
> 
> 
> Dear friend
> everytime I run the program in DEV-C++ the wondows
> console is closed so fast so I can't see the result.
> how come can I fix this problem ?
> thanks
> alex

Re: [Dev-C++] Help with application security (hiding strings in compiled binaries)

[Mark L. <mli...@ip...>]

On Fri, 15 Aug 2003 17:10:05 -0400 Ed Cottrell <em...@to...> wrote:

EC> So, how can I hide those strings in the compiled code, other than
EC> building
EC> in some sort of encryption? Would building the passwords from
EC> individual
EC> characters (ASCII values) work? Other ideas?

Build the DSN string in say ROT13 (or any other shrouding type routine) and
then when you go to use it, unshroud it.

HTH

MarkL

[Dev-C++] opinion on as it could be the list

[Rhuan P. L. B. <rhu...@po...>]

I do not know if the remaining portion of the staff goes to agree to me, =
but=20
this list in email form is very bad to read the messages sent the list. =20
F=F3rum would have to be one type phpBB, it would be much more easy to an=
swer=20
the messages, and a suggestion would not crowd the box of entrance of its=
=20
email alone.  if sufficiently people to agree we poderiamos to speak with=
=20
the staff of the Dev-c++ on the subject!  or if they not to agree could=20
create thus in same a forum.  it are that we teriamos much more advantage=
s=20
in our communication!=20

 --------
Rhuan Barros, 16 anos,
Brasil - Rio Grande do Sul - Porto Alegre,
T=E9cnico em Inform=E1tica
ICQ 45268878
 --------=20

=20


--=20
POP. Nem parece internet gr=E1tis.=20

Seja POP voc=EA tamb=E9m!
Acesse: http://www.pop.com.br/pop_discador.php e baixe o POPdiscador.

[Dev-C++] Re: Compiler

[Rhuan P. L. B. <rhu...@po...>]

you also can use this function:
#include <conio.h>
getch();
//or
getche();=20

 --------
Rhuan Barros, 16 anos,
Brasil - Rio Grande do Sul - Porto Alegre,
T=E9cnico em Inform=E1tica
ICQ 45268878
 --------=20

=20

=20

--=20
POP. Nem parece internet gr=E1tis.=20

Seja POP voc=EA tamb=E9m!
Acesse: http://www.pop.com.br/pop_discador.php e baixe o POPdiscador.

RE: [Dev-C++] Help with application security (hiding strings in compiled binaries)

[P.D. v. Z. <pa...@my...>]

Yeah, you're right... I only checked the executable for the string
literal (in either ASCII or Unicode) using a hex editor, didn't spend
much time checking for any other patterns. Another option would be to
use (or write) a string encoding program, which emits a (reversible)
string that you then use as a literal in your application. Then when you
need the plain-text string, you decode it using some decoding function
(could be anything simple, bit inversion would even suffice). I know
it's a bit more work, but it will effectively get rid of your problem.
Doesn't get rid of the plain-text string existing in memory at some
point, but that's not your problem as far as I understood.

I'll send along a simple example of what I mean. This is just some
really basic 'encoding', and not quite safe in any way.. using bit
inversion... simplest I could think of to effectively garble text (have
no idea if it'd work correctly at all, this is off the top of my head).

[for encoding your strings for use in your application, don't think
you'd want to do that by hand :P]:

#include <iostream>
using std::cout;
using std::endl;

int main(int argc, char* argv[])
{
	if (argc !=3D 2)
		return 1;
=09
	for (int i =3D 0; i < strlen(argv[1]); ++i)
		cout << ~argv[1][i];
	cout << endl;
}


[decoding function for use in your application]

#include <iostream>
using std::cout;
using std::endl;

void decodepass(char* pDest, const char* pSrc, int iLen)
{
	if (!pDest || !pSrc)
		return;
=09
	for (int i =3D 0; i < iLen; ++i)
		pDest[i] =3D ~pSrc[i];
	pDest[i] =3D '\0';
}

int main()
{
	const char* pszSomePass =3D "<some encoded string>";
	char szDecoded[256];
=09
	decodepass(szDecoded, pszSomePass);
	cout << "My decoded string is: " << szDecoded << endl;
=09
	return 0;
}


