Code Review - HackerChix Edition

In the 8 nights this course will run, students will be walked through the numerous cases of undefined and platform specific behavior in C. We’ll look at every part of the C language, with numerous real-world examples of bugs found by InfoSect. This course is partly focused on vulnerability research. We'll look for ways to automate bug discovery using fuzzing and static analysis. Finally, we will look at coding recommendations and ways to prevent, fix, and secure buggy C code.

Lectures & Labs:

C Refresher

• Introduction to the Training
• History of C
• Developing in C
• Review of C Programming Basics
• Pointers, Strings, and Arrays
• Structures and Unions
• Dynamic Memory Management

Vulnerability Research

• Fuzz Testing
• Dynamic Memory Checkers

C Bug Classes & Fixes

• Bugs in Preprocessor
• Bugs in Declarations and Initialisation
• Bugs in Expressions
• Bugs in Floating Point
• Bugs in Arrays
• Bugs in Characters and Strings
• Bugs in Memory Management
• Bugs in Input Output
• Bugs in Environment
• Bugs in Miscellaneous
  
• Bugs in Posix
• Code Review Strategies