Austin Python Learners Meetup - Everything you need to know about programming...Danny Mulligan
This document provides an overview of the key topics and tools needed for programming without prior experience, summarized in 3 sentences:
It discusses editors/IDEs, revision control, testing, debugging, common errors, performance, libraries, documentation, getting help, practicing, and answers questions about programming. Popular editors mentioned include TextEdit, Notepad, EMACS, and vim, while revision control tools include GIT and Mercurial. The document emphasizes using libraries, writing tests, avoiding errors, and getting help from documentation and online communities like StackOverflow.
This document discusses fuzzing browsers to uncover security vulnerabilities. It explains that fuzzing involves sending malformed or unexpected input to programs to find crashes or bugs. Specifically for browsers, fuzzing is useful because browsers are commonly targeted and easy to test. Successful fuzzing can find issues like buffer overflows, integer overflows, and out of bound reads. Finding bugs through fuzzing can help secure systems and earn significant rewards through browser bug bounty programs.
The document discusses distributed fuzzing, which involves spreading the workload of fuzz testing across multiple machines to dig deeper faster. It proposes a distributed fuzzing solution with the following key components: a database to store fuzzing data, a web interface for management, virtual machine nodes running fuzzers and monitoring targets, and an RPC interface to coordinate communication between components. The goal is to make deployment and management of distributed fuzzing easy while avoiding vendor lock-in.
This document provides an overview of fuzz testing and fuzzing tools. It discusses what fuzzing is, the history and evolution of fuzzing, popular fuzzing tools like Peach Fuzz and Sulley, and fuzzing methods like generation-based, mutation-based, and byte flipping fuzzing. The document also covers the phases of fuzzing like identifying targets and inputs, generating fuzzed data, executing it, and monitoring for exceptions. Key fuzzing frameworks and tools from organizations like CERT and their capabilities are described as well.
American Fuzzy Lop (AFL) is a security-oriented fuzz testing tool.
In this talk, I demonstrate how dead-simple AFL is to use. I show how I used it to fuzz a Python library, discovering a subtle bug in the process.
Game Programming 04 - Style & Design PrinciplesNick Pruehs
Chapter 4 of the lecture Game Programming taught at HAW Hamburg.
Introduction to naming conventions, type and member design, exception design and common .NET interfaces.
OllyDbg is a free debugger that can be used to analyze malware. It was originally developed over a decade ago for cracking software but is now widely used for malware analysis and exploit development. OllyDbg allows users to load EXEs and DLLs directly or attach to running processes to debug malware. It provides useful interfaces like a disassembler, register and memory views. OllyDbg also supports setting various breakpoints, calling functions, modifying data, and tracing program execution which helps analysts understand malware behavior.
This document discusses techniques for internal penetration testing. It begins by explaining why internal pen tests are more interesting than external or web app tests due to the ability to gain shells on internal systems. It then provides tips for easy exploits such as exploiting weak passwords, lack of patching, and improper access controls to gain initial access. Further tips include using tools like Responder to capture credentials, using a USB rubber ducky to quickly gain access when a user is logged in, and techniques for safely dumping passwords without antivirus detection. The document concludes by discussing how to escalate privileges to domain admin, loot sensitive data from file shares and databases, and scripts to automate post-exploitation tasks. Mitigations are briefly discussed as well as tips
Fuzzing underestimated method of finding hidden bugsPawel Rzepa
Fuzzing is a method of discovering software faults by providing unexpected input and monitoring for exceptions. There are two main types of fuzzers: mutation-based fuzzers which mutate valid samples, and generation-based fuzzers which require samples to be defined. Fuzzing discovers bugs by providing invalid input to any software, so it should always be considered as a testing method. A fuzzer contains an input generator, history of generated inputs, and a process monitor.
Slides for a college course at City College San Francisco. Based on "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software", by Michael Sikorski and Andrew Honig; ISBN-10: 1593272901.
Instructor: Sam Bowne
Class website: https://samsclass.info/126/126_S17.shtml
The document discusses fuzz testing or fuzzing, which is a software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program to test for security vulnerabilities or crashes. It provides examples of fuzzing network protocols like HTTP and fuzzing file formats. It also discusses different types of fuzzers and provides an example of vulnerable source code and a simple fuzzing scheme to test it.
Steelcon 2014 - Process Injection with Pythoninfodox
This is the slides to accompany the talk given by Darren Martyn at the Steelcon security conference in July 2014 about process injection using python.
Covers using Python to manipulate processes by injecting code on x86, x86_64, and ARMv7l platforms, and writing a stager that automatically detects what platform it is running on and intelligently decides which shellcode to inject, and via which method.
The Proof of Concept code is available at https://github.com/infodox/steelcon-python-injection
This document discusses the importance and benefits of code reviews. It notes that code reviews can increase quality, reduce defects, improve readability, share knowledge within a team, and help people get to know each other better. The document outlines different methodologies for conducting code reviews, such as team reviews, pair programming, walkthroughs, and peer reviews. It also provides tips for preparing code for review and things reviewers should check for, such as naming conventions, logic, refactoring, performance, and security. Overall, the document promotes code reviews as a way to improve code quality and collaboration.