-----Original Message-----
From: dev...@li...
[mailto:dev...@li...] On Behalf Of Ed
Cottrell
Sent: Sunday, August 17, 2003 1:22 AM
To: dev...@li...
Subject: RE: [Dev-C++] Help with application security (hiding strings in
compiled binaries)


Hi -

That's certainly an improvement. However, it still shows up somewhat
predictably. It looks like this in a text editor (I doubt this will
display
correctly):

  =
=FA=FF=FFj=C6=85=A9=FA=FF=FFi=C6=85=AA=FA=FF=FFl=C6=85=AB=FA=FF=FFl=C6=85=
=AC=FA=FF=FF =C6=85
     ^      ^      ^      ^      ^

It's a little weird, but you can see the pretty regular repetition,
there. It MIGHT be sufficient to my purposes to do it this way, but it's
not ideal...

Other ideas?

-Ed


-----Original Message-----
From: dev...@li...
[mailto:dev...@li...] On Behalf Of P.D. van
Zelst
Sent: Saturday, August 16, 2003 6:45 PM
To: 'Ed Cottrell'; 'Michael D. Smith';
dev...@li...
Subject: RE: [Dev-C++] Help with application security (hiding strings in
compiled binaries)


Well, it appears that if you specify your passwords as separate
characters in a character array, it won't turn up in the executable as a
string literal. I just tested this, as I was curious myself... The
following code will generate an executable with the string literal
"jack" in it, but "jill" won't show up as a literal (at least, not on my
compiler... GCC 3.2 [Dev-C++
4.9.8.2]):

#include <iostream>
using std::cout;
using std::endl;


int main()
{
	char szUser[] =3D "jack";
	char szPass[] =3D { 'j', 'i', 'l', 'l', '\0'};
	cout << szUser << endl;
	cout << szPass << endl;
	return 0;
}


Hope this helps you somewhat,


Paul

-----Original Message-----
From: dev...@li...
[mailto:dev...@li...] On Behalf Of Ed
Cottrell
Sent: Sunday, August 17, 2003 12:02 AM
To: 'Michael D. Smith'; dev...@li...
Subject: RE: [Dev-C++] Help with application security (hiding strings in
compiled binaries)


Hi Mike & others,

I know I can't make it impossible to find, but I'd like it to be more
difficult than it is. The user logging in to the database will have
limited capabilities, of course, but one (the trickiest to secure) is
SELECT capability, by necessity...

I'm not sure how I could separate the logon program from the main
program (and put it in a secured directory) without losing
functionality; the end user HAS to be able to login to the database
servers from the program itself, but without having access other than
through the program's own controls. In other words, when he/she runs my
app, he/she should then have limited access to the database, but without
knowing the authentication used to get there. If the user is going to
somehow invoke a separate login program, that requires yet another layer
of security, right? The user will be accessing some of the data over the
net, and I don't want just anybody to run a login script... (NOTE:
traffic sniffing isn't a concern with this data
- no credit cards or anything; somebody logging in and getting lots at
once, though, is).

NOTE: I don't mind encrypting it, somehow; I'm just not thrilled about
it, because it would result in definite penalties in file size,
execution speed, and development time.

How else can I make this more discrete?

-Ed

-----Original Message-----
From: Michael D. Smith [mailto:for...@hi...]=20
Sent: Friday, August 15, 2003 10:14 PM
To: Ed Cottrell
Subject: Re: [Dev-C++] Help with application security (hiding strings in
compiled binaries)



I've done a good bit of computer security work over the years, I first=20
programmed a UNIVAC 9200 in 1969, but I'm just now learning C, so from
that=20
perspective...

The situation is that you can't make it impossible to the truly
determined.=20
You might could make it take 200 people 3 years though, which is no
doubt=20
much, much, much better than "anyone" and "notepad"

It depends on the specifics which of course you don't want to give for=20
obvious reasons. The first thing that comes to my mind is you should ask

yourself "why do people logging on have access to the logon program?" If

you could stop that, that alone would go a long way towards making you
more=20
secure. See if you can't do something with the file/directory
permissions=20
to make that impossible.

