Skip to content
SudoSecurity

Sections

Course

C for Systems & Security

Read and write C where it still lives: memory ownership, pointer arithmetic, undefined behavior, the classic exploit patterns, and the modern tooling that catches them.

9 lessons

Course Q&A

Memory, Pointers, and Ownership

How C lays out memory, what pointers really are, and the ownership discipline that keeps heap code from leaking or corrupting.

  1. 01How C Lays Out Memory: Stack, Heap, and AddressesMap a real process: text, data, bss, heap, stack, and how to read /proc/<pid>/maps and ASLR's effect.20mOpen
  2. 02Pointer Arithmetic, Array Decay, and Bounds Disciplinep + n moves elements, not bytes; sizeof lies at function boundaries; walk untrusted buffers without walking off them.25mOpen
  3. 03Ownership: malloc, free, and Who Frees WhatThe caller/callee contracts, single-exit goto cleanup, the realloc leak trap, and the double-free defenses that scale.25mMembers

Undefined Behavior and the Classic Exploits

The bugs that made C infamous: UB, stack overflows, format strings, and use-after-free, how they work and how they're found.

  1. 01Undefined Behavior: The Compiler Is Not Your FriendSigned overflow, strict aliasing, unsequenced writes — why -O2 deletes your checks and how UBSan names them.25mMembers
  2. 02Buffer Overflows: Smashing and Reading the StackFrame layout, overwriting the return address, Heartbleed-style over-reads, and what canaries/NX/ASLR actually stop.30mMembers
  3. 03Format Strings and Use-After-Freeprintf(user) leaks the stack and %n writes it; dangling pointers read reused memory. Fixes and field checks.30mMembers

Modern Tooling and Defensive C

The toolchain that catches memory bugs before attackers do: sanitizers, fuzzers, hardening flags, and sane C idioms.

  1. 01The Sanitizer Triad: ASan, UBSan, and MSanBuild with -fsanitize and let every OOB, UAF, and uninitialized read name itself with a stack trace in CI.25mPremium
  2. 02Fuzzing C: libFuzzer Harnesses and AFL++Coverage-guided fuzzing finds the bugs review misses — write the harness, seed the corpus, read the crash file.30mPremium
  3. 03Shipping Hardened C: Flags, Idioms, and When to StopThe production flag set, checksec verification, safe idioms — and the honest case for choosing Rust next time.25mPremium