This document provides an introduction and overview of the Python programming language. It discusses what Python is, how it can be used for tasks like web development, data analysis, and scientific computing. It also covers how to get started with Python, including installing it and using basic features like variables, functions, modules, and packages. Examples are provided for common Python concepts like lists, dictionaries, and working with CSV files. MongoDB and the PyMongo module for interacting with MongoDB databases from Python are also briefly introduced.
Ice Age melting down: Intel features considered usefull!Peter Hlavaty
Decades history of kernel exploitation, however still most used techniques are such as ROP. Software based approaches comes finally challenge this technique, one more successful than the others. Those approaches usually trying to solve far more than ROP only problem, and need to handle not only security but almost more importantly performance issues. Another common attacker vector for redirecting control flow is stack what comes from design of today’s architectures, and once again some software approaches lately tackling this as well. Although this software based methods are piece of nice work and effective to big extent, new game changing approach seems coming to the light. Methodology closing this attack vector coming right from hardware - intel. We will compare this way to its software alternatives, how one interleaving another and how they can benefit from each other to challenge attacker by breaking his most fundamental technologies. However same time we go further, to challenge those approaches and show that even with those technologies in place attackers is not yet in the corner.
[2012 CodeEngn Conference 06] beist - Everyone has his or her own fuzzerGangSeok Lee
2012 CodeEngn Conference 06
퍼징 기술의 입문자, 중급자에 초점을 맞추었고 퍼징 기술에 대한 백그라운드 설명부터 시작하여 최근의 퍼징 기술에는 어떠한 것들이 있는지 살펴보고 퍼징 기술이 버그 찾기에 어떻게 쓰일 수 있는지 부터 시작하여 효율적인 퍼징 테크닉은 어떤것들이 있는지 설명한다. 또한, 각 퍼징 기법들의 한계점과 단점에 대해서 지적하며 왜 자신만의 퍼징 노하우와 방법이 필요한지 설명하면서 퍼징 기술의 복잡성과 다양성, 해커들은 어떤 기법을 선호하는지 소개한다. 발표자가 사용하고 있는 기법이나 노하우에 대해서도 공유 할 예정이다.
http://codeengn.com/conference/06
Session - Debugging memory stomps and other atrocities - Stefan Reinalter - T...Expert Insight
The document discusses common memory-related bugs in games such as memory leaks, stack overflows, and memory overwrites. It provides examples of each bug and recommends remedies like using bounds checking, static code analysis tools, and memory tracking to debug issues. Debugging optimized builds is also discussed, emphasizing the importance of understanding compiler optimizations and assembly code. Hardware breakpoints and page protection are presented as techniques for finding random memory overwrites.
The document discusses techniques for rapidly testing web applications through automation to find security vulnerabilities within a limited time frame (T) and network requests (Q). It proposes prioritizing testing based on features like platform, number of inputs, and response status. Algorithmic approaches are suggested like using polyglot payloads to check for multiple issues simultaneously, building a decision tree to classify hackability, and calculating page priorities to guide the scan. Whitebox testing techniques like custom grep scripts to find code vulnerabilities are also covered. The goal is to build an efficient automated web application scanner that traverses the "pwning paths graph" to find bugs within the constraints.
Practical Malware Analysis: Ch 10: Kernel Debugging with WinDbgSam Bowne
This document discusses using WinDbg for kernel debugging and analyzing rootkits. It explains that WinDbg can debug in both user-mode and kernel-mode, unlike OllyDbg which is only for user-mode. Device drivers run code in the Windows kernel and are difficult to analyze. The DriverEntry routine is called when a driver is loaded and it registers callback functions. Malware often imports functions from Ntoskrnl.exe and Hal.dll to manipulate the kernel. WinDbg commands like bp, lm, and dt are demonstrated for setting breakpoints, listing modules, and viewing structures. Symbol files from Microsoft provide function and structure names to make debugging easier.
This document provides tips for taking the OSCP certification exam, focusing on reconnaissance, exploitation, and pivoting. It recommends aggressively scanning all ports with NMAP, using tools like Dirbuster for web enumeration, and saving all findings. Exploitation advice includes using Searchsploit and Metasploit carefully according to exam rules, and getting comfortable with buffer overflows. The document also suggests scripting commonly used exploits, thoroughly pillaging compromised systems, and pivoting networks through SSH port forwarding or ProxyChains. Organizing notes and completing the required lab report are also emphasized.
This document provides an overview of using the OllyDbg debugger to analyze malware. It discusses OllyDbg's history and interface, how to load and debug malware using OllyDbg, setting breakpoints, tracing code execution, patching code, and analyzing shellcode. The key points are that OllyDbg is an effective tool for debugging malware, it allows setting different breakpoint types, tracing helps record execution, and shellcode can be directly analyzed by pasting it into OllyDbg memory.
Software Security : From school to reality and back!Peter Hlavaty
This document provides an overview of software security topics such as terminology, hackers and their roles, tools used for security research, and competitions. It discusses key concepts like programming, code, performance, vulnerabilities, exploitation, and defense techniques. Recommendations are made around starting with tools like IDEs, reverse engineering tools, and virtual machines. Competitions like CTFs are also mentioned as a way to learn and improve skills.
