RE: Delphi Auditing

Delphi is often used in a RAD (Rapid Application Development) environment;
it's particularly good for creating windows applications quickly.  

Consequently, and with apologies to the many good Delphi programmers out
there, there are quite a lot of fairly low skilled Delphi coders.  The flip
side of this is that many applications written in Delphi use standard
Delphi, COM or ActiveX components, so the coder's job in Delphi is often
just to link these things together appropriately at a fairly high level.
This is unlike C++ or C, where programmers frequently exhibit the need to
work at a very low level.

However, the language itself can be problematic from a security point of
view.  Objects are passed by pointer - there is no passing by reference
(actually, it looks like reference passing, but the reference is really a
pointer).  It is also impossible to pass a truly const object - the const
refers to the pointer, not the object, so it's not possible enforce read
only access to objects at compile time.

Matt Palmer
Technical Analyst
e-mail: [email protected]
Website: www.nationalarchives.gov.uk



-----Original Message-----
From: ADex [mailto:[email protected]]
Sent: 23 April 2004 16:43
To: [email protected]
Subject: Delphi Auditing


I've recently been asked to audit a distributed application written in
Delphi.
Truthfully I have a limited knowledge of Delphi. Does anyone have any tips,
tools, or experiences that may make the job go a little more smoothly.
Thanks
in advance.  

AJ Dexter
http://hiddennetwork.no-ip.org


	
		
__________________________________
Do you Yahoo!?
Yahoo! Photos: High-quality 4x6 digital prints for 25¢
http://photos.yahoo.com/ph/print_splash

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________