5 ms·
How does one start acquiring skills like these?
by krtkush 1y ago
How does one start acquiring skills like these?
- mdaniel 1y agoPractice, and having supernatural perseverance (although probably not in that order) I'd guess the curriculum is half reverse engineering and half reading any write-ups to see the attacks and areas of attack for inspiration
- anthonj 1y agoI get the feeling these kind of skills are very rare because they fall in the category "understanding and debugging other people code/mess", while most people prefer to build new things (and often struggle to debug their own work). It takes a lot a passion and dedication to security and reverse engineering to get there.
- WalterBright 1y agoSpending a lot of time debugging code. Eventually, the pattern recognizer in your brain will pick out the bugs. The term for this is "code smell". For example, when I'd review C code I'd look at the str???() function use. They are nearly always infested with bugs, usually either neglecting to add a terminator zero or neglecting to add sufficient storage for the terminating zero.
- jve 1y agoIt is crazy that anytime someone works on application layer and wants to manipulate string, which is a very, very common thing to do when writing application, one has to consider \0 which would be an implementation detail. How can that language still be so popular?
- avar 1y agoBecause whatever language you think should be popular instead is running on a mountain of C code, but the reverse isn't true.
- WalterBright 1y agoThe D implementation and runtime library has zero C code in it.
- avar 1y agoAnd when you run that compiler implementation, what language family was used to implement the OS and kernel it's running on, the firmware you're using etc? That's what I meant, not that self hosted compliers don't exist.
- AlienRobot 1y agoOkay, I want to make a desktop app that runs on Linux. Which language should I use? Java?
- rkomorn 1y agoSome current trendy options would be Kotlin (with Kotlin Multiplatform) or C# (with Avalonia UI). Edit: I guess I should've at least asked myself if the question was rhetorical.
- uecker 1y agoWhatever you do, please do not use a language that makes it difficult to provide security updates: https://www.debian.org/releases/trixie/release-notes/issues.html#limitations-in-security-support https://www.debian.org/releases/trixie/release-notes/issues....
- AlienRobot 1y agoMy problem with "crossplatform" GUIs that run on Linux is that they aren't made to run on Linux desktop, they are made to run on Android, iOS, Windows, macOS, and finally Linux desktop. All I want is a menubar, a toolbar, a statusbar, and some dialog windows. I don't want fading transitions when I click a tab. It's crazy that I'm forced to write header files just to have a menubar. Zig 1.0 can't come soon enough.
- rkomorn 1y agoWouldn't Qt or GTK be good for this, then? Or... https://quickshell.org/ https://quickshell.org/ ?
- jve 1y agoThat questions is kind of the point I want to make. We live in 2025 and C is still an option for new applications, i.e wrong abstraction layer for application level development. No doubt there are valid reasons to use it, that is just the state of things they are unfortunately.
- uecker 1y agoThe language is just fine. The real question is: Why do people not use a string library that abstracts this away safely?
- saagarjha 1y agoWhy does the language not make one?
- tonyhart7 1y agobecause at that time, C creator didn't know thing would evolve into the future. after all computer is a new thing
- eska 1y agoLots of C applications nowadays don’t actually use any of the str functions or null termination.
- saagarjha 1y agoProgramming is the consideration of implementation details. When you manipulate strings in C you consider the terminating nul byte just like when you manipulate strings in Python you consider how its stores codepoints or when you manipulate strings in Swift you think about grapheme clusters. There is no free lunch. (Though, of course, you can get reduced price lunches based on the choices you make!)
- CrimsonCape 1y agoPardon my ignorance, since I don't know C, but is it true to say that the length of string "Foo" is greater than 4 because of the null terminating byte? Or maybe there is no concept of string length? I could see this getting annoying since Foo is three chars long, you would assume it's length is 3, but we could be speaking of the actual length of bytes, in which i assume it is sizeof(char)*3+1 i.e. the sizeof(char F, char o, char o)+1nullbyte
- probably_wrong 1y agoThe string length in C is "whatever number of bytes are there between the beginning of the string and the first \0 character". That's different from "how much memory is being used by this string" because you usually allocate a bigger buffer. The length of the string "Foo", when properly terminated, is 3. The minimum number of bytes needed [1] to represent that string properly is 4 (3+'\0'). The actual number of bytes used by that string is whatever you asked for and received when using "malloc". [1] Assuming ASCII and 1-byte characters.
- saagarjha 1y agostrlen("Foo") == 3 but you need 4 bytes to store it.
- WalterBright 1y agoC was popular because, if one is familiar with assembler, it takes about an hour to become adept at programming in it. It's also an easy language to write a compiler for. At one point I counted over 30 C compilers available for DOS.
- Hilift 1y agoRead the blogs of the guys creating the bugs.
- baobabKoodaa 1y ago[flagged]
- saagarjha 1y agohttps://pwn.college/ https://pwn.college/
- tptacek 1y agoBy reading and keeping up with the published work in browser exploit development, replicating it yourself, and then finding you have a knack for spotting vulnerabilities in C++ code.