This is the slides accompanying the talk I gave at BSides Hannover 2015, discussing the reverse engineering and exploitation of numerous vulnerabilities in Icomera Moovmanage products along with the post exploitation of such, including the potential creation of a firmware rootkit
Slides for a college course at City College San Francisco. Based on "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software", by Michael Sikorski and Andrew Honig; ISBN-10: 1593272901.
Instructor: Sam Bowne
Class website: https://samsclass.info/126/126_S17.shtml
Useful Shareware for Technical Communicators - STC New England Interchange co...Ed Marshall
Ed Marshall presents useful shareware tools for technical communicators, including file comparison tools like Beyond Compare, search and replace tools like Funduc, advanced text editors like NoteTab Pro and EditPad Pro, and the file transfer program Filezilla. He also discusses tools for keeping computers safe from malware, such as Trend Micro Internet Security, Secunia Personal Security Inspector, and Copernic Desktop Search. Backup utilities like Acronis True Image and CD burning software like Nero 9 Ultra Edition round out the presentation.
CNIT 126: 10: Kernel Debugging with WinDbgSam Bowne
Slides for a college course at City College San Francisco. Based on "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software", by Michael Sikorski and Andrew Honig; ISBN-10: 1593272901.
Instructor: Sam Bowne
Class website: https://samsclass.info/126/126_F18.shtml
Practical Malware Analysis: Ch 8: Debugging Sam Bowne
This document discusses debugging techniques for malware analysis. It describes the differences between disassemblers and debuggers, and introduces two popular debuggers - OllyDbg for user-mode debugging and Windbg for kernel-mode debugging. It covers debugging concepts like source-level versus assembly-level debugging, setting breakpoints, single-stepping, and modifying execution by skipping or testing functions.
The document discusses programming languages and ways they can be improved and customized. It argues that libraries are often overused to extend languages when the compiler itself could be extended instead. This could be done through compiler services that expose compiler information, macros that operate on the syntax tree, and quasi-quotations for building complex AST structures. Extending the compiler allows for more control and avoids issues like dependency cycles that plague library-based extensions.
The document discusses developing an exploit from a vulnerability and integrating it into the Metasploit framework. It covers finding a buffer overflow vulnerability in an application called "Free MP3 CD Ripper", using tools like ImmunityDebugger and Mona.py to crash the application and gain control of EIP. It then shows using Mona.py to generate an exploit, testing it works, and submitting it to the Metasploit framework. It also provides an overview of Meterpreter and its capabilities.
Fuzzing underestimated method of finding hidden bugsPawel Rzepa
Fuzzing is a method of discovering software faults by providing unexpected input and monitoring for exceptions. There are two main types of fuzzers: mutation-based fuzzers which mutate valid samples, and generation-based fuzzers which require samples to be defined. Fuzzing discovers bugs by providing invalid input to any software, so it should always be considered as a testing method. A fuzzer contains an input generator, history of generated inputs, and a process monitor.
Slides for a college course at City College San Francisco. Based on "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software", by Michael Sikorski and Andrew Honig; ISBN-10: 1593272901.
Instructor: Sam Bowne
Class website: https://samsclass.info/126/126_S17.shtml
The document discusses fuzz testing or fuzzing, which is a software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program to test for security vulnerabilities or crashes. It provides examples of fuzzing network protocols like HTTP and fuzzing file formats. It also discusses different types of fuzzers and provides an example of vulnerable source code and a simple fuzzing scheme to test it.
Steelcon 2014 - Process Injection with Pythoninfodox
This is the slides to accompany the talk given by Darren Martyn at the Steelcon security conference in July 2014 about process injection using python.
Covers using Python to manipulate processes by injecting code on x86, x86_64, and ARMv7l platforms, and writing a stager that automatically detects what platform it is running on and intelligently decides which shellcode to inject, and via which method.
The Proof of Concept code is available at https://github.com/infodox/steelcon-python-injection
This document discusses the importance and benefits of code reviews. It notes that code reviews can increase quality, reduce defects, improve readability, share knowledge within a team, and help people get to know each other better. The document outlines different methodologies for conducting code reviews, such as team reviews, pair programming, walkthroughs, and peer reviews. It also provides tips for preparing code for review and things reviewers should check for, such as naming conventions, logic, refactoring, performance, and security. Overall, the document promotes code reviews as a way to improve code quality and collaboration.
This document provides an introduction and overview of the Python programming language. It discusses what Python is, how it can be used for tasks like web development, data analysis, and scientific computing. It also covers how to get started with Python, including installing it and using basic features like variables, functions, modules, and packages. Examples are provided for common Python concepts like lists, dictionaries, and working with CSV files. MongoDB and the PyMongo module for interacting with MongoDB databases from Python are also briefly introduced.
