Secure Coding in C++ with Claude Code

Day 1

Coding responsibly with Claude Code 

What is security?

Threat and risk

Cyber security threat types – the CIA triad

Cyber security threat types – the STRIDE model

Consequences of insecure software

What is responsible AI?

Security and responsible AI in software development

Memory management vulnerabilities

Assembly basics and calling conventions 

· x64 assembly essentials

· Registers and addressing

· Most common instructions

· Calling conventions on x64

o Calling convention – what it is all about

o Calling convention on x64

o The stack frame

o Stacked function calls

Buffer overflow

· Memory management and security

· Buffer security issues

· Buffer overflow on the stack

o Buffer overflow on the stack – stack smashing

o Exploitation – Hijacking the control flow

o Lab – Buffer overflow 101, code reuse

o Exploitation – Arbitrary code execution

o Injecting shellcode

o Lab – Code injection, exploitation with shellcode

o Case study – Stack BOF in FriendlyName handling of the Wemo Smart Plug

· Pointer manipulation

o Modification of jump tables

o Overwriting function pointers

Best practices and some typical mistakes 

· Unsafe functions

· Dealing with unsafe functions

· Lab – Fixing buffer overflow

· Using std::string in C++

· Unterminated strings

· readlink() and string termination

· Manipulating C-style strings in C++

· Malicious string termination

· Lab – String termination confusion

· String length calculation mistakes

Day 2

Memory management hardening 

Securing the toolchain 

Compiler options and instrumentation

· Securing the toolchain in C++

· Using FORTIFY_SOURCE

· Lab – Effects of FORTIFY

· AddressSanitizer (ASan)

o Using AddressSanitizer (ASan)

o Lab – Using AddressSanitizer

· Stack smashing protection

o Detecting BoF with a stack canary

o Argument cloning

o Stack smashing protection on various platforms

o SSP changes to the prologue and epilogue

o Lab – Effects of stack smashing protection

Runtime protections 

· Runtime instrumentation

· Address Space Layout Randomization (ASLR)

o ASLR on various platforms

o Lab – Effects of ASLR

o Circumventing ASLR – NOP sleds

· Non-executable memory areas

o The NX bit

o Write XOR Execute (W^X)

o NX on various platforms

o Lab – Effects of NX

o NX circumvention – Code reuse attacks

- Return-to-libc / arc injection

o Return Oriented Programming (ROP)

- Protection against ROP

- Case study – Systematic exploitation of a MediaTek buffer overflow

Common software security weaknesses

Security features 

· Authentication

· Password management 

o Storing account passwords

o Password in transit

o Lab – Is just hashing passwords enough?

o Dictionary attacks and brute forcing

o Salting

o Adaptive hash functions for password storage

· Password policy

o NIST authenticator requirements for memorized secrets

o Password database migration

Code quality 

· Code quality and security

· Data handling

o Type mismatch

o Lab – Type mismatch

o Initialization and cleanup

- Constructors and destructors

- Initialization of static objects

- Lab – Initialization cycles

o Unreleased resource

- Array disposal in C++

- Lab – Mixing delete and delete[]

· Object oriented programming pitfalls

o Inheritance and object slicing

o Implementing the copy operator

o The copy operator and mutability

o Mutability

- Mutable predicate function objects

- Lab – Mutable predicate function object

Using vulnerable components 

Security of AI generated code

· Practical attacks against code generation tools

· Dependency hallucination via generative AI

· Case study – Agentic coding and code security (mid-2025 onward)

Day 3

Common software security weaknesses

Input validation 

· Input validation principles

· Denylists and allowlists

· What to validate – the attack surface

· Where to validate – defense in depth

· When to validate – validation vs transformations

· Injection 

o Code injection 

- OS command injection

- Lab – Command injection

- OS command injection best practices

- Avoiding command injection with the right APIs

- Lab – Command injection best practices

- Lab – Experimenting with command injection in Claude Code

- Case study – Command injection in Zyxel IKE packet decoder

· Integer handling problems

o Representing signed numbers

o Integer visualization

o Integer promotion

o Integer overflow

o Lab – Integer overflow

o Lab – Experimenting with integer overflow in Claude Code

o Case study – Integer underflows in IPv6 handling of tcpip.sys

o Signed / unsigned confusion

o Case study – Signed/unsigned confusion DoS in DrayTek Vigor routers

o Lab – Signed / unsigned confusion

o Lab – Experimenting with signed / unsigned confusion in Claude Code

o Integer truncation

o Lab – Integer truncation

o Lab – Experimenting with integer truncation in Claude Code

o Best practices

- Upcasting

- Precondition testing

- Postcondition testing

- Using big integer libraries

- Best practices in C

- UBSan changes to arithmetics

- Lab – Handling integer overflow on the toolchain level in C++

- Best practices in C++

- Lab – Integer handling best practices in C++

- Case study – Integer check failure in Skia

· Files and streams 

o Path traversal

o Lab – Path traversal

o Path traversal-related examples

o Case study – File spoofing in WinRAR

o Virtual resources

o Path traversal best practices

o Lab – Path canonicalization

o Lab – Experimenting with path traversal in Claude Code

· Format string issues 

o The problem with printf()

o Lab – Exploiting format string

Wrap up 

Secure coding principles

· Principles of robust programming by Matt Bishop

· Secure design principles of Saltzer and Schroeder

And now what?

· Software security sources and further reading

· C and C++ resources

· Generative AI – Resources and additional guidance.