YOu could store it packed (as binary) but anyone can read that as well
if=20
it's in a known code. I'm not 100% sure but I think putting it in a=20
"struct" does that in C. If not, there's certainly someway to convert
it.=20
They would have to be a "little"  (very little) more determined to crack
it=20
but it could still be done. Still it's better than "anyone" and
"notepad."

Even though you don't like encoding, it certainly could work. There's a=20
world of possibilities out there. Just be aware, a "good" code is going
to=20
cost you in processing time. Maybe as much as 30 seconds per user. If=20
you're already at, or close to capacity that could be a hit. Of course
with=20
processing speed doubling every few months "they say" you're not
supposed=20
to worry about that. Of course with everyone not worrying about that ...
:)

And of course the current hot programming thinking is OOP (object
oriented=20
programming). For some reason, the way they push OOP these days leaves
out=20
the fact that it's purpose was/is security. But it too has security
holes=20
for those in the know. I guess they figure that if you don't know that's

it's purpose, you don't make it your purpose to find the security holes.

You give the users an object that only allows them to use your method=20
(subroutine) to access/change the database or perhaps to logon to start=20
with. Your subroutine of course only does access/changes that you
approve=20
of. I suspect this would involve rewriting the whole program which, if
your=20
not interested in encoding, you're probably not interested in rewriting
the=20
whole thing either. That too very much depends on your program being in
a=20
directory they don't have permission to access.

By necessity, as I don't know much C, and don't have any specifics, I've

been rather vague but if there's anything else I can do to help (yea=20
right:) -- write anytime.

Good luck.

ms





At 04:10 PM 8/15/03, you wrote:
>Hi,
>
>I have an application that, as one of its primary features, connects to

>numerous databases with semi-sensitive to highly sensitive info in=20
>them. The end users of this will be employees of a large organization,=20
>and they should not have ANY direct access to the databases,=20
>themselves. So, rather than giving them a username and password, I want

>to hard-code that into the application.
>
>This is currently being done like this (simplified pseudo code):
>
>     char myconnectionstring =3D=20
> =
"DSN=3Dsomething;server=3Dmyserver;username=3Dmyname;password=3Dmypass";
>     MyConnectionFunction(myconnectionstring);
>
>The compiled file (binary), though, contains this info in plain text.=20
>I.e., anybody can open it up in Notepad, find the usernames and=20
>passwords, and go hack the databases. That won't work.
>
>So, how can I hide those strings in the compiled code, other than
>building in some sort of encryption? Would building the passwords from
individual=20
>characters (ASCII values) work? Other ideas?
>
>Thanks!
>
>-Ed





-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01
/01
_______________________________________________
Dev-cpp-users mailing list
Dev...@li...
TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
https://lists.sourceforge.net/lists/listinfo/dev-cpp-users




-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01
/01
_______________________________________________
Dev-cpp-users mailing list
Dev...@li...
TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
https://lists.sourceforge.net/lists/listinfo/dev-cpp-users




-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01
/01
_______________________________________________
Dev-cpp-users mailing list
Dev...@li...
TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
https://lists.sourceforge.net/lists/listinfo/dev-cpp-users

RE: [Dev-C++] Help with application security (hiding strings in compiled binaries)

[Ed C. <em...@ed...>]

P.D., Pete, etc -

Thanks for the suggestions. I'll probably go with the XOR method or some
other bit manipulation. (The man-in-the-middle is not a problem - I
personally control most of the servers involved and have them locked =
down
awfully tight; it's the app that is the weak link).=20

Anyway, thanks for the help.

-Ed

-----Original Message-----
From: P.D. van Zelst [mailto:pa...@my...]=20
Sent: Saturday, August 16, 2003 8:25 PM
To: 'Ed Cottrell'; dev...@li...
Subject: RE: [Dev-C++] Help with application security (hiding strings in
compiled binaries)


Yeah, you're right... I only checked the executable for the string =
literal
(in either ASCII or Unicode) using a hex editor, didn't spend much time
checking for any other patterns. Another option would be to use (or =
write) a
string encoding program, which emits a (reversible) string that you then =
use
as a literal in your application. Then when you need the plain-text =
string,
you decode it using some decoding function (could be anything simple, =
bit
inversion would even suffice). I know it's a bit more work, but it will
effectively get rid of your problem. Doesn't get rid of the plain-text
string existing in memory at some point, but that's not your problem as =
far
as I understood.