Ice Age melting down: Intel features considered usefull!Peter Hlavaty
Decades history of kernel exploitation, however still most used techniques are such as ROP. Software based approaches comes finally challenge this technique, one more successful than the others. Those approaches usually trying to solve far more than ROP only problem, and need to handle not only security but almost more importantly performance issues. Another common attacker vector for redirecting control flow is stack what comes from design of today’s architectures, and once again some software approaches lately tackling this as well. Although this software based methods are piece of nice work and effective to big extent, new game changing approach seems coming to the light. Methodology closing this attack vector coming right from hardware - intel. We will compare this way to its software alternatives, how one interleaving another and how they can benefit from each other to challenge attacker by breaking his most fundamental technologies. However same time we go further, to challenge those approaches and show that even with those technologies in place attackers is not yet in the corner.
[2012 CodeEngn Conference 06] beist - Everyone has his or her own fuzzerGangSeok Lee
2012 CodeEngn Conference 06
퍼징 기술의 입문자, 중급자에 초점을 맞추었고 퍼징 기술에 대한 백그라운드 설명부터 시작하여 최근의 퍼징 기술에는 어떠한 것들이 있는지 살펴보고 퍼징 기술이 버그 찾기에 어떻게 쓰일 수 있는지 부터 시작하여 효율적인 퍼징 테크닉은 어떤것들이 있는지 설명한다. 또한, 각 퍼징 기법들의 한계점과 단점에 대해서 지적하며 왜 자신만의 퍼징 노하우와 방법이 필요한지 설명하면서 퍼징 기술의 복잡성과 다양성, 해커들은 어떤 기법을 선호하는지 소개한다. 발표자가 사용하고 있는 기법이나 노하우에 대해서도 공유 할 예정이다.
http://codeengn.com/conference/06
Session - Debugging memory stomps and other atrocities - Stefan Reinalter - T...Expert Insight
The document discusses common memory-related bugs in games such as memory leaks, stack overflows, and memory overwrites. It provides examples of each bug and recommends remedies like using bounds checking, static code analysis tools, and memory tracking to debug issues. Debugging optimized builds is also discussed, emphasizing the importance of understanding compiler optimizations and assembly code. Hardware breakpoints and page protection are presented as techniques for finding random memory overwrites.
The document discusses techniques for rapidly testing web applications through automation to find security vulnerabilities within a limited time frame (T) and network requests (Q). It proposes prioritizing testing based on features like platform, number of inputs, and response status. Algorithmic approaches are suggested like using polyglot payloads to check for multiple issues simultaneously, building a decision tree to classify hackability, and calculating page priorities to guide the scan. Whitebox testing techniques like custom grep scripts to find code vulnerabilities are also covered. The goal is to build an efficient automated web application scanner that traverses the "pwning paths graph" to find bugs within the constraints.
Practical Malware Analysis: Ch 10: Kernel Debugging with WinDbgSam Bowne
This document discusses using WinDbg for kernel debugging and analyzing rootkits. It explains that WinDbg can debug in both user-mode and kernel-mode, unlike OllyDbg which is only for user-mode. Device drivers run code in the Windows kernel and are difficult to analyze. The DriverEntry routine is called when a driver is loaded and it registers callback functions. Malware often imports functions from Ntoskrnl.exe and Hal.dll to manipulate the kernel. WinDbg commands like bp, lm, and dt are demonstrated for setting breakpoints, listing modules, and viewing structures. Symbol files from Microsoft provide function and structure names to make debugging easier.
This document provides tips for taking the OSCP certification exam, focusing on reconnaissance, exploitation, and pivoting. It recommends aggressively scanning all ports with NMAP, using tools like Dirbuster for web enumeration, and saving all findings. Exploitation advice includes using Searchsploit and Metasploit carefully according to exam rules, and getting comfortable with buffer overflows. The document also suggests scripting commonly used exploits, thoroughly pillaging compromised systems, and pivoting networks through SSH port forwarding or ProxyChains. Organizing notes and completing the required lab report are also emphasized.
This document provides an overview of using the OllyDbg debugger to analyze malware. It discusses OllyDbg's history and interface, how to load and debug malware using OllyDbg, setting breakpoints, tracing code execution, patching code, and analyzing shellcode. The key points are that OllyDbg is an effective tool for debugging malware, it allows setting different breakpoint types, tracing helps record execution, and shellcode can be directly analyzed by pasting it into OllyDbg memory.
Software Security : From school to reality and back!Peter Hlavaty
This document provides an overview of software security topics such as terminology, hackers and their roles, tools used for security research, and competitions. It discusses key concepts like programming, code, performance, vulnerabilities, exploitation, and defense techniques. Recommendations are made around starting with tools like IDEs, reverse engineering tools, and virtual machines. Competitions like CTFs are also mentioned as a way to learn and improve skills.
This is the slides accompanying the talk I gave at BSides Hannover 2015, discussing the reverse engineering and exploitation of numerous vulnerabilities in Icomera Moovmanage products along with the post exploitation of such, including the potential creation of a firmware rootkit
Slides for a college course at City College San Francisco. Based on "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software", by Michael Sikorski and Andrew Honig; ISBN-10: 1593272901.
