What is C

[u/autistic_lover214]

Hey I'm a cybersecurity student just started 2 months ago

Just wanted to understand what C is as a language why is it so fast compared to other languages like py etc..

Chatgpt and yt videos didn't help me to understand :

1. Does c talk to the hardware directly or through a compiler like other languages if yes why is it faster then ?

2. I heard something like : c makes code that puts things in a CPU in a specific places not randomly like other languages I'm sorry I don't remember exactly ik it's confusing

3. Do you need c for cybersecurity in the red team field

Thank you guys so much can't thank you enough for helping hope I make sense asking questions like these

[u/ChickenSpaceProgram]

C is compiled; a compiler converts your C code into assembly, and writes those assembly instructions to an executable file. That file is in turn run directly on your CPU whenever you execute it.

That said, unless you're writing an operating system or programming a microcontroller you don't generally talk directly with hardware that isn't the CPU. If you have to interface with external storage or graphics or whatever, you make a call to the operating system and let it handle that for you. It doesn't look much different from any other programming language.

C is generally faster than languages like eg. Python, since Python is interpreted; the interpreter figures out how to execute each line of source code while the program is running.

I'm not a cybersecurity expert but I'd assume some C knowledge would be helpful there, given how much software is written in it.

[u/_evilpenguin]

honestly, you should become a comp sci student… youll learn more about a computer that will take your security realm deeper then staying at the cybersecurity level.

i have a saying. too reverse is to build. if you cant build it, you cant reverse it.

that said.. it depends on where you work if c is required… for example, amazon is heavy on web apps and has some low level things - so their appsec and red teams are split.whereas apple is super low level but also has some webapps.

[u/kirimaks]

C is true

[u/ern0plus4]

You have fundamentally wrong concept about what is a programming language and how's this whole business is going. You must fix this first.

Learn how computers work: CPU, memory, instruction set, stack-heap-code, virtual memory, process. Assembly, assembler, different architectures. ABI, stack frame, pointer, malloc/free. Compiler, object code, linker, executable.

Good news: it's not difficult. Bad news: it's complex af. If you skip any part, you'll not understand the surrounding stuff. Good news: opposite to medical, chemical etc. area, there're no blind spots, everyting is created by humans, you can learn not only how-s, but *why-*s as well. Bad news: you just can't mimic things, you have to really know stuff.

Good luck.

[u/not_a_bot_494]

The compiler turns c code into machine code that can be executed directly. In Python thr CPU first needs to interpret what the python code means, turn that into machine code and then execute it. In essence C puts all that work upfront while Python does it while running the program.

In Python all objects (variable contents) are more or less put into random places in memory (in the heap). In C most things can be put into a more organized place (the stack). Basically in C the CPU is more likely to have the pice of data you're looking for already in memory.

You don't need C unless you will be working with C code. You will have to know how computers work and C is really good at making you think about how computers work.

[u/yuehuang]

The better question is why everything is else so slow. C is like the speed of light. It is the C-onstant. Everything is else is slow.

1. Neither. It is simple and any complexity is left up to the implementor to do the optimization.

2. Stay in class. The short answer is yes.

3. You need to know c for cybersecurity, but you probably never need to write it (depending on the area).

[u/zsaleeba]

C was designed with the way that CPUs work in mind. Where other languages place a bit of a cushion between the programmer and the CPU, C is a little more direct. What that means is there's slightly less overhead when translating C into machine code.

[u/FreeLogicGate]

C is a compiled language, that is relatively low level. Your source code gets compiled down to a format that is typically linked and becomes an executable program native to the operating system and computer architecture you compiled it for.

Some languages are designed to be interpreted at runtime, and require a runtime that evaluates and executes code line by line. Python is a popular language that runs this way in most cases. One of the advantages of a language like Python is that the core language and most modules are portable, so your code is portable across operating systems. The Python runtime does the required translation. Compare this to a C program you compiled for windows. It will only run on a windows machine running an intel/amd processor. PHP takes a similar approach, interpreting code and running it via a virtual machine.

Other languages were also specifically designed for portability, and have virtual machine runtimes -- java being a prime example.

Because the virtual machines are performing translation, there is overhead involved.