I'll send along a simple example of what I mean. This is just some =
really
basic 'encoding', and not quite safe in any way.. using bit inversion...
simplest I could think of to effectively garble text (have no idea if =
it'd
work correctly at all, this is off the top of my head).

[for encoding your strings for use in your application, don't think =
you'd
want to do that by hand :P]:

#include <iostream>
using std::cout;
using std::endl;

int main(int argc, char* argv[])
{
	if (argc !=3D 2)
		return 1;
=09
	for (int i =3D 0; i < strlen(argv[1]); ++i)
		cout << ~argv[1][i];
	cout << endl;
}


[decoding function for use in your application]

#include <iostream>
using std::cout;
using std::endl;

void decodepass(char* pDest, const char* pSrc, int iLen)
{
	if (!pDest || !pSrc)
		return;
=09
	for (int i =3D 0; i < iLen; ++i)
		pDest[i] =3D ~pSrc[i];
	pDest[i] =3D '\0';
}

int main()
{
	const char* pszSomePass =3D "<some encoded string>";
	char szDecoded[256];
=09
	decodepass(szDecoded, pszSomePass);
	cout << "My decoded string is: " << szDecoded << endl;
=09
	return 0;
}


-----Original Message-----
From: dev...@li...
[mailto:dev...@li...] On Behalf Of Ed =
Cottrell
Sent: Sunday, August 17, 2003 1:22 AM
To: dev...@li...
Subject: RE: [Dev-C++] Help with application security (hiding strings in
compiled binaries)


Hi -

That's certainly an improvement. However, it still shows up somewhat
predictably. It looks like this in a text editor (I doubt this will =
display
correctly):

  =
=FA=FF=FFj=C6=85=A9=FA=FF=FFi=C6=85=AA=FA=FF=FFl=C6=85=AB=FA=FF=FFl=C6=85=
=AC=FA=FF=FF =C6=85
     ^      ^      ^      ^      ^

It's a little weird, but you can see the pretty regular repetition, =
there.
It MIGHT be sufficient to my purposes to do it this way, but it's not
ideal...

Other ideas?

-Ed


-----Original Message-----
From: dev...@li...
[mailto:dev...@li...] On Behalf Of P.D. van
Zelst
Sent: Saturday, August 16, 2003 6:45 PM
To: 'Ed Cottrell'; 'Michael D. Smith'; =
dev...@li...
Subject: RE: [Dev-C++] Help with application security (hiding strings in
compiled binaries)


Well, it appears that if you specify your passwords as separate =
characters
in a character array, it won't turn up in the executable as a string
literal. I just tested this, as I was curious myself... The following =
code
will generate an executable with the string literal "jack" in it, but =
"jill"
won't show up as a literal (at least, not on my compiler... GCC 3.2 =
[Dev-C++
4.9.8.2]):

#include <iostream>
using std::cout;
using std::endl;


int main()
{
	char szUser[] =3D "jack";
	char szPass[] =3D { 'j', 'i', 'l', 'l', '\0'};
	cout << szUser << endl;
	cout << szPass << endl;
	return 0;
}


Hope this helps you somewhat,


Paul

-----Original Message-----
From: dev...@li...
[mailto:dev...@li...] On Behalf Of Ed =
Cottrell
Sent: Sunday, August 17, 2003 12:02 AM
To: 'Michael D. Smith'; dev...@li...
Subject: RE: [Dev-C++] Help with application security (hiding strings in
compiled binaries)


Hi Mike & others,

I know I can't make it impossible to find, but I'd like it to be more
difficult than it is. The user logging in to the database will have =
limited
capabilities, of course, but one (the trickiest to secure) is SELECT
capability, by necessity...