Instructor: Sam Bowne
Class website: https://samsclass.info/126/126_S17.shtml
Useful Shareware for Technical Communicators - STC New England Interchange co...Ed Marshall
Ed Marshall presents useful shareware tools for technical communicators, including file comparison tools like Beyond Compare, search and replace tools like Funduc, advanced text editors like NoteTab Pro and EditPad Pro, and the file transfer program Filezilla. He also discusses tools for keeping computers safe from malware, such as Trend Micro Internet Security, Secunia Personal Security Inspector, and Copernic Desktop Search. Backup utilities like Acronis True Image and CD burning software like Nero 9 Ultra Edition round out the presentation.
CNIT 126: 10: Kernel Debugging with WinDbgSam Bowne
Slides for a college course at City College San Francisco. Based on "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software", by Michael Sikorski and Andrew Honig; ISBN-10: 1593272901.
Instructor: Sam Bowne
Class website: https://samsclass.info/126/126_F18.shtml
Practical Malware Analysis: Ch 8: Debugging Sam Bowne
This document discusses debugging techniques for malware analysis. It describes the differences between disassemblers and debuggers, and introduces two popular debuggers - OllyDbg for user-mode debugging and Windbg for kernel-mode debugging. It covers debugging concepts like source-level versus assembly-level debugging, setting breakpoints, single-stepping, and modifying execution by skipping or testing functions.
The document discusses programming languages and ways they can be improved and customized. It argues that libraries are often overused to extend languages when the compiler itself could be extended instead. This could be done through compiler services that expose compiler information, macros that operate on the syntax tree, and quasi-quotations for building complex AST structures. Extending the compiler allows for more control and avoids issues like dependency cycles that plague library-based extensions.
The document discusses developing an exploit from a vulnerability and integrating it into the Metasploit framework. It covers finding a buffer overflow vulnerability in an application called "Free MP3 CD Ripper", using tools like ImmunityDebugger and Mona.py to crash the application and gain control of EIP. It then shows using Mona.py to generate an exploit, testing it works, and submitting it to the Metasploit framework. It also provides an overview of Meterpreter and its capabilities.
Sperasoft is a game development company specializing in console development. This document provides tips for console development including considerations for different hardware platforms, using development kits to debug platform-specific issues, optimizing for limited memory and performance, following development processes, and addressing technical requirements checklists.
This document provides tips and tricks for debugging Arbortext applications. It discusses challenges like debugging components with multiple interfaces and custom code. It recommends using messages like response() and eval to monitor state, and debugging tools like the Java console. It also suggests adding debug messages programmatically, using binary search, and getting a second set of eyes to help find bugs. Maintaining backups and good documentation are emphasized.
https://youtu.be/rT7qVmQpfJg
https://github.com/utmgdsc/2023-c-workshop
C Workshop
Sam Chan on February 24, 2023
CSC108 level of knowledge required, CSC148 basics recommended
Friday 24th, 5pm
What you’ll learn:
* C vs. Python: what are the main diffs?
* Structs, typedefs and pointers
* Manual memory management
* What can go wrong (segfaults, UB)
* Stack and heap
* Memory management best practices (malloc, free)
The Good, the Bad and the Ugly things to do with androidStanojko Markovik
The document discusses good practices, bad habits, and ugly issues that can arise when developing Android applications.
The good section covers clean code practices, using libraries, XML resources, and lifecycle methods. The bad section notes lazy practices like ignoring lifecycles and leaving cursors open. The ugly section describes ANRs, memory issues like bitmaps and strings, and overuse of logs and notifications. Developers are advised to follow proper patterns, manage resources carefully, and leverage tools like TraceView and MAT to debug problems.
Reading Notes : the practice of programmingJuggernaut Liu
This document summarizes a study group sharing on programming best practices. It discusses topics like style, design, interfaces, debugging, testing, performance, portability, and notation. The speaker, Juggernaut Liu, has 6 years of C# experience and focuses on ideas like using descriptive variable names, commenting code, designing for interfaces to hide implementations, and writing portable code to improve maintainability. Examples are provided throughout to illustrate techniques for writing clean, efficient code.
Scripting experts from Inductive Automation cover general best practices that will help you add flexibility and customization to HMI, SCADA, IIoT, and other industrial applications. Some specific tips about using scripting in the Ignition platform will be included as well.
In this webinar, learn more about:
• Common scripting pitfalls and how to avoid them
• The best programming languages to use
• Things to consider before using scripting
• How scripting environments work
• Scripting timesavers
• And more
Scripting experts from Inductive Automation cover general best practices that will help you add flexibility and customization to HMI, SCADA, IIoT, and other industrial applications. Some specific tips about using scripting in the Ignition platform will be included as well.
In this webinar, learn more about:
• Common scripting pitfalls and how to avoid them
• The best programming languages to use
• Things to consider before using scripting
• How scripting environments work
• Scripting timesavers
• And more
Time Series Anomaly Detection with Azure and .NETTMarco Parenzan
f you have any device or source that generates values over time (also a log from a service), you want to determine if in a time frame, the time serie is correct or you can detect some anomalies. What can you do as a developer (not a Data Scientist) with .NET o Azure? Let's see how in this session.
