C from a reverse engineer's perspective

C-P01NTs

A C workshop from a reverse engineer's perspective — nineteen lessons that start at the compilation stages and end at the preprocessor, tying every concept to its footprint in the disassembly.

19 Lessons 3 Stages

Start at 0x00

Basics

Stage 1 — Language Foundations

8 lessons

From compilation stages to arrays and strings: the structure everything else builds on, each concept tied to its footprint in the binary.

0x00 The Stages Code Goes Through 3 min read The four stages that turn C code into an executable — preprocessor, compiler, assembler, linker — and how each one shapes the binary. 0x01 Program Structure 3 min read The basic anatomy of a C program: includes, main, comments, global variables, and functions — and what each part leaves in the binary. 0x02 Variables and Constants 4 min read Declaring variables and naming rules, constants via const and #define, and the fundamental difference between them at compile time and in memory. 0x03 Data Types and Format Specifiers 4 min read Data types and their real sizes on x86/x64, plus printf/scanf format specifiers — mapped to operand sizes in assembly. 0x04 Escape Sequences 3 min read Escape sequences and the null terminator (0x00): how strings are actually stored, and why strings inside binaries end with zero. 0x05 Conditional Statements 5 min read if/else, switch, and the ternary operator — and how they become cmp instructions, conditional jumps, and jump tables in disassembly. 0x06 Loops 5 min read while, do-while, for, and nested loops — and the fingerprint that gives a loop away in assembly: the backward jump. 0x07 Arrays and Strings 5 min read Arrays and strings in memory, the dangerous string.h functions, and their direct relationship to buffer overflow vulnerabilities.

Memory

Stage 2 — Functions & Memory

5 lessons

The heart of the series: functions, pointers, bitwise operators, then the Stack and Heap anatomy down to dynamic allocation and its exploits.

0x08 Functions 6 min read Function types, the memory and I/O functions that matter to analysts, plus prologue/epilogue structure and calling conventions. 0x09 Pointers and Memory Management 8 min read Pointer types, address arithmetic, and the five memory segments — plus where pointers meet famous vulnerabilities. 0x10 Bitwise Operators 6 min read Bitwise operators and increment/decrement — the shared language between C and assembly, including XOR decryption patterns. 0x11 Virtual Memory: Stack vs Heap 9 min read Stack frames, registers, and calling conventions, plus heap chunks — the two primary battlegrounds of exploitation. 0x12 Dynamic Memory Allocation 10 min read malloc, calloc, realloc, bins, and tcache — and the misuse vulnerabilities: heap overflow, UAF, and double free.

Advanced

Stage 3 — Low-level & Advanced Types

6 lessons

Real assembly work: passing by reference, scopes and static, structs and unions, and the preprocessor.

0x13 Passing by Value vs by Reference 10 min read Value vs reference passing fully traced in x86-64 assembly — the golden rule for telling mov apart from lea. 0x14 Functions — Part Two 8 min read Variable scope, header files, static, and recursion — with a complete step-by-step trace of the stack frame. 0x15 Data Modifiers 4 min read Sign, size, and storage modifiers (signed/short/static), and two's complement representation of negative numbers. 0x16 Structures 5 min read Structs, typedef, and the arrow operator, padding and alignment — and how a struct becomes an offset map during analysis. 0x17 Bit Fields, Unions, and Enums 4 min read Bit fields, unions, and enums — three daily tools for reading binaries, each with clear patterns in assembly. 0x18 The Preprocessor 5 min read Preprocessor directives: macros, conditional compilation, and #pragma pack — and what each leaves behind in the binary.