I'm not sure how I could separate the logon program from the main =
program
(and put it in a secured directory) without losing functionality; the =
end
user HAS to be able to login to the database servers from the program
itself, but without having access other than through the program's own
controls. In other words, when he/she runs my app, he/she should then =
have
limited access to the database, but without knowing the authentication =
used
to get there. If the user is going to somehow invoke a separate login
program, that requires yet another layer of security, right? The user =
will
be accessing some of the data over the net, and I don't want just =
anybody to
run a login script... (NOTE: traffic sniffing isn't a concern with this =
data
- no credit cards or anything; somebody logging in and getting lots at =
once,
though, is).

NOTE: I don't mind encrypting it, somehow; I'm just not thrilled about =
it,
because it would result in definite penalties in file size, execution =
speed,
and development time.

How else can I make this more discrete?

-Ed

-----Original Message-----
From: Michael D. Smith [mailto:for...@hi...]=20
Sent: Friday, August 15, 2003 10:14 PM
To: Ed Cottrell
Subject: Re: [Dev-C++] Help with application security (hiding strings in
compiled binaries)



I've done a good bit of computer security work over the years, I first=20
programmed a UNIVAC 9200 in 1969, but I'm just now learning C, so from =
that=20
perspective...

The situation is that you can't make it impossible to the truly =
determined.=20
You might could make it take 200 people 3 years though, which is no =
doubt=20
much, much, much better than "anyone" and "notepad"

It depends on the specifics which of course you don't want to give for=20
obvious reasons. The first thing that comes to my mind is you should ask

yourself "why do people logging on have access to the logon program?" If

you could stop that, that alone would go a long way towards making you =
more=20
secure. See if you can't do something with the file/directory =
permissions=20
to make that impossible.

YOu could store it packed (as binary) but anyone can read that as well =
if=20
it's in a known code. I'm not 100% sure but I think putting it in a=20
"struct" does that in C. If not, there's certainly someway to convert =
it.=20
They would have to be a "little"  (very little) more determined to crack =
it=20
but it could still be done. Still it's better than "anyone" and =
"notepad."

Even though you don't like encoding, it certainly could work. There's a=20
world of possibilities out there. Just be aware, a "good" code is going =
to=20
cost you in processing time. Maybe as much as 30 seconds per user. If=20
you're already at, or close to capacity that could be a hit. Of course =
with=20
processing speed doubling every few months "they say" you're not =
supposed=20
to worry about that. Of course with everyone not worrying about that ...
:)

And of course the current hot programming thinking is OOP (object =
oriented=20
programming). For some reason, the way they push OOP these days leaves =
out=20
the fact that it's purpose was/is security. But it too has security =
holes=20
for those in the know. I guess they figure that if you don't know that's

it's purpose, you don't make it your purpose to find the security holes.

You give the users an object that only allows them to use your method=20
(subroutine) to access/change the database or perhaps to logon to start=20
with. Your subroutine of course only does access/changes that you =
approve=20
of. I suspect this would involve rewriting the whole program which, if =
your=20
not interested in encoding, you're probably not interested in rewriting =
the=20
whole thing either. That too very much depends on your program being in =
a=20
directory they don't have permission to access.

By necessity, as I don't know much C, and don't have any specifics, I've

been rather vague but if there's anything else I can do to help (yea=20
right:) -- write anytime.

Good luck.

ms





At 04:10 PM 8/15/03, you wrote:
>Hi,
>
>I have an application that, as one of its primary features, connects to

>numerous databases with semi-sensitive to highly sensitive info in
>them. The end users of this will be employees of a large organization,=20
>and they should not have ANY direct access to the databases,=20
>themselves. So, rather than giving them a username and password, I want

>to hard-code that into the application.
>
>This is currently being done like this (simplified pseudo code):
>
>     char myconnectionstring =3D
> =
"DSN=3Dsomething;server=3Dmyserver;username=3Dmyname;password=3Dmypass";
>     MyConnectionFunction(myconnectionstring);
>
>The compiled file (binary), though, contains this info in plain text.
>I.e., anybody can open it up in Notepad, find the usernames and=20
>passwords, and go hack the databases. That won't work.
>
>So, how can I hide those strings in the compiled code, other than=20
>building in some sort of encryption? Would building the passwords from
individual=20
>characters (ASCII values) work? Other ideas?
>
>Thanks!
>
>-Ed





