MSDL, Microsoft Security Development Lifecycle

http://blogs.msdn.com/b/sdl/

By following a few simple guidelines, you can help to ensure that your application’s users’ credentials remain secure, even if your database is compromised:

Always store and compare hashes of passwords, never the plaintext passwords themselves.
Apply a random, unique salt value to each password before hashing.
Use a cryptographically strong hash algorithm such as one from the SHA-2 family.
Allow for potential future algorithm changes by implementing a cryptographically agile design.
Hash on the server tier and be sure to transmit all passwords and credential tokens over HTTPS.

Mocking Frameworks and NUnit

A Mocking framework like Rhino allows you to mock the behaviour of objects and interfaces
For example we may have a class called Duck which implements interface ITalk
and this may have a method quack

Class Library below is LibWithMultipleClasses.dll which has the class to be tested
*************************************************************************************
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

namespace LibWithMultipleClasses
{
public interface ITalk
{
void quack();
}

public class Duck
{
ITalk s;

public int Method1(ITalk s)
{
s.quack();
return 1;
}
}
}

Class Library below is NUnitTests.dll which will be input as a dll into NUnit GUI
*************************************************************************************
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using NUnit.Framework;
using LibWithMultipleClasses;
using Rhino.Mocks;

namespace NUnitTests
{
[TestFixture]
public class MyTestClass
{
Duck f;
MockRepository m;
ITalk q;


[SetUp]
public void Initialize()
{
m = new MockRepository();
f = new Duck();
q = (ITalk)m.CreateMock(typeof(ITalk));
}

[Test]
public void CallMethod1_inDuck1()
{
Expect.Call(q.quack);
m.ReplayAll();
Assert.AreEqual(f.Method1(q), 1);
m.VerifyAll();
}

[Test]
public void CallMethod1_inDuck2()
{

Assert.AreEqual(f.Method1(q), 1);
}

[TearDown]
public void End()
{ }
}
}

Great Way to use Enums(by casting)

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

namespace ConsoleApplication1
{
public enum Fruit
{
apple = 0,
watermelon = 1,
banana = 3
}


class Program
{
static void Main(string[] args)
{
foreach(Fruit f in Enum.GetValues(typeof(Fruit)))
{
Console.WriteLine((int)f);
}

Console.WriteLine((int)Fruit.apple);
}
}
}

Sheet for WinDbg/SOS

Nice sheet from the following blog for WinDbg/SOS
http://geekswithblogs.net/.NETonMyMind/archive/2006/03/14/72262.aspx



Starting, Attaching, Executing and Exiting


Start -> All Programs -> Debugging Tools for Windows -> WinDbg

F6
attach to process

Ctrl-Break
interrupt debugee

.detach
detach from a process

g
continue debugee execution

q
exit WinDbg




Getting Help

?
help on commands that affect the debugee

.help
help on commands that affect the debugger

.hh command
view the on line help file

!help
help on the extension dll at the top of the chain (e. g., SOS)




Issuing Commands

up arrow, down arrow, enter
scroll through command history

Right mouse button
paste into command window




Examining the Unmanaged Environment

lmf
list loaded modules with full path

lmt
list loaded modules with last modified timestamp

~
list unmanaged threads

~thread s
select a thread for thread specific commands

!token -n
view thread permissions

k
view the unmanaged call stack

!runaway
view thread CPU consumption

bp
set a breakpoint

.dump path
dump small memory image

.dump /ma path
dump complete memory image




Working with Extension DLLs (e. g., SOS)

.chain
list extensions dlls

.load clr10\sos
load SOS for debugging framework 1.0 / 1.1

.unload clr10\sos
unload SOS

.loadby sos mscorwks
load SOS for debugging framework 2.0




SOS Commands

!threads
view managed threads

!clrstack
view the managed call stack

!dumpstack
view combined unmanaged & managed call stack

!clrstack -p
view function call arguments

!clrstack –l
view stack (local) variables

!name2ee module class
view addresses associated with a class or method

!dumpmt –md address
view the method table & methods for a class

!dumpmd address
view detailed information about a method

!do address
view information about an object

!dumpheap –stat
view memory consumption by type

!dumpheap –min size
view memory consumption by object when at least size

!dumpheap –type type
view memory consumption for all objects of type type

!gcroot address
view which object are holding a reference to address

!syncblk
view information about managed locks




SOS 2.0 Commands

!bpmd module method
set breakpoint

!DumpArray address
view contents of an array

!PrintException
view information about most recent exception

Art of Living News from around the Globe

The News is being fed from a temporary feed as of now.
This feed will soon be sourced from http://www.artofliving.org/

Some of the Art of Living Centres from around the Globe

Google SEO

Google Webmasters
Google Webmasters Guidelines