The course gives an introduction to C programming (incl. the use of pointers and dynamically allocated data), the underlying memory representation on the stack and the heap, and ways to abuse all this (with buffer overflows, integer overflows, and format strings attacks). The course also teaches some basic command lines skills in Linux/UNIX, incl. shell scripts and Makefiles.
Parts of the course are inspired by on material from the SysSec Common Curriculum, and the course is part of the 10K Students Challenge to teach 10 thousand students the basics of software vulnerabilities and secure programming.
Hoorcollege: dinsdags 13:30-15:30 in LIN 4.
Werkcollege: maandags 8:30-10:30 in HG00.075
(op 16 en 23 maart in HG0.029)
Vereiste voorkennis: Imperatief programmeren 1 & 2 (NWI-IPC014, NWI-IPC015 ) en Processoren (NWI-IPC006)
For this course there are obligatory weekly programming or hacking exercises, which have to be done in pairs. At most one of these exercises may have been marked as nsi (niet serieus ingeleverd) in order for you to take the exam. Exercises have to be handed in via Blackboard.
| 2 feb practicum 1 |
Intro (slides) and the Linux command line, gcc, and make:
[assignment1]
[linux-cheat-sheet] [alternative cheat sheet by Felix Stegerman] Makefile main.c hello.c addvector.c addvector.h | |
| 3 feb college 1 | Intro [slides] C - data types and their representation [slides] Example C code demoed in lecture |
|
| 9 feb practicum 2 | Messing around on the stack: [assignment2] | |
| 10 feb college 2 | C - alignment, arrays and pointers [slides] The code demo-ed during the lecture to check alignment is where_is_data_allocated.c; compile with option -O2 to get gcc to re-align data (at least, it does on my 64-bit machine). Read Section 9.1 of your 'Program Solving with C++' book for another explanation of pointers. |
|
| 16 en 17 feb | geen colleges vanwege carnaval | |
| 23 feb practicum 3 | Pointers and the stack: [assignment 3] | |
| 24 feb college 3 | Memory management: the stack
& the heap [slides] Example (not exam material): Stack overflow in Toyota's; more info here. A bit childish, but great for revision: Binky pointer fun movie by Nick Parlante |
|
| 2 maart practicum 4 | Playing around on the heap: [assignment 4] | |
| 3 maart college 4 | Memory management continued [slides] gdb [slides] | |
| 9 maart practicum 5 |
Local stack attacks: [assignment 5a] (Deadline: March 16) A classic `remote' buffer overflow attack (with machine code payload): [assignment 5b] (Deadline: March 23) |
|
| 10 maart college 5 | Buffer overflows and format strings attacks [slides] Read the tutorial on buffer overflows by Herbert Bos and lecture notes on format strings by Wenliang Du. |
|
| 16 maart practicum 6 | NB Andere zaal (HG00.029) Working session on final assignment | |
| 17 maart college 6 | Buffer overflows: more attacks and some defenses | |
| 23 maart practicum 7 | NB Andere zaal (HG00.029) Working session on final assignment | |
| 23 maart practicum 7 | Extra final practicum session: 15:30-16:30 in HG00.029 | |
| 24 maart college 7 | Discussion of final assignment [slides] and Reflection [slides] | |
| woe 8 april 8 - 8:30-11:30 | exam in HG00.307;HG00.304 (HG00.058 voor mensen met extra tijd) | |
| ma 4 mei - 8:30-11:30 |
resit exam in LIN 4 |