- Writing code is important for researchers to validate ideas, understand algorithms, and check work, but code is a means to an end rather than the primary product. Researchers should focus on knowledge gained rather than the code itself.
- Researchers must balance optimizing time with producing trustworthy, reproducible results. Using version control and tracking parameters helps achieve this.
- Testing, especially unit testing, helps researchers have confidence in their results. Creative testing approaches may be needed given the nature of research code.
- Researchers should aim to need as few bespoke tools as possible but not less, reusing existing frameworks and code when reasonable. Shared tools can also help disseminate ideas.
The document discusses best practices for coding for production environments. It recommends:
1) Writing code that is easy for others to understand and maintain by avoiding fancy features, scripting all actions, and not reinventing standard processes.
2) Using a sandbox environment that is isolated from production to safely test new code and data without risk.
3) Designing code to be agnostic of the environment by configuring settings instead of having the code directly access resources.
4) Treating exceptions as helpful for developers rather than suppressing them.
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013midnite_runr
Patching Windows Executives with the Backdoor Factory is a presentation about binary patching techniques. It discusses the history of patching, how key generators and Metasploit patch binaries, and how the author learned to manually patch binaries. The presentation then introduces the Backdoor Factory tool, which can automatically patch Windows binaries by injecting shellcode into code caves. It demonstrates patching via code cave insertion, single cave jumps, and cave jumping. Mitigations like self-validation and antivirus are discussed.
Know thy cost (or where performance problems lurk)Oren Eini
Performance happens. Whether you're designed for it or not it doesn’t matter, she is always invited to the party (and you better find her in a good mood). Knowing the cost of every operation, and how it distributes on every subsystem will ensure that when you are building that proof-of-concept (that always ends up in production) or designing the latest’s enterprise-grade application; you will know where those pesky performance bugs like to inhabit. In this session, we will go deep into the inner working of every performance sensitive subsystem. From the relative safety of the client to the binary world of Voron.
Making Scala Faster: 3 Expert Tips For Busy Development TeamsLightbend
This document provides information about the author and discusses ways to improve Scala compilation performance. The author has worked on Scala tooling and is the co-founder of Triplequote. They discuss how build time differs from compilation time due to pre-processing steps. They warn that type classes and macros can significantly increase code size and slow compilation. Whitebox macros are type-checked three times while blackbox macros only participate in type inference. They recommend monitoring compilation to identify bottlenecks like macro expansion or implicit resolution. Finally, they note that the Scala compiler is single-threaded, but parallelization using Scala Hydra can improve compilation speed.
Optimizing mobile applications - Ian Dundore, Mark Harknessozlael ozlael
This document provides tips and best practices for optimizing mobile applications. It discusses using profiling tools like Instruments to identify performance issues. Specific topics covered include reducing startup time, examining callbacks and coroutines, identifying asset loads, and reducing memory usage. The document also provides recommendations for reducing CPU usage through techniques like splitting canvases, avoiding string manipulation, and replacing direct callbacks with an update manager.
0507 057 01 98 * Adana Çukurova Klima Servisleri, Adana Çukurova Klima Servisi, Adana Çukurova Klima Servisleri, Arçelik Klima Servisi Adana Çukurova, Beko Klima Servisi Adana Çukurova, Demirdöküm Klima Servisi Adana Çukurova, Vestel Klima Servisi Adana Çukurova, Aeg Klima Servisi Adana Çukurova, Bosch Klima Servisi Adana Çukurova, Ariston Klima Servisi Adana Çukurova, Samsung Klima Servisi Adana Çukurova, Siemens Klima Servisi Adana Çukurova, Profilo Klima Servisi Adana Çukurova, Fujitsu Klima Servisi Adana Çukurova, Baymak Klima Servisi Adana Çukurova, Sharp Klima Servisi Adana Çukurova, Mitsubishi Klima Servisi Adana Çukurova, Alaska Klima Servisi Adana Çukurova, Aura Klima Servisi Adana Çukurova, Adana Çukurova Klima Servisleri, Alarko Klima Servisi Adana Çukurova
Thursday night is fine with us know what time we should go and if you are approached to make sure you get the best for the wonderful and soon they were going on the top management across
2. What this is about
• The things that you should do at the beginning of a game
(or similar) project to simplify debugging, adding
features, optimization, build and release.
• We are talking about the technical and code aspect of
this problem, but some of the ideas are generalizable to
the rest of the team.
• I can only give you some tips, not a streamlined process.
That's your job.
• Seasoned programmers and developers will definitely
know what I'm talking about and will agree with most of
this. Less-experienced programmers have to trust me (to
some extent.)
3. Process, Process, Process (1/3)
• Do {Conceptualize -> Build -> Import ->
Integrate -> Test } while (0 == 0);
• Iteration time is the most important and under-
estimated factor in game development process.
• Ideally, you should never have to exit the game
to change anything (code, assets, configuration,
scripts,...)
• More realistically, you should never have to exit
the game to change anything except for code.
4. Process, Process, Process (2/3)
• Data-driven design and code is king!
• Keep engineers out of the loop. Seriously!
