L04 · Numbers, the Toolchain, and 32-bit C Memory Layout

Discussion prompt

Before we open L04 · Numbers, the Toolchain, and 32-bit C Memory Layout: without looking back, what was the main idea of L03 · Threat Modeling (STRIDE/DFD) + TCB & TOCTTOU Labs, and what could you do by the end of it that you could not do before?

Hint: One sentence for the idea, one for the skill. If the second one is blank, that is the part to revisit.

Comparison matrix

From We are on a 32-bit system from here on: refill the Address size column from what you know. The rest of the table is as it appeared.

Comparison matrix

From One hex digit = one nibble = 4 bits: every row here is a choice with a cost. Fill the Decimal column, then say which row you would actually pick and what you give up for it.

Put in order

Put the moves of Convert 0b10110101 by hand into the order they have to happen.

1. Sum the set bits
2. Group into nibbles for hex
3. Check by reversing

Why: These are the moves of the worked example in the order it makes them, and each one is set up by the one before it. 128 + 32 + 16 + 4 + 1 = 181. Only the columns with a 1 contribute.

Step through it

Step through Convert 0b10110101 by hand one row at a time. What is driving the change, and what would the row after the last one be?

1. Step 1: Form is binary
2. Step 2: Form is hex
3. Step 3: Form is decimal

Comparison matrix

From Two's complement: how negatives are stored: refill the Note column from what you know. The rest of the table is as it appeared.

Predict first

A student writes this, and it looks reasonable:

The 4 bytes 0xFFFFFFFF are in memory.

It is wrong. Say what breaks — and say it before you turn the page.

Correct: Reads the bits as unsigned without checking the variable's type — the same bits mean different numbers.

The 4 bytes 0xFFFFFFFF are in memory.

Why: Reads the bits as unsigned without checking the variable's type — the same bits mean different numbers.

Discussion prompt

The rule this trap just fixed:

Bits carry no sign on their own; the declared type decides interpretation. This exact ambiguity becomes the integer-conversion bug in Lesson 9.

Now break it on purpose. Build a case that violates it and follow the consequences until something visibly fails. Where does the failure first show up — and would you have noticed it if you had not been looking?

Hint: The dangerous rules are the ones whose violation still produces an answer. If yours fails loudly, try to find one that fails quietly.

Discussion prompt

C does not run directly. A pipeline transforms text into a running process, and each stage has one job.

That is stated as though it always holds. Do one of two things: produce a case where it fails, or say precisely what rules such a case out. "It just does" is not on the menu.

Hint: Hunt at the extremes first — zero, one, negative, empty, equal. If every extreme survives, the reason they survive is the proof.

Discussion prompt

Explain Why the linker is its own stage by analogy to something with no Computer Security in it at all — a queue, a recipe, a map, a bank balance, whatever fits. Then say where your analogy breaks.

Hint: An analogy that never breaks is not an analogy, it is the same idea wearing a hat. Find the seam — that is the part that is actually new.

Comparison matrix

From ⊕ ELF sections (real-world detail): every row here is a choice with a cost. Fill the Holds column, then say which row you would actually pick and what you give up for it.

Sort into buckets

Sort these by Grows, from memory, without looking back at Four regions, low address to high. Telling them apart on the spot is the skill; the table is only where the answer happens to be written down.

fixed

Code; Static

UP ↑ (toward higher addr)

Heap

DOWN ↓ (toward lower addr)

Stack

g1

Grows is "fixed" for Code, Static — that is what the table on "Four regions, low address to high" records, and it is the single property separating this group from the rest.

g2

Grows is "UP ↑ (toward higher addr)" for Heap — that is what the table on "Four regions, low address to high" records, and it is the single property separating this group from the rest.

g3

Grows is "DOWN ↓ (toward lower addr)" for Stack — that is what the table on "Four regions, low address to high" records, and it is the single property separating this group from the rest.

Put in order

Put the moves of Place each variable in its region into the order they have to happen.

1. g and s → static region
2. the literal "hi" → static (read-only); the pointer msg → wherever msg is declared
3. Verify the split

Why: These are the moves of the worked example in the order it makes them, and each one is set up by the one before it. Globals and statics live for the whole program, so they sit in the fixed static section (g initialized, s zero-initialized).