-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including =
Data
Reports, E-commerce, Portals, and Forums are available now. Download =
today
and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01
/01
_______________________________________________
Dev-cpp-users mailing list
Dev...@li...
TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
https://lists.sourceforge.net/lists/listinfo/dev-cpp-users




-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including =
Data
Reports, E-commerce, Portals, and Forums are available now. Download =
today
and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01
/01
_______________________________________________
Dev-cpp-users mailing list
Dev...@li...
TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
https://lists.sourceforge.net/lists/listinfo/dev-cpp-users




-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including =
Data
Reports, E-commerce, Portals, and Forums are available now. Download =
today
and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01
/01
_______________________________________________
Dev-cpp-users mailing list
Dev...@li...
TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
https://lists.sourceforge.net/lists/listinfo/dev-cpp-users

Re: [Dev-C++] How do I store HUGE numbers.

[Per W. <pw...@ia...>]

Have you looked at the GNU MP library (GMP).
http://www.swox.com/gmp/

It has good documentation, a large number of functions, and is well
tested.

/Per W

On Sat, 16 Aug 2003, David McKen wrote:

> Cool,
> It looks like it is exactly what I want.
>
> I would apeciate it if you would tell me when you complete
> it.
>
> Thanks in Advance
> David McKen
>
> ----- Original Message -----
> From: "Hossein Haeri" <ult...@em...>
> To: <dev...@li...>
> Sent: Saturday, August 16, 2003 12:09 PM
> Subject: Re: [Dev-C++] How do I store HUGE numbers.
>
>
> > Dear David,
> >
> > > Other than allocating a block of memory and
> interpreting
> > > each of the bits myself how can I store really big
> numbers
> > > (Let's stick with integers for now) in memory.
> >
> > I've got a heavy STLised library available at:
> >
> >
> http://www.programmersheaven.com/search/download.asp?FileID=26357
> >
> > I describe it hifty, as it uses a pure vector as the
> storage.
> >
> > I have written a better version that uses a
> boost::shared_ptr to
> > the vector as the storage. But, unfortunately, it is not
> > downloadable. If you think you will need a copy of it, or
> want to
> > test it, send me an email to send the file to you
> directly.
> >
> > I'm waiting to catch a time to implement a better
> version, but I
> > always lack it! Anyway, it is likely that I start and
> finish this
> > process in the few following days. If you are not in a
> hurry, and
> > want the library to be more reliable, it could be better
> to wait.
> >
> > Regards,
> > --Hossein
> > --
> >
> __________________________________________________________
> > Sign-up for your own personalized E-mail at Mail.com
> > http://www.mail.com/?sr=signup
> >
> > CareerBuilder.com has over 400,000 jobs. Be smarter about
> your job search
> > http://corp.mail.com/careers
> >
> >
> >
> > -------------------------------------------------------
> > This SF.Net email sponsored by: Free pre-built ASP.NET
> sites including
> > Data Reports, E-commerce, Portals, and Forums are
> available now.
> > Download today and enter to win an XBOX or Visual Studio
> .NET.
> >
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
> > _______________________________________________
> > Dev-cpp-users mailing list
> > Dev...@li...
> > TO UNSUBSCRIBE:
> http://www23.brinkster.com/noicys/devcpp/ub.htm
> >
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! SiteBuilder - Free, easy-to-use web site design software
> http://sitebuilder.yahoo.com
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
> _______________________________________________
> Dev-cpp-users mailing list
> Dev...@li...
> TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users
>

RE: [Dev-C++] Help with application security (hiding strings in compiled binaries)

[Per W. <pw...@ia...>]

The problem with

  char array[] =3D {'a','b','c','\0');

is that if the compiler is smart, it will notice that it is a string
literal and add one to the program. This is especially true if the array
had been declared static.

If the compiler fails to notice it as a string literal, it will emit code
like:

array[0] =3D 'a';
array[1] =3D 'b';
array[2] =3D 'c';
array[3] =3D '\0';

and unless the compiler have other instructions that it will mix in during
the optimization pass, the characters will be stored at a regular offset
from each other.

