Programming is an enormous field and entire careers can be spent mastering a single language, framework or technology stack. This course is not intended to turn you into a professional software engineer, backend developer or compiler expert.
Instead, the goal is to provide every aspiring operator with a practical understanding of how software works beneath the surface. You are not expected to become an expert programmer. You are expected to become a competent operator who can understand, investigate and manipulate software when required.
I have personally encountered numerous senior engineers with over a decade of experience who have never needed to read low-level code. This is perfectly reasonable, as their profession focuses on algorithms, distributed systems, architectural design and business requirements rather than operating system internals.
Security professionals often approach software from a different perspective. While a security researcher may not be able to build a highly optimized web application or large-scale business platform, they are typically comfortable analyzing binaries, debugging applications, identifying vulnerabilities and understanding how software interacts with the operating system beneath it.
Neither skill set is inherently superior to the other—they simply solve different problems. This chapter focuses on the latter perspective.
We will heavily use C/C++ and Assembly.
Throughout the course we will occasionally encounter C#, but our primary focus in this chapter will be C/C++ and Assembly. C# becomes more relevant later in the course, as many modern enterprise applications, security products and offensive tools are built on top of the .NET ecosystem.
Why C and Assembly?
The reason is simple: operators frequently interact with software that operates very close to the operating system itself. Malware, security tools, exploits, debuggers, drivers, implants and operating system components are commonly written in C and ultimately execute Assembly instructions on the CPU.
Understanding these languages helps explain concepts such as:
- Memory management
- Function calls
- Process execution
- System calls (syscalls)
- Binary execution
- Operating system internals
We are not building websites, mobile applications or business software in this chapter. Our goal is to understand how software interacts with the operating system and hardware beneath it, which is why C and Assembly remain foundational skills for security professionals.
Installing Visual Studio
To write and debug software, two important tools are needed:
- An IDE (Integrated Development Environment), which provides a place to write, organize, build and manage code.
- A Debugger, which allows us to execute programs step-by-step, inspect memory, observe variables and understand how software behaves internally.
My all-time favorite IDE is Visual Studio, which includes both:
- Visual Studio Community: https://visualstudio.microsoft.com/vs/community/
- Visual Studio Installer Documentation: https://learn.microsoft.com/en-us/visualstudio/install/install-visual-studio
During installation, select the following workload:
- Desktop development with C++
- .NET Desktop Development
This will install everything required for the course, including:
- Microsoft Visual C++ Compiler (MSVC)
- Windows SDK
- Debugging Tools
- C/C++ Build Tools
The default installation options are sufficient. No additional components are required at this stage.
For C#, even without Visual Studio workloads, you can later install:
and immediately do:
dotnet new console
dotnet build
dotnet run
without installing any additional Visual Studio components.
Once installed, verify the setup by creating a simple C++ Console Application and building it successfully.
Before we get to actual coding (in the offensive chapters later), we need to first understand the fundamental principles of how software works.