Comparison matrix

From Place each variable in its region: refill the Region column from what you know. The rest of the table is as it appeared.

Sort into buckets

These are the pieces of L04 · Numbers, the Toolchain, and 32-bit C Memory Layout, out of order. Put each one back under the part of the lesson it belongs to.

Numbers & Hex

One hex digit = one nibble = 4 bits; Convert 0b10110101 by hand; Two's complement: how negatives are stored

The Toolchain

Source becomes a process in stages; Why the linker is its own stage; ⊕ ELF sections (real-world detail)

C Memory Layout

Four regions, low address to high; Place each variable in its region; Why 'stack grows down' is the whole game

s1

Numbers & Hex is where L04 · Numbers, the Toolchain, and 32-bit C Memory Layout puts One hex digit = one nibble = 4 bits, Convert 0b10110101 by hand, Two's complement: how negatives are stored. Knowing which part of the lesson a problem belongs to is most of knowing which method to reach for.

s2

The Toolchain is where L04 · Numbers, the Toolchain, and 32-bit C Memory Layout puts Source becomes a process in stages, Why the linker is its own stage, ⊕ ELF sections (real-world detail). Knowing which part of the lesson a problem belongs to is most of knowing which method to reach for.

s3

C Memory Layout is where L04 · Numbers, the Toolchain, and 32-bit C Memory Layout puts Four regions, low address to high, Place each variable in its region, Why 'stack grows down' is the whole game. Knowing which part of the lesson a problem belongs to is most of knowing which method to reach for.

Predict first

A student writes this, and it looks reasonable:

A buffer is filled by copying bytes into it.

It is wrong. Say what breaks — and say it before you turn the page.

Correct: Conflates frame ALLOCATION direction with data WRITE direction — they are not the same thing.

A buffer is filled by copying bytes into it.

Why: Conflates frame ALLOCATION direction with data WRITE direction — they are not the same thing.

Sort into buckets

Some of these hold up and some are the exact mistakes this lesson is built to prevent. Sort them.

Holds up

Every offset we compute in Weeks 2–5 assumes 4-byte words. Memorize that now — it's the #1 source of wrong exam answers when students drift to 64-bit.; A signed 32-bit int stores negatives in two's complement: to get −x, invert all bits of x and add 1. The top bit is the sign.; C does not run directly. A pipeline transforms text into a running process, and each stage has one job.

Breaks

The 4 bytes 0xFFFFFFFF are in memory.; A buffer is filled by copying bytes into it.

sound

These are stated as this lesson states them — each one survives the edge cases L04 · Numbers, the Toolchain, and 32-bit C Memory Layout puts it through.

flawed

Each of these is lifted from a trap in this deck: reasonable-sounding, and wrong in a way that only shows up once you rely on it.

Discussion prompt

We treat addresses as virtual throughout this unit; the physical mapping (CS 61C / 162) doesn't change any exploit arithmetic.

That is stated as though it always holds. Do one of two things: produce a case where it fails, or say precisely what rules such a case out. "It just does" is not on the menu.

Hint: Hunt at the extremes first — zero, one, negative, empty, equal. If every extreme survives, the reason they survive is the proof.

Put in order

These are the steps of The Lesson-4 recipe, scrambled. Put them back in order before the next slide shows you.

1. Hex ↔ binary: split every byte into two nibbles; each hex digit = 4 bits.
2. Negatives: invert + 1; −1 is all-ones (0xFFFFFFFF) in 32 bits.
3. Same bits, two meanings: signed vs unsigned is a TYPE decision.
4. Toolchain order: preprocess → compile → assemble → link → load.
5. Place a variable: lifetime/scope decides region — globals & statics & literals → static; locals → stack; malloc → heap.
6. Directions: stack allocates DOWN, heap allocates UP, but byte writes within a buffer go UP.

Why: This is the order the recipe itself gives. Recalling the sequence without the slide in front of you is the difference between recognising the method and being able to run it — most of what goes wrong in practice is a step done out of turn.

Discussion prompt

The Lesson-4 recipe works on the cases you have just seen. Push it to the edge: what is the most degenerate input it still handles — empty, zero, one item, everything equal — and what is the first case where it stops being true? Name the case, not just "it breaks".

