C-P01NTs on P01NT

The Stages Code Goes Through

Thu, 13 Aug 2026 10:00:00 +0300

Assalamu alaikum wa rahmatullahi wa barakatuh.

This series covers the fundamentals of the C language that matter most for reverse engineering. We will not expand into every detail of the language — only into what matters when reading disassembly and analyzing binaries.

The Stages C Code Goes Through

We start with the source code — the .c file containing what we wrote. This code passes through four stages before it executes, and understanding them is extremely important:

Program Structure

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

In this article we will look at the basic structural anatomy of a C program. The structure consists of essential parts that every C program adheres to:

#include <stdio.h> // Including system libraries
// Definition of constants or global variables


// Other functions


int main(){
 // Core code here
 // Variables, functions, loops, conditionals
 return 0; // Return value to the operating system
}


// Other functions

1. Includes

Example: #include <stdio.h> — used to import built-in libraries. This particular library is responsible for input and output, and its name stdio stands for:

Variables and Constants

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

In this article we will cover how to declare variables, the steps involved and the naming rules, plus how to define constants, their types, and how to declare them — and finally we will clarify the difference between variables and constants.

First: Variables

Definition: a location reserved in memory (RAM) to store a specific value while the program runs.

A subtle note: when a function ends, a local variable’s space on the stack is reclaimed — but the value itself may remain in physical memory until it is overwritten by other values. This concept matters greatly in reverse engineering: analysts sometimes hunt for stale values that were never deliberately wiped.

Data Types and Format Specifiers

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

In this article we will look at data types and the format specifiers associated with them.

Note: sometimes memorizing the English terminology is a must, because most of your work with programming languages will be in English — and Arabic translations vary from one person to another.

What Are Data Types?

They are the form in which data (such as variables) is stored so it can be kept and processed. The most important types:

Escape Sequences

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

In this article we will look at escape sequences, their importance, and their uses.

What Are Escape Sequences?

They are used inside strings to represent special characters or to control output formatting. They are written as a backslash (\) followed by one or more characters. Their purpose is to make it easy to represent special characters that are hard to type inside a string literal — such as tab or newline.

Conditional Statements

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

In this article we will cover if / else-if / else, nested if statements, the switch statement, and the ternary operator.

Conditional statements: used to make decisions based on certain conditions — different instructions execute depending on whether a condition evaluates to true or false.

1. The if Statement

Used to check a condition and execute code if it is true. It is the simplest form.

if (condition) {
 // runs if the condition is true
}

2. The if-else Statement

Executes one piece of code if the condition is true, and a different piece if it is false.

Loops

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

In this article we will cover loops: while, do-while, for, and nested loops — along with how to control them and when each one fits.

Loops: used to execute a block of instructions repeatedly based on a condition. There are several kinds, and each suits a different use case.

1. The while Loop

Used when repetition depends on a condition — and the loop may not run at all if the condition is never met.

Arrays and Strings

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

In this article we will cover arrays and strings, their uses, and their importance in reverse engineering.

From this article onward we go deeper — because the remaining articles are among the most valuable for reverse engineering, and mastering them is essential.

Arrays and strings are among the most important data structures for storing and processing data, and they differ in usage and structure. Understanding how they live in memory is the foundation of executable analysis, especially when it comes to uncovering vulnerabilities.

Functions

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

In this article we will cover functions, their types and forms, and the functions that matter most in reverse engineering.

Functions play a pivotal role in programming, and especially in reverse engineering — they are the fundamental unit of analysis: when you open any program in IDA or Ghidra, the first thing you see is a list of functions, and understanding them is how you understand the program.

What Is a Function?

Fundamental units for reusing and organizing code — “blocks” of instructions designed to perform specific tasks. Every function can accept arguments and return a value.

Pointers and Memory Management

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

In this article we will cover pointers and their types, along with an introduction to memory management and allocation. This is the final article of the basics series, God willing.

Note: we will not expand into memory management as deeply as the topic deserves — we cover the core concepts that help us understand pointers, because the subject warrants its own article.

Pointers are a powerful tool giving direct control over memory, which makes them of paramount importance when analyzing programs and understanding binary instructions.

Bitwise Operators

Thu, 13 Aug 2026 10:00:00 +0300

Assalamu alaikum wa rahmatullahi wa barakatuh.

From this article on we deal with C at a genuinely low level.

Before starting: you should be comfortable with the basics of C — you can review the previously published basics series.

In this article we cover bitwise operators plus increment/decrement and the ternary operator. We will not focus on simple arithmetic (addition, subtraction…) because it is self-evident — this series focuses on the more powerful constructs that serve us in reverse engineering.

Virtual Memory: Stack vs Heap

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

In this article we discuss the design of stack and heap memory, and clarify the differences between them.

