PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Clang Hardening Cheat Sheet

blog.quarkslab.com | research | #tooling | #hardening | #compilers | #security | #clang | #fortify
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Clang hardening cheat sheet: fortify source, strip/debug flags, ASLR/PIE and related compile- and link-time protections, filling a gap since most hardening guides focus on GCC.
Published
Collected

Related coverage

research · blog.quarkslab.com
Implementing a Custom Directive Handler in Clang
How-to on implementing a custom #pragma directive handler in clang, used to drive an LLVM-based obfuscator while keeping sources compilable elsewhere; a tour of the preprocessing and parsing stages.
research · blog.quarkslab.com
A glance at compiler internals: Keep my memset
Why Clang/LLVM can delete your memset: tracing llvm.memset through Dead Store Elimination, the risk for code that wipes secrets, and the volatile function-pointer trick that keeps the wipe alive.
blog · blog.trailofbits.com
Holy Macroni! A recipe for progressive language enhancement
Trail of Bits introduces Macroni, a tool combining Clang, PASTA, VAST, and MLIR to preserve CPP macro provenance and enable macro-aware C static analyses and safer language constructs.
blog · blog.trailofbits.com
The future of Clang-based tooling
Peter Goodman examines why Clang dominates compiling yet disappoints toolsmiths: its AST, CFG, and libClang interfaces hide crucial data-flow connections, and new tooling aims to fill these gaps.
blog · blog.trailofbits.com
Using Static Analysis and Clang To Find Heartbleed
Trail of Bits built a Clang analyzer plugin that statically detects Heartbleed-style bugs: it taints ntohl/ntohs return values and flags unconstrained data used as memcpy sizes, tested on OpenSSL.
research · blog.quarkslab.com
Obfuscation vs the Optimizer: An LLVM Middle-End Arms Race
A Quarkslab post on the tug-of-war between obfuscators and compiler optimizers: through LLVM's middle-end IR and passes, it shows how a single upstream commit can unravel an obfuscation.
Back