Phase 01 - Systems Programming and Computer Science Foundations

Duration: 12 weeks (Months 2-4)
Objective: understand software below framework level and build security tools without unsafe parsing, memory, concurrency, or privilege assumptions.

Deep guides: WARMUP.md derives the memory/parser/binary boundary; HITCHHIKERS-GUIDE.md covers compiler hardening, attack corpora, fuzzing, triage, and production containment.

Objectives and Theory

C memory model: object lifetime, stack/heap, pointers, bounds, integer conversion, UAF, double-free, and undefined behavior.
C++ object model: RAII, ownership, vtables, exceptions, templates, and unsafe interoperability.
Rust ownership, borrowing, lifetimes, traits, unsafe, FFI, and parser design.
Go goroutines, channels, cancellation, interfaces, memory model, races, and network I/O.
Python typing, binary parsing, async/subprocess safety, packaging, and secure automation.
Java/Kotlin bytecode/runtime basics needed for Android.
x86-64 and ARM64 registers, calling conventions, stack frames, control flow, and syscalls.
Processes, threads, virtual memory, file descriptors, signals, scheduling, IPC, filesystems, and user/kernel transitions.
ELF, PE, Mach-O, linking, relocation, symbols, debug information, disassembly, and decompilation.

Every program needs malformed-input tests, explicit resource limits, structured errors, dependency locking, and a short threat model. Run compiler warnings, linters, sanitizers, race detectors, and fuzzers where applicable.

12-Week Build Sequence

Week	Lab	Build and prove
1	C memory corpus	small owned examples of bounds, lifetime, format, and integer bugs; fixed versions and ASan/UBSan tests
2	Tiny allocator	allocate/free/coalesce with invariants, corruption checks, and randomized tests
3	Rust parser	memory-safe parser for a bounded binary format; compare with a C implementation
4	ELF inspector	parse headers, sections, symbols, permissions, and hardening flags without shelling out
5	Syscall tracer	trace a child process, decode a safe syscall subset, handle lifecycle and errors
6	Toy debugger	breakpoints, register display, memory read, and symbol lookup against owned programs
7	Packet parser	Ethernet/IPv4/TCP/UDP/DNS parser with truncation, length, and checksum tests
8	Fuzz harness	libFuzzer/AFL++ harness, corpus, dictionary, crash minimization, regression workflow
9	Go security tool	concurrent TLS/HTTP configuration auditor for a local fixture with bounded workers
10	Python automation	inventory and normalize findings into JSON/SARIF with schema validation
11	Secure HTTP service	limits, timeouts, TLS, authn hook, safe logging, error handling, and load test
12	Secret CLI	envelope-encrypted local store, file permissions, memory/lifecycle limitations, threat model

Runnable lab portfolio

Together they cover parser attack surfaces, hardening metadata, syscall observation, forbidden kernel interfaces, policy regression, native memory corruption under sanitizers, and memory-safe capability authorization with tenant, expiry, action, and replay invariants.

Do not build exploit chains. Vulnerable examples exist only to teach root cause, compiler/runtime diagnostics, secure replacement patterns, and regression prevention.

Capstone - Security Engineer Systems Toolkit

Integrate the ELF inspector, tracer, fuzz harness, Rust parser, packet decoder, configuration auditor, SARIF normalizer, and secure coding corpus behind one documented workspace.

Required capstone experiments:

Feed 10,000 generated malformed inputs to each parser.
Demonstrate sanitizer or fuzzer discovery of at least three seeded defects.
Fix each defect and add a regression test.
Benchmark safe limits and identify denial-of-service thresholds.
Compare C and Rust failure modes without claiming Rust eliminates logic bugs.

Recommended Sources

Computer Systems: A Programmer's Perspective
Operating Systems: Three Easy Pieces
Effective C and the SEI CERT C/C++ guidance
The Rustonomicon, Rust unsafe-code guidelines, Go memory model and race detector docs
System V AMD64 ABI, Arm ABI, ELF and DWARF specifications
The Fuzzing Book and LLVM libFuzzer/sanitizer documentation

Measurable Outcomes

80%+ meaningful branch coverage on owned parser logic.
Zero sanitizer findings and zero race-detector findings after fixes.
Fuzz smoke test runs in CI with saved regression corpus.
All tools reject oversized/truncated input without crash or unbounded allocation.
A new engineer can run the toolkit from a clean environment in under 15 minutes.

Evaluation Checklist

Explain stack vs heap, virtual vs physical memory, and syscall transitions from a trace.
Identify endianness, alignment, lifetime, and integer-width hazards during review.
Read a small x86-64 and ARM64 function and reconstruct control flow.
Explain ELF/PE/Mach-O similarities and security-relevant differences.
Minimize a crash, identify root cause, patch it, and prove regression coverage.
State what each tool cannot safely conclude.

Common Mistakes and Interview Prompts

Mistakes: parsing before validating lengths, trusting file offsets, unbounded concurrency, subprocess command construction, swallowing errors, confusing crashes with exploitability, and reporting sanitizer output without root-cause analysis.

Interview prompts:

Design a safe parser for an untrusted length-prefixed format.
What makes use-after-free possible, and how do ownership systems change the risk?
Walk from a function call to a syscall and back.
How would you fuzz a stateful protocol parser?
Why can a memory-safe service still be security-critical?

Portfolio and Stretch

Publish the toolkit with architecture, tests, sample sanitized outputs, benchmarks, and a research note on one root cause. Stretch: PE/Mach-O support, eBPF-based tracing, grammar-aware fuzzing, differential parser tests, and a small verified parser state machine.