Note: this article does not cover everything exhaustively, but it will bring us to a full understanding of the topics we discuss.

Memory Layout

As mentioned in the pointers article, program memory in modern x86/x64 systems divides into 5 main segments (some say 4 by merging Data with BSS):

Text Segment — the executable instructions (read-only).
Data Segment — initialized globals.
BSS Segment — uninitialized globals.
Heap — dynamic allocation.
Stack — locals and function frames.

+-----------------+ high addresses
| Stack | grows downward
| | |
| v |
+-----------------+
| (gap) |
+-----------------+
| ^ |
| | |
| Heap | grows upward
+-----------------+
| BSS |
| Data |
| Text |
+-----------------+ low addresses

We are dealing only with the user space here — kernel space is another topic.

Dynamic Memory Allocation

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

After discussing the heap and the stack and understanding the internal structure of each, today we cover dynamic memory allocation in an expanded way — free-memory management and the most common vulnerabilities in this area.

Dynamic Memory Allocation: understanding it is essential for analyzing software, exploiting vulnerabilities, and understanding how programs work from the inside.

Core Allocation Functions

1. malloc() and free()

malloc allocates a heap block of a given size (in bytes) without initialization — its contents are garbage values:

Passing by Value vs by Reference

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

From this article we begin entering x86-64 Assembly to gain low-level understanding. The explanation will be simple and clear.

Prerequisite: a study of computer architecture and organization, plus basic knowledge of memory and registers (covered in the pointers and stack-vs-heap articles), is recommended before continuing this series.

Example environment: the gcc outputs here are from Linux (the SysV convention, where the first argument goes in RDI). On Windows x64 the argument registers differ (RCX/RDX/R8/R9) as explained in the virtual memory article.

Functions — Part Two

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

Having laid the cornerstone of C, memory division, pointers, and the assembly introduction — we continue toward a complete body of knowledge. This article treats functions at an advanced level, with K&R as a primary reference, tracing registers in the assembly to see how the code moves at the low level.

Article index:

1.1 Variable Scope
1.2 Header Files
1.3 Static Variables and Functions
1.4 Recursion

Function Essentials

Component	Description
Signature	the declaration: `returnType funcName(Parameters) {}`
Body	what the function does
Parameters	input values
Return value	the main output

A Function’s Execution Model

int add(int a, int b) {
 int result = a + b;
 return result;
}

The Assembly (32-bit)

We use -m32 to simplify the explanation (the classic EBP pattern seen in millions of legacy programs):

Data Modifiers

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

In this article we cover data modifiers — the keywords that change the properties and shape of data types:

Sign: signed, unsigned.
Size: short, long.
Storage: auto, register, extern, static.

General Notes

You cannot combine more than one modifier of the same kind (long short together is invalid).
Some modifiers are invalid in certain positions — like unsigned float, because floats are always signed.

1. Sign Modifiers

How is a signed variable represented inside a data type? Three methods evolved over time:

Structures

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

In this article we cover the Structure — the first user-defined data type.

Struct Basics

We know C ships with standard data types: int, char, float, double…

What if we want to represent a real-world object — like a person with a name and an age? We need to mix a string (array of characters) with an int inside one object.

That is where the Structure comes in: it resembles an array, but it groups variables of multiple types (whereas arrays hold one type). Since the developer designs it, it counts as a User Defined Data Type.

Bit Fields, Unions, and Enums

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

In this article we cover Bit Fields, Unions, and Enums.

1. Bit Fields

We established in the previous article that a struct distributes bytes — but what if we want to split a single byte into bits? That is the bit field: we specify the number of bits per member.

typedef struct {
 u8 a : 4; // 4 bits
 u8 b : 2; // 2 bits
 u8 c : 1; // 1 bit
} student; // 7 bits total ← inside one byte

+---+---+---+---+---+---+---+---+
| a (4 bits) | b (2) | c | (free) |
+---+---+---+---+---+---+---+---+

Note: the compiler packs bit fields into the byte, but does not guarantee identical behavior across all compilers (implementation-defined). During analysis, reading bit fields in assembly involves and/shift operations.

The Preprocessor

Thu, 13 Aug 2026 10:00:00 +0300

Bismillah.

After this series of articles we have completed the fundamentals of C — and next, God willing, comes the Malware Development series.

In this article we cover the directives of the preprocessor — the # sign followed by reserved words that the preprocessor understands, substituted before compilation.

A recap of the compilation stages (covered in the first article) — in isolated form:
gcc -E file.c -o file.i # 1. Preprocessor
gcc -S file.i -o file.s # 2. Compiler
gcc -c file.s -o file.o # 3. Assembler
gcc file.o -o file # 4. Linker

1. Inclusion Directives

`#include`

It enables restructuring: splitting a large program into multiple files, each responsible for a specific function: