PBuelow128889 (Community Member) asked a question.
Company mandated analysis for a C++ implementation on an ARM Linux platform. Can Veracode handle this? If so, what's possible?
I've got a support case open, but I thought I would ask the community what Veracode can do for embedded ARM Linux applications and libraries (C++ and Yocto based). I know about the command line tool, and hope to give that a run this week. We aren't docker based, and don't use virtualization at all. This is like we are building a bunch of RPi type apps to run directly on Raspbian .
Anyone else work through this yet and have some pointers? Is what I want to do here possible? What might actually be possible?
.png){kind=logo}
Hi @PBuelow128889 (Community Member) ,
From our Compilation Instructions for C/C++ on Solaris and Linux:
> Veracode does not currently support analyzing C/C++ code compiled for Itanium (IA64), Alpha, MIPS, PowerPC, ARM, or other microarchitectures.
* https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/FO_I~d5tIL7O0b5Xxue4kQ
If you would like to have this software scanned with Veracode Static Analysis you will need to compile the application on a supported platform (like CentOS) to a supported processor architecture (like X86_64). This may however be difficult if the application makes heavy use of Rasbian APIs.
If you're building on a supported platform you might also want to use Veracode Software Composition Analysis to determine if any library used has any known vulnerabilities, more information here: https://help.veracode.com/reader/hHHR3gv0wYc2WbCclECf_A/UhhyEJn_0hV2vR9FPAJ7DA .
You may also want to investigate Veracode Manual Penetration Testing ( https://help.veracode.com/reader/Q1kdnfv1dleCE31uWgTKzw/LtIuhqHFUlz0vaCKM_mOJw ) to identify vulnerabilities in these types of applications.
Thank you,
Boy Baukema