If you are just going for obfuscation, you might store the difference
relative the previous character. One other alternative is to xor the
string with another string, and store the resulting string in the
application. One more xor pass will retrieve the original string.

Note that whatever you do, it will still be possible to retrieve the
access information - a man-in-the-middle might take over the port you
expect the database on, and then get all access information in clear text.
Some databases supports encrypted communication. For example MySQL may
tunnel the data through a ssh channel. For a modern processor, it
shouldn't take more than a second or two to perform the connect
negotiation and after the key exchange, the communication will use a very
efficient encryption requiring very little CPU.

If you want to go for encryption, you might look at openssl.

/Per W

On Sat, 16 Aug 2003, Ed Cottrell wrote:

> Hi -
>
> That's certainly an improvement. However, it still shows up somewhat
> predictably. It looks like this in a text editor (I doubt this will displ=
ay
> correctly):
>
>   =FA=FF=FFj=C6=85=A9=FA=FF=FFi=C6=85=AA=FA=FF=FFl=C6=85=AB=FA=FF=FFl=C6=
=85=AC=FA=FF=FF =C6=85
>      ^      ^      ^      ^      ^
>
> It's a little weird, but you can see the pretty regular repetition, there=
=2E
> It MIGHT be sufficient to my purposes to do it this way, but it's not
> ideal...
>
> Other ideas?
>
> -Ed
>
>
> -----Original Message-----
> From: dev...@li...
> [mailto:dev...@li...] On Behalf Of P.D. van
> Zelst
> Sent: Saturday, August 16, 2003 6:45 PM
> To: 'Ed Cottrell'; 'Michael D. Smith'; dev...@li...=
t
> Subject: RE: [Dev-C++] Help with application security (hiding strings in
> compiled binaries)
>
>
> Well, it appears that if you specify your passwords as separate character=
s
> in a character array, it won't turn up in the executable as a string
> literal. I just tested this, as I was curious myself... The following cod=
e
> will generate an executable with the string literal "jack" in it, but "ji=
ll"
> won't show up as a literal (at least, not on my compiler... GCC 3.2 [Dev-=
C++
> 4.9.8.2]):
>
> #include <iostream>
> using std::cout;
> using std::endl;
>
>
> int main()
> {
> =09char szUser[] =3D "jack";
> =09char szPass[] =3D { 'j', 'i', 'l', 'l', '\0'};
> =09cout << szUser << endl;
> =09cout << szPass << endl;
> =09return 0;
> }
>
>
> Hope this helps you somewhat,
>
>
> Paul
>
> -----Original Message-----
> From: dev...@li...
> [mailto:dev...@li...] On Behalf Of Ed Cottre=
ll
> Sent: Sunday, August 17, 2003 12:02 AM
> To: 'Michael D. Smith'; dev...@li...
> Subject: RE: [Dev-C++] Help with application security (hiding strings in
> compiled binaries)
>
>
> Hi Mike & others,
>
> I know I can't make it impossible to find, but I'd like it to be more
> difficult than it is. The user logging in to the database will have limit=
ed
> capabilities, of course, but one (the trickiest to secure) is SELECT
> capability, by necessity...
>
> I'm not sure how I could separate the logon program from the main program
> (and put it in a secured directory) without losing functionality; the end
> user HAS to be able to login to the database servers from the program
> itself, but without having access other than through the program's own
> controls. In other words, when he/she runs my app, he/she should then hav=
e
> limited access to the database, but without knowing the authentication us=
ed
> to get there. If the user is going to somehow invoke a separate login
> program, that requires yet another layer of security, right? The user wil=
l
> be accessing some of the data over the net, and I don't want just anybody=
 to
> run a login script... (NOTE: traffic sniffing isn't a concern with this d=
ata
> - no credit cards or anything; somebody logging in and getting lots at on=
ce,
> though, is).
>
> NOTE: I don't mind encrypting it, somehow; I'm just not thrilled about it=
,
> because it would result in definite penalties in file size, execution spe=
ed,
> and development time.
>
> How else can I make this more discrete?
>
> -Ed
>
> -----Original Message-----
> From: Michael D. Smith [mailto:for...@hi...]
> Sent: Friday, August 15, 2003 10:14 PM
> To: Ed Cottrell
> Subject: Re: [Dev-C++] Help with application security (hiding strings in
> compiled binaries)
>
>
>
> I've done a good bit of computer security work over the years, I first
> programmed a UNIVAC 9200 in 1969, but I'm just now learning C, so from th=
at
> perspective...
>
> The situation is that you can't make it impossible to the truly determine=
d.