• Code reviews are good things, even
informal ones.
• Agile philosophy is fantastic for small
game developers.
5. Process, Process, Process (3/3)
• Automate as much as you can, as early as
possible, and keep adapting. Tools, tools,
tools!
• Transparency and discoverability
• Source control, asset control, versioning,
branches, tags and issue tracking are not
just fancy words.
6. Naming and Directory Structure
• A name is a unifying concept. Helps
develop common views and more efficient
and less error-prone communication.
• ??? (No one knows what you need!)
• When choosing a name, consider how that
name looks to these entities:
– Yourself, in 6 months
– Other people
– Scripts and tools
7. Build System (1/4)
• Quick, configurable, dependable, minimal.
• Think about header and source layout, very
carefully and very deliberately.
• The compiler is your friend. Each compile-time
error is potentially one less runtime or logical
error you'd have to chase down.
• Ideally, wrong code should not compile. (Static
assertion, type traits, template
metaprogramming, type system design, etc.)
8. Build System (2/4)
• Code build time is important. Make it as
short as possible.
– Plan the dependencies (inside your code.)
– Use precompiled headers.
– Modularize your code (into libraries.)
– Use abstract interfaces (but consider the
performance costs of polymorphism.)
– Eliminate unnecessary inter-class
dependencies.
– Use forward definitions.
9. Build System (3/4)
• Build variations
– Full debug
– Optimized debug
– Profiled release
– Developer release (with debug information)
– Retail
– and a couple more...
10. Build System (4/4)
• Strive to always have a build that is
always:
– Playable
– Performant
– Progressing
– In Memory
– Stable
12. Decisions to be Made
• Coding Style
• To OOP or not to OOP...
• Exceptions
• RTTI
• Templates vs. Polymorphism
• Smart pointers vs. Handles vs. Raw pointers
• RAII
• Lifetime and Ownership Management (and a bag full of
problems)
• Intrusive code instrumentation
• String format
• and much much much more...
13. Love Thy Compiler (1/2)
• Use EVERY little obscure compiler and platform facility
that can possibly help.
• But wrap them up, even if you don't care about portability
(in case of a change in compilers/libraries, or if you want
to disable a feature, etc.)
• Don't be afraid of assembly. Learn to read through what
your compiler produces. Love doesn't necessarily imply
trust!
• Memory is NOT fast (except on an SPU.) LOVE YOUR
CACHE TOO. Even more than your compiler.
14. Love Thy Compiler (2/2)
• Learn all about compiler #pragmas and intrinsics.
• Use intrinsics instead of inline assembly, because asm
usually hinders compiler optimizations.
• Learn about pointer aliasing, restricted pointers and
every other hint that you can give the compiler to
produce better (faster) code.
• Don't be afraid of assembly. Sometimes compilers
generate really bad code. Hand-crafted assembly is and
always will be an option.
• ...but not for the faint of heart. Don't drop to assembly
lightly, specially on PC.
15. Type System (1/3)
• Consider implementing your own containers (STL is
too frivolous with memory.)
• Type metadata and reflection
• Try not to use common type keywords (int, short,
float, etc.) Typedef them all.
– i32, u32, i16, u64, i8, u8, byte, ch8, ch16, ...
– f32, f64, v128
• ..or use stdint.h, which is a standard header but
missing from Visual C++ (still!) There are free and
conforming implementations available though.
16. Type System (2/3)
• Types that are equal physically, but not
semantically:
– Use different classes with no assignment
operators (or at least correct ones.) For example:
Degree vs. Radian, NormalizedVector3 vs.
Vector3
– Hungarian Notation (commonly misapplied, e.g.
in Win32 headers and docs!)
• degAngle = radAngle; is most probably
wrong and the good thing is that it indeed
looks WRONG.
17. Type System (3/3)
• Strings
– ASCII is dead (mostly.)
– At least differentiate between these usages:
• File names and paths.
• User input and text shown to the user.
• Internal entity names, IDs and the like.
• Text file and script contents, etc.
• And many more.
– Realize that some strings are (mostly) constant during
their lifetime. (Optimization opportunity!)
18. Pointers
• Don't use T* to represent a pointer to T. At least
typedef something like TPtr and use that instead (or
Ptr<T>.)
• Don't use T* to represent an array. Use a struct with
size information (templated for arrays with known sizes
at compile-time, or a member size_t (or smaller data if
suitable) if not.)
• NULL is not the only invalid pointer value (0xcdcdcdcd,
0xcafebabe, 0xdeadc0de, …) Don't use comparison
with NULL to detect this. Use a macro.
• Don't just use NULL for passing optional values. You can
use boost::optional, or at the very least abstract out
the concept.
19. Standard Library Independence
• File Handling and asynchronous I/O
• Directory handling
• Random numbers
• Math
• Time handling
• ...
20. Debugging
Consider the idea that the purpose of
writing code is not running it. Write code
for debugging.
• Logging
• Assertion
• Context metadata
• Crash handling and crash dump
• Visualizing data
21. Debug: Logging
• Do NOT overwhelm!
• Collect as much as possible, show as little as
needed.