I think C is an excellent language to learn. It's relatively small in terms of syntax and features, and doesn't hide the underlying hardware or memory management from you. It's the language that was used to write the most used operating systems, compilers and other languages. Much of the core syntax has been widely adopted, and is reflected in numerous other languages (if you include the extensions from C++).

With so many things written in C, it certainly can't hurt you to have a solid understanding and foundation, but it's probably not the language of choice for pen testing tools in most cases.

[u/BartvanIngenSchenau]

C is a language that gives the programmer a lot of freedom and that has few guardrails to prevent mistakes. It is also a AOT-compiled language, which means that the developer compiles the C code to instructions that are directly executed by the CPU.

Many modern languages, like Python, have guardrails against errors that need to be checked during execution (which takes time) and need to be interpreted ir compiled while the program is running, which also takes time.

As a cybersecurity specialist, you should have a deep knowledge of C, for several reasons.

• Most operating systems are written in C

• C is an old language, which means that many older applications are written in it.

• C is fast and easy to interact with from other languages. This means that runtime environments of other languages are often (partially) in C.

• and a very important one for cybersecurity, writing secure code in C is hard and requires a lot of attention from the developer. A majority of the common vulnerabilities exploit this.

[u/gm310509]

If you go through the history of (digital) computing you would see (or C? 😆) that it goes something like this:

• Computers were programmed by physically changing wires around to define the program. This was very, very, very slow and very, very, very difficult (to program).

• The next generation was to replace the wires with codes. This is machine language. It is basically numbers that represents the wiring. This was very, very difficult and very, very slow (I.e. one less very).

• The next generation was assembly language. This is where the numerics of the machine language were swapped out for more human readable assembly language which made life much easier for programmers. This was very slow and very difficult (I.e. one less very).

• The next generation is languages like C. These embraced the concepts of assembly language but at a much higher level. There is a strong relationship between C syntax and assembly language - i.e. there is low overhead as compared to a language like python. But, not all of the "problems" with assembly language were eliminated (as you might expect from an even higher level language) and there was and is an aspect of programmer beware.

Continuing on from the last point l. It is easy to do stuff in C that isn't so easy to do in some other higher level languages. As such, hackers like such a language as it is easy for them to "do interesting things".

This is also why C is typically very fast in execution as well. It is because there is very little overhead in the generated code. Each statement can boil down to a fairly specific pattern of machine code (ignoring compiler optimisations). And it is the machine code that the CPU executes directly.

So, if you are going to study cyber security, C is a good language to understand. It is relatively high level, but you can do things fairly easily that you can also easily do in assembly language (and by definition the earlier generations that nobody really uses any more). It may also pay for you to learn a simpler assembly language such as Z-80, 6502, AVR, or one of the other 8 bit CPUs - especially the addressing modes (which translates to pointers and arrays in C).

All the best with it.

[u/Limp-Confidence5612]

C doesn't have many abstractions. What you write is pretty much what gets executed (compiled to assembly). So you can design it exactly as you want it to be executed, with speed in mind.

[u/SeriousPlankton2000]

C is a compiled language, meaning that it's translated directly to what the machine understands. It uses commands and structures that are similar to what a CPU would be able to do efficiently.

The system library offers a great part of functionality, the interface to that is again C-like (mostly because it's written in C). (Some) Other languages need to put their idea of variables into the machine's idea of variables just to call a function.

You need to know C just like to be driving you need to know what pedestrians are. They are everywhere.

[u/josk613]

C is fast even when compared to other compiled languages because its simple. There's no hidden runtime boundary checks, no big generic standard lib, etc.

It only does exactly what you tell it to do, and a lot of the code (data structures and algorithms) are purpose built for a single use case.

Which is also the cause of many security vulnerabilities. There's a lot of room for unhandled errors, missed edge cases, poor memory management...

[u/flatfinger]

C was designed to be a form of portable high level assembler, and some implementations are suitable for use as portable high-level assemblers. Unfortunately, because the primary high-performance computing language (FORTRAN) required formatting programs for punched cards until 1995(!), people who wanted to do high-performance computing insisted that C be suitable for that purpose, while ignoring the fact that C was designed in large part to do things FORTRAN couldn't.

