Code Responsibly with Generative AI in C++ training

Day 1
Coding responsibly with GenAI 
What is security?
Threat and risk
Cyber security threat types – the CIA triad
Cyber security threat types – the STRIDE model
Consequences of insecure software
What is responsible AI?
Security and responsible AI in software development
Memory management vulnerabilities
Assembly basics and calling conventions
•    x64 assembly essentials
•    Registers and addressing
•    Most common instructions
•    Calling conventions on x64
o    Calling convention – what it is all about
o    Calling convention on x64
o    The stack frame
o    Stacked function calls
Buffer overflow
•    Memory management and security
•    Buffer security issues
•    Buffer overflow on the stack
o    Buffer overflow on the stack – stack smashing
o    Exploitation – Hijacking the control flow
o    Lab – Buffer overflow 101, code reuse
o    Exploitation – Arbitrary code execution
o    Injecting shellcode
o    Lab – Code injection, exploitation with shellcode
o    Case study – Stack BOF in FriendlyName handling of the Wemo Smart Plug
•    Pointer manipulation
o    Modification of jump tables
o    Overwriting function pointers
Best practices and some typical mistakes 
•    Unsafe functions
•    Dealing with unsafe functions
•    Lab – Fixing buffer overflow
•    Using std::string in C++
•    Unterminated strings
•    readlink() and string termination
•    Manipulating C-style strings in C++
•    Malicious string termination
•    Lab – String termination confusion
•    String length calculation mistakes
Day 2
Memory management hardening 
Securing the toolchain
Compiler options and instrumentation
•    Securing the toolchain in C++
•    Using FORTIFY_SOURCE
•    Lab – Effects of FORTIFY
•    AddressSanitizer (ASan)
o    Using AddressSanitizer (ASan)
o    Lab – Using AddressSanitizer
•    Stack smashing protection
o    Detecting BoF with a stack canary
o    Argument cloning
o    Stack smashing protection on various platforms
o    SSP changes to the prologue and epilogue
o    Lab – Effects of stack smashing protection
Runtime protections 
•    Runtime instrumentation
•    Address Space Layout Randomization (ASLR)
o    ASLR on various platforms
o    Lab – Effects of ASLR
o    Circumventing ASLR – NOP sleds
•    Non-executable memory areas
o    The NX bit
o    Write XOR Execute (W^X)
o    NX on various platforms
o    Lab – Effects of NX
o    NX circumvention – Code reuse attacks
-    Return-to-libc / arc injection
o    Return Oriented Programming (ROP)
-    Protection against ROP
-    Case study – Systematic exploitation of a MediaTek buffer overflow
Common software security weaknesses
Security features 
•    Authentication
•    Password management 
o    Storing account passwords
o    Password in transit
o    Lab – Is just hashing passwords enough?
o    Dictionary attacks and brute forcing
o    Salting
o    Adaptive hash functions for password storage
•    Password policy
o    NIST authenticator requirements for memorized secrets
o    Password database migration
Code quality 
•    Code quality and security
•    Data handling
o    Type mismatch
o    Lab – Type mismatch
o    Initialization and cleanup
-    Constructors and destructors
-    Initialization of static objects
-    Lab – Initialization cycles
o    Unreleased resource
-    Array disposal in C++
-    Lab – Mixing delete and delete[]
•    Object oriented programming pitfalls
o    Inheritance and object slicing
o    Implementing the copy operator
o    The copy operator and mutability
o    Mutability
-    Mutable predicate function objects
-    Lab – Mutable predicate function object
Using vulnerable components 
Security of AI generated code
•    Practical attacks against code generation tools
•    Dependency hallucination via generative AI
•    Case study – A history of GitHub Copilot weaknesses (up to mid-2025)
•    Case study – Agentic coding and code security (mid-2025 onward)
Day 3
Common software security weaknesses
Input validation 
•    Input validation principles
•    Denylists and allowlists
•    What to validate – the attack surface
•    Where to validate – defense in depth
•    When to validate – validation vs transformations
•    Injection 
o    Code injection
-    OS command injection
-    Lab – Command injection
-    OS command injection best practices
-    Avoiding command injection with the right APIs
-    Lab – Command injection best practices
-    Lab – Experimenting with command injection in GenAI
-    Case study – Command injection in Zyxel IKE packet decoder
•    Integer handling problems
o    Representing signed numbers
o    Integer visualization
o    Integer promotion
o    Integer overflow
o    Lab – Integer overflow
o    Lab – Experimenting with integer overflow in GenAI
o    Case study – Integer underflows in IPv6 handling of tcpip.sys
o    Signed / unsigned confusion
o    Case study – Signed/unsigned confusion DoS in DrayTek Vigor routers
o    Lab – Signed / unsigned confusion
o    Lab – Experimenting with signed / unsigned confusion in GenAI
o    Integer truncation
o    Lab – Integer truncation
o    Lab – Experimenting with integer truncation in GenAI
o    Best practices
-    Upcasting
-    Precondition testing
-    Postcondition testing
-    Using big integer libraries
-    Best practices in C
-    UBSan changes to arithmetics
-    Lab – Handling integer overflow on the toolchain level in C++
-    Best practices in C++
-    Lab – Integer handling best practices in C++
-    Case study – Integer check failure in Skia
•    Files and streams 

o    Path traversal
o    Lab – Path traversal
o    Path traversal-related examples
o    Case study – File spoofing in WinRAR
o    Virtual resources
o    Path traversal best practices
o    Lab – Path canonicalization
o    Lab – Experimenting with path traversal in GenAI
•    Format string issues 
o    The problem with printf()
o    Lab – Exploiting format string
Wrap up 
Secure coding principles
•    Principles of robust programming by Matt Bishop
•    Secure design principles of Saltzer and Schroeder
And now what?
•    Software security sources and further reading
•    C and C++ resources
•    Generative AI – Resources and additional guidance.