> You might could make it take 200 people 3 years though, which is no doubt
> much, much, much better than "anyone" and "notepad"
>
> It depends on the specifics which of course you don't want to give for
> obvious reasons. The first thing that comes to my mind is you should ask
>
> yourself "why do people logging on have access to the logon program?" If
>
> you could stop that, that alone would go a long way towards making you mo=
re
> secure. See if you can't do something with the file/directory permissions
> to make that impossible.
>
> YOu could store it packed (as binary) but anyone can read that as well if
> it's in a known code. I'm not 100% sure but I think putting it in a
> "struct" does that in C. If not, there's certainly someway to convert it.
> They would have to be a "little"  (very little) more determined to crack =
it
> but it could still be done. Still it's better than "anyone" and "notepad.=
"
>
> Even though you don't like encoding, it certainly could work. There's a
> world of possibilities out there. Just be aware, a "good" code is going t=
o
> cost you in processing time. Maybe as much as 30 seconds per user. If
> you're already at, or close to capacity that could be a hit. Of course wi=
th
> processing speed doubling every few months "they say" you're not supposed
> to worry about that. Of course with everyone not worrying about that ...
> :)
>
> And of course the current hot programming thinking is OOP (object oriente=
d
> programming). For some reason, the way they push OOP these days leaves ou=
t
> the fact that it's purpose was/is security. But it too has security holes
> for those in the know. I guess they figure that if you don't know that's
>
> it's purpose, you don't make it your purpose to find the security holes.
>
> You give the users an object that only allows them to use your method
> (subroutine) to access/change the database or perhaps to logon to start
> with. Your subroutine of course only does access/changes that you approve
> of. I suspect this would involve rewriting the whole program which, if yo=
ur
> not interested in encoding, you're probably not interested in rewriting t=
he
> whole thing either. That too very much depends on your program being in a
> directory they don't have permission to access.
>
> By necessity, as I don't know much C, and don't have any specifics, I've
>
> been rather vague but if there's anything else I can do to help (yea
> right:) -- write anytime.
>
> Good luck.
>
> ms
>
>
>
>
>
> At 04:10 PM 8/15/03, you wrote:
> >Hi,
> >
> >I have an application that, as one of its primary features, connects to
>
> >numerous databases with semi-sensitive to highly sensitive info in
> >them. The end users of this will be employees of a large organization,
> >and they should not have ANY direct access to the databases,
> >themselves. So, rather than giving them a username and password, I want
>
> >to hard-code that into the application.
> >
> >This is currently being done like this (simplified pseudo code):
> >
> >     char myconnectionstring =3D
> > "DSN=3Dsomething;server=3Dmyserver;username=3Dmyname;password=3Dmypass"=
;
> >     MyConnectionFunction(myconnectionstring);
> >
> >The compiled file (binary), though, contains this info in plain text.
> >I.e., anybody can open it up in Notepad, find the usernames and
> >passwords, and go hack the databases. That won't work.
> >
> >So, how can I hide those strings in the compiled code, other than
> >building in some sort of encryption? Would building the passwords from
> individual
> >characters (ASCII values) work? Other ideas?
> >
> >Thanks!
> >
> >-Ed
>
>
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including Da=
ta
> Reports, E-commerce, Portals, and Forums are available now. Download toda=
y
> and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01
> /01
> _______________________________________________
> Dev-cpp-users mailing list
> Dev...@li...
> TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users
>
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including Da=
ta
> Reports, E-commerce, Portals, and Forums are available now. Download toda=
y
> and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/=
01
> _______________________________________________
> Dev-cpp-users mailing list
> Dev...@li...
> TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users
>
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/=
01
> _______________________________________________
> Dev-cpp-users mailing list
> Dev...@li...
> TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users
>