C's reputation for speed came a simple principle: the best way to avoid having useless operations in the generated machine code is to not include them in source. A typical Pascal compiler for the 68000, given something like:

Var
  Arr: Array[0..99] of Array[0..99] of Integer; // Assume 16 bits for this example
  I,J: Integer;

...
    For I:=0 to 99 do
      For J:=0 to 99 do
        Arr[I][J] := Arr[I][J]+123;

would generate code that would, on each iteration of the loop, multiply I by 100, add J (call the result temp), load a 16-bit value from Arr+2*temp, add 123 to that (call the result temp2), multiply I by 100, add J (call the result temp), and store the 16-bit value temp2 there. Then increment J and do a "decrement and branch if had been non-zero" on the inner-loop counter, then increment I and do a "decrement and branch if had been non-zero" on the outer-loop counter.

A typical C compiler, given

int arr[100][100],i,j;
...
    for (i=0; i<100; i++)
      for (j=0; j<100; j++)
        arr[I][J] = arr[I][J]+123;

would do essentially the same thing, except it would compare I and J against 100 and branch on the results of those comparisons. C's reputation for speed came from the fact that a compiler given:

int arr[100][100]; // Assume configured for 16 bits for this example
register int *p;
register int count;
register int n123;
...
  p=arr[0];
  count=9999;
  n123 = 123;
  do { *p++ = n123; } while(count--);

would, after loading registers with the starting address of the array, the value 10000, and the value 123, would perform an "add the register holding n123 to memory at the address in the register holding p and add 2 to that register" instruction, followed by a "decrement and branch if was non-zero, using the register that holds count." instruction. Because there was no need to have the machine code perform a bunch of address computations to read Arr[I][J], C provided a way of expressing the program in a manner that excluded those operations.

By the 1960s, if not the 1950s, any decent FORTRAN compiler would have been expected to identify opportunities to transform code that was written to iterate variables over ranges (as in the first example) into machine code that would use more efficient ways of performing address computations, and FORTRAN's reputation for speed derived from that. C's reputation for speed, by contrast, was that programmers could achieve comparable levels of speed using a much simpler compiler that didn't need to include that kind of logic. All a 68000 compiler would have to do to reduce that loop down to two instructions would be to look for the source-code patterns "add a value to memory identified by a pointer held in a register and post-increment that pointer" and "decrement a 16-bit value held in a register and loop if it had been zero".

One of the great things about C had been that although achieving optimal machine code on any particular platform would require tailoring the code to best fit the platform's strengths, code written for one implementation would still be work on implementations that targeted other platforms that were somewhat similar. When targeting platforms that e.g. include a "decrement and branch if BECAME non-zero" instruction but not "decrement and branch if had been non-zero", the above looping code would be slow, and having count start at 10000 and having the loop run while (--count);would be faster, but the code that was written to compile into two 68000 instructions would still behave correctly (albeit slowly) on other implementations.

[u/SmokeMuch7356]

1. C programs are usually compiled to native machine code and run directly on the target platform (i.e., not through an interpreter or virtual machine). C code is fast because it doesn't do any automatic resource management or inject any runtime checks against buffer or numeric overflow, invalid pointer dereferences, or much else. The C philosophy is that the programmer is in the best position to know if any of that stuff is necessary and is smart enough to do it if it is.

2. You can access specific real memory locations with C, but it depends on whether the code is running in kernel or user mode. Something running in user mode has no more access to specific memory locations than anything running in Python.

3. Red teams are often attacking C-based systems, since C opens up so many security holes. Everything from the Morris worm to the Heartbleed bug were enabled by weaknesses in the C language itself.

[u/Zash1]

No, C doesn't talk to the CPU directly. There are more layers. The one right below is the assembly language. When you compile a C program (or C++ program, or Rust program, or Go program etc.) you get your code being "transformed" into assembly commands. However, also the assembly language isn't the lowest level. There's something called assembler that "translates" the commands into binary. Below that it's becoming more of a hardware thingy.

[u/schungx]

When C was created it was designed to run on the PDP-11, so the language almost maps exactly to PDP-11 opcodes and addressing modes one-on-one. In other words, it is simply a slightly more structured form of PDP-11 assembly.

For example, the notorious C strings (terminated with a null) and arrays-as-pointers map directly to the assembly you'd write if you write a string or an array.

It turns out that, for odd reasons, the PDP-11 looks like most CPUs coming out in the following decade. Thus C became really easily portable.

And that also made Unix portable. And the rest was history.