Re: Delphi and buffer overflows

1/ If you mean "Delphi programs are immune to buffer overflows because
they have a 'String' data type", you're wrong.

See the recent Argosoft FTP Server vulnerability, which is a plain
exploitable heap overflow vulnerability. Remember that Delphi has to
handle C-style strings to communicate with Windows Native API.

2/ IMHO, decompiling Delphi programs is useless. Most Delphi
applications are compiled as native x86 applications nowadays (e.g.
Skype), and will be perfectly handled by IDA Pro, with full support of
Delphi signatures.

Regards,
- Nicolas RUFF
Received on Apr 18 2006