• A good logging library should be:
– runtime controllable
– able to send logs to multiple targets
– able to filter what is sent where based on audience,
source, target, etc.
– fast, fast, fast
– as non-intrusive as possible
– Employed from day 0.
22. Debug: Assertion
• You do use them, don't you?!
• Never use the standard assert!
• Assert whenever you can, but nowhere
you shouldn't. (Hint: don't assert when a
configuration file is not found; make a new
one!)
23. Debug: Context metadata
• Should be totally and partially disable-able.
• Including, but not limited to:
– Machine name, user name, code revision, build number, build
parameters, time, environment, frame number, etc.
– Where does the execution flow come from? (Stack trace)
– Where are we now? File, line, function, instance.
– Which subsystem called this piece of code? Graphics? AI?
Animation? Sound?
– Why did it call this? Was it initializing? Loading data? Looking for
a collision? Walking the scene graph? Visiting AI actors?
– How long did the function take to execute?
– How Many times was it called in this frame?
– How many memory allocations did it perform?
– … (use your imagination!)
24. Debug: Crash handling and crash
dump
• If you have to fail, fail as soon as possible and
as loud as possible.
• Gather as much data as you possibly can: place,
time, what happened before, what was going to
happen after, context, hardware environment,
software environment, user settings, etc.
• Use a “Black Box” type construct. Collect some
data all the time, but store it only when crashing.
• Consider automatically submitting this info to
your issue tracker (during development) or
emailing it to your team (after release.)
25. Debug: Visualizing Data
• There is much more going on in a game than
graphics (which can be seen already!)
– Lots of data involved.
– No clear picture from mere numbers.
– Hard to understand in a single slice of time.
• Add visual representations for non-visual
objects: physics, bounding volumes, AI
algorithms, behavioral decisions, etc.
• Real-time graphs and bars too!
26. Memory
• NEVER use naked new/delete in real code.
• NEVER EVER use naked new/delete in real code!
• Write your own memory manager, even if it is just a
wrapper over new/delete.
• Don't forget malloc() and friends.
• Don't forget third-party libraries.
• Always be conscious about who uses how much
memory. Always.
• Always override the memory management in third party
libraries (including STL) unless you have reason not to.
• Writing a memory bug detector is quite easy. Write one
or find one.
• Memory allocation is usually a source of performance
bottlenecks as well as bugs.
27. In-game console
• Useful for debugging and interactive
experimentation.
• Tied-in to the scripting system.
• Make it like a good OS shell.
• Can think about it as a higher-level debugger
(inter-object relationships, etc.)
• Give access to everything you can, but consider
that the designers and artists will have to use it
too.
28. Serialization
• Useful for much more than saving/loading or
network communication.
• Template magic? Some form of IDL?
Übermacros?
• Consider two interchangeable formats: one
optimized binary and one human readable.
• Make everything you can serializable.
• Consider interactions with source control.
• Plan for evolution of data structures over the
course of development.
29. Runtime Asset management
• Everything other than code that
constitutes the game.
• Consider going beyond simple files.
• Consider treating asset management
more like writing a DBMS, than a file
system.
• Consider integrating asset fingerprinting,
change management, versioning, change
detection, hot reloading, etc.
• Consider asynchronous operations.
30. Time
• Do NOT underestimate time management.
• Never just use direct calls to OS to get the time for game
subsystems.
• Familiarize yourself with higher-resolution timers
(RDTSC, QueryPerformanceCounter(),
gettimeofday(), ...)
• Familiarize yourself with multi-core issues, power
management issues, Windows issues(!), user issues,...
• Consider the difference between wall clock, game clock,
camera clock, level clock, animation clock, etc.
• The more time you put in time, the better the times you'll
have when the time of debugging time comes!
31. Screen capture and Game Replay
• Capturing still images is a must.
• Capturing video is a big plus.
• Capturing metadata (DEM files, anyone?) to be
able to replay a scenario is a huge plus.
• The game replay subsystem can be
implemented with varying levels of complexity
and functionality. Even a simple system can
have considerable benefits.
32. Runtime Statistics
• Please invest in this!
• You must know your own game. This is
one very good way.
• Anything from frame-rate and tri-count to
number of memory allocations and file
accesses per frame, per second or per-
level.
• Find interesting ways to display these
data.
33. Automated Testing
• Full unit testing is the Holy Grail!
• Testing of games and features is usually very
time consuming. Any automation helps.
• Any change in code or assets can have
undesired side-effects: regression testing.
• You can even have automatic screen-shot
comparisons!
• Auto test non-visual parts, if you can't manage
more sophisticated methods.
34. Questions?
"I know that you believe that you
understood what you think I said, but I
am not sure you realize that what you
heard is not what I meant.”
#2: This is a modified version of what I presented at CGS10 in Sharif University. A few slides has been added.
#17: Hungarian Notation: The idea is to add information about the usage of a value to the name of its variable. Commonly, the only information added is about the type (e.g. pFoo for a pointer or dwHeight for a DWORD) which is useless and stupid. This is not how the concept was intended to be employed.
#35: Did I mention that static and global data are evil?!