RE: Delphi Auditing

AJ,

	How are the individual pieces communicating?  Are they using midas
to talk between the client and the application server?  Delphi is similar in
C++ by the fact that you can still pass pointers and do strcpy allowing for
the possibility of buffer overflows.  I believe through debugging one of our
components at work I stumbled over a possible buffer overflow in the
abbrevia package for Delphi 5.  That is another thing you should focus on is
the version of Delphi they are using.  There is a rather large change
between Delphi5 and Delphi6.  

	Check on all the components they use, most components allow you to
step into the source which would allow for a more in-depth review.  If you
are not allowed to view the source approach it just like you would a C++
program IMHO.  You can write assembly, use pointers, declare a set amount of
memory, etc... Most of the time you won't run across some of these things
but it all depends what the application is doing, etc.. 

	Well I hope that helps.

	Thanks,
	Mike 

-----Original Message-----
From: ADex [mailto:[email protected]] 
Sent: Friday, April 23, 2004 8:43 AM
To: [email protected]
Subject: Delphi Auditing

I've recently been asked to audit a distributed application written in
Delphi.
Truthfully I have a limited knowledge of Delphi. Does anyone have any tips,
tools, or experiences that may make the job go a little more smoothly.
Thanks in advance.  

AJ Dexter
http://hiddennetwork.no-ip.org


	
		
__________________________________
Do you Yahoo!?
Yahoo! Photos: High-quality 4x6 digital prints for 25"
http://photos.yahoo.com/ph/print_splash