how can memory safe code STOP HACKERS?

Memory safety is something that we all can't just continue to ignore. But first, before we care about memory, safety, what does that even mean? Is C a memory safe language? Is Rust? How can we count on our code to do what we tell it.

In this video we'll discuss what memory safety is, some violations of memory safety, and how other languages make it better.

🏫 COURSES 🏫

🔥🔥🔥 SOCIALS 🔥🔥🔥

[labrat]

Hmm, as an 'old school' programmer, we used to (sometimes do) use such memory unsafety as a feature, not as a bug (e.g. following arbitrary pointers that the engineer knows about to get a desired value, then calculating the offset between the desired location and an array under your control, then addressing that location using an array index that's out of bounds of the original declared intent). We did this for efficiency and speed at a time when memory and CPU resources were massively more constrained than they are.

I'm kind of glad that such acts are dying out, but there's a twinge of nostalgia and a worry that future SW engineers will come across such code and not be able to understand its function and thus, struggle to maintain it.

[socvirnylestela]

I really like that you emphasized the last part "Memory Safe != Memory Secure" since I hear many times that unsafe code is insecure code. But the same could be true with safe code if not implemented properly as well. Although, I believe that memory safe languages can help lessen the time to fix memory related bugs or security issues.

[costelinha]

"The author of this code managed to pack 7 bugs into it"



That would sound like me, but I don't program in C/C++.

[LogicEu]

Nice video! I believe there's another point to be considered; safety versus freedom. Specially in C, you are absolutely free as programmer, you can freely read and write to memory, reinterpret it, execute memory as code, do whatever. That's a powerful feeling and gives you a sense of control over the hardware. I do think safety is extremely important and the main problem in C, but I think that's why both Rust and C have their places.

[williamdrum]

3:45 That's quite the hot take, and I'd have to agree. They don't call C "portable assembly" for nothing. Whether intended or not, it assumes the programmer understands at least one assembly language and computer architecture in general, without giving you the ability to micromanage it. Hell, even I understand assembly and still find C difficult to use. If I have to interact directly with hardware ports I find assembly much easier to write. None of that *(volatile unsigned int*) mumbo jumbo.

[heitortremor]

It's really important to consider these things. Your vids are much appreciated

[spiderjockey]

I'd be really cool to see how you would take control of the system using this code if you could also set the point values. Exploiting something like this is something that I hear a lot about, but nobody really ever shows an example of it in action to drive the point home and show how this stuff actually works.

[thediaclub]

I think its good to have and use Rust for programs that need memory safety to prevent exploits that could create critical damage, but I still prefer to have absolute controll over execution flow and memory management in programs that don't need to be memory safe. Having bugs and playing around with them is fun and actually a good way to learn how to prevent them and also gives me the ability to hack my calculator.

[FudFst]

At work I've used mostly Rust but also C, I think my C code is better as a result of being scolded by the rust compiler over and over again.

[ReptilianXHologram]

Any chance on you creating a course or series on how to write C programs securely ?

[blastygamez]

I like unsafe memory because i like jailbreak exploits and i love the c programming language (not only for that).

[yoelbinyominsuarez]

the problem is between the chair and the screen monitor

[matyasmarkkovacs]

Well, everybody who knows C is aware that C is unsafe, but it's also very efficient and easy to learn. And there are tools like Valgrind which helps you to prevent memory leaks, segfaults, etc.
C/C++ is so entrenched in the IT world, that I highly doubt it will be replaced in the near future by something like Rust.

[annasmith]

this only makes sense to me now because I started learning Rust (started out with Python 😪), thanks for this demo with C!

[MikoPlayer]

Hey, I just want to say I love these videos as I'm learning reverse engineering. I've seen a few similar bug walkthroughs on your channel but it helps to have it revised a few times.

[valshaped]

There are many footguns in programming, but memory safety is easily the foot-BFG9000.
I'll go out on a limb and say most exploit chains are going to take advantage of memory unsoundness in some form, unless you're lucky (or really determined) to find a chain of logic errors to get you where you want to go.

[GottZ]

things I did and still do in C:
detours: replacing opcodes behind function pointers with relative jumps to hook functions.
this allows me to interject flow for a moment to fix upstream bugs in a video game server.
direct access: writing and reading from bus bound hardware interfaces.
other stuff too.

[wChris_]

I actually never had to debug a rust program i wrote using gdb or something similar! At most some println! macros where all i needed to find semantic issues in my program.

[stryderx]

The reason why industry still and always will use C for years on :
1. C99.
2. Static Code analysis.
3. Memory leak/valgrind/helgrind and super variety tools for sanitizing.
If you work in commercial projects you do all at once, static, dynamic analysis, unit tests and component testing. C is super simple in that regard.

[theabyss]

At least C doesn't have esoteric syntax that looks like somebody tried to write Python but had a stroke.