Hint: Try the smallest legal input, then the largest, then the one where two things collide. Methods are specified at their edges; the middle takes care of itself.

Check your understanding

What value does it hold, and why?

• A. −1, because two's complement makes all-ones the representation of −1. (correct)
• B. 4,294,967,295, because that is what 0xFFFFFFFF equals.
• C. 0, because the bits cancel out.
• D. 2,147,483,647, because that is the largest int.

Answer: A

Why: For a signed 32-bit int, 0xFFFFFFFF is two's-complement −1 (invert 1 → 0xFFFFFFFE, add 1 → 0xFFFFFFFF). The unsigned reading would be 4,294,967,295, but the type here is signed.

Why B tempts people

That is the UNSIGNED interpretation; the variable is declared signed, so the top bit is a sign bit.

Why C tempts people

All-ones is not zero; zero is 0x00000000. The bits do not cancel.

Why D tempts people

INT_MAX is 0x7FFFFFFF (sign bit 0). 0xFFFFFFFF has the sign bit set, so it is negative.

Eliminate the wrong options

Which toolchain stage produced this error?

3 of these 4 are wrong. Strike them one at a time, and say what rules each one out before you strike the next. The survivor is the answer.

• A. The preprocessor, because the header wasn't expanded.
• B. The compiler, because main.c has a type error.
• C. The linker, because no object file provides helper's address.
• D. The loader, because helper isn't mapped into memory.

Survives elimination: C

Why: The declaration satisfied the compiler (it knew helper's signature), so compilation succeeded. The error appears when the linker tries to resolve the call to a definition across all object files and finds none — a classic link-time symbol-resolution failure.

Check your understanding

Which toolchain stage produced this error?

• A. The preprocessor, because the header wasn't expanded.
• B. The compiler, because main.c has a type error.
• C. The linker, because no object file provides helper's address. (correct)
• D. The loader, because helper isn't mapped into memory.

Answer: C

Why: The declaration satisfied the compiler (it knew helper's signature), so compilation succeeded. The error appears when the linker tries to resolve the call to a definition across all object files and finds none — a classic link-time symbol-resolution failure.

Why A tempts people

The header expanded fine; a declaration is present. The problem is a missing definition, found later.

Why B tempts people

The compiler was satisfied by the declaration — that's exactly why the error slips to link time.

Why D tempts people

The loader never runs; there is no executable yet because linking failed first.

Eliminate the wrong options

The stack 'grows down,' so in which direction do the copied bytes land, and what do they threaten?

3 of these 4 are wrong. Strike them one at a time, and say what rules each one out before you strike the next. The survivor is the answer.

• A. Downward to lower addresses, threatening the heap.
• B. Upward to higher addresses, threatening the saved return address above buf.
• C. They stay within buf; C prevents writing past index 7.
• D. Randomly, depending on the allocator.

Survives elimination: B

Why: Frame allocation goes down, but a string copy fills buf[0], buf[1], … at increasing addresses — upward. Since the saved return address sits above buf, a long-enough copy overwrites it. That is the entire mechanism of the stack overflow in Lesson 8.

Check your understanding

The stack 'grows down,' so in which direction do the copied bytes land, and what do they threaten?

• A. Downward to lower addresses, threatening the heap.
• B. Upward to higher addresses, threatening the saved return address above buf. (correct)
• C. They stay within buf; C prevents writing past index 7.
• D. Randomly, depending on the allocator.

Answer: B

Why: Frame allocation goes down, but a string copy fills buf[0], buf[1], … at increasing addresses — upward. Since the saved return address sits above buf, a long-enough copy overwrites it. That is the entire mechanism of the stack overflow in Lesson 8.

Why A tempts people

Allocation goes down, but data is written upward; and the heap is at the opposite end of the address space, not just below the stack.

Why C tempts people

C performs no automatic bounds checking — writing buf[8] and beyond is exactly what's allowed and dangerous.

Why D tempts people

A sequential copy is deterministic and goes strictly upward; nothing random about it.

Draw it

One page, no notation unless you need it: draw how these connect — Numbers & Hex · The Toolchain · C Memory Layout. Put an arrow wherever one of them is what makes another possible, and label the arrow with why.