{"id":480,"date":"2025-10-16T21:13:52","date_gmt":"2025-10-16T21:13:52","guid":{"rendered":"https:\/\/support.nullflag.com\/?post_type=docs&p=480"},"modified":"2025-11-03T19:40:34","modified_gmt":"2025-11-03T19:40:34","password":"","slug":"c-language-fundamentals","status":"publish","type":"docs","link":"https:\/\/www.nullflag.com\/support\/kb\/cpp_c_java_arm64_javascript\/c_basic\/c-language-fundamentals\/","title":{"rendered":"C Language Fundamentals"},"content":{"rendered":"\n

Course Objective<\/h2>\n\n\n\n

Why Learn C Language?<\/h2>\n\n\n\n

From Reverse Engineering Perspective<\/h3>\n\n\n\n

In Android application security analysis, we encounter different implementation approaches:<\/p>\n\n\n\n

“We don’t approach this from a development perspective, but rather from a reverse engineering perspective. As long as we can understand and analyze, that’s sufficient. Different goals lead to different levels of learning difficulty.<\/p>\n\n\n\n

Why learn C language for app reverse engineering?<\/p>\n\n\n\n

Because most app algorithms are developed at the Java layer, which is relatively easy to implement. To prevent algorithms from being found through Java decompilation and to discover the specific encryption process, developers must increase the difficulty of cracking, so they use C language for development.<\/p>\n\n\n\n

When encountering APKs, use JADX for decompilation, When encountering SO dynamic libraries, use IDA for decompilation.<\/p>\n\n\n\n

Finally, use hooking methods to pass values and observe the value transmission process.<\/p>\n\n\n\n

This is the reverse engineering perspective.<\/p>\n\n\n\n

From an Android development perspective: By implementing the developer’s process, we know how this encryption was implemented.”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

There is a MainActivity, and when this app first starts, there’s an onCreate function that calls a method in some class. If a certain core parameter is obtained, then calling the encryption function at the Java layer can achieve encrypted submission. However, to increase the difficulty of cracking, we need to introduce functions written in C language.<\/p>\n\n\n\n

In the next section, we’ll cover JNI development, using System.loadLibrary to call a native function that is written in C language. We can see the specific implementation of the encrypt function in the crypt.c file.<\/p>\n\n\n\n

Android Development Context<\/h3>\n\n\n\n

If you see System.loadLibrary(“Crypt”); this code in the JADX decompiled code, it indicates that you need to find the libCrypt.so file in the app’s dynamic libraries and drag it into IDA for decompilation. By finding the exported function Java_com_yoloho_libcore_util_Crypt_encrypt_1data() in the SO file, you can roughly understand its meaning from the pseudocode. You need to understand their logic.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

This course provides an introduction to C language programming concepts, specifically designed for reverse engineering and mobile security analysis. Students will learn essential C programming concepts including data types, pointers, arrays, structures, and linked lists.<\/p>\n\n\n\n

1. C Language Development Environment Setup<\/h2>\n\n\n\n

Three Essential Components:<\/h3>\n\n\n\n
    \n
  1. Language Syntax<\/strong>: Learn C grammar and write code<\/li>\n\n\n\n
  2. Compiler\/Interpreter<\/strong>: Compile and run code<\/li>\n\n\n\n
  3. IDE<\/strong>: Rapid development environment<\/li>\n<\/ol>\n\n\n\n

    1.1 Compilers<\/h3>\n\n\n\n

    After writing C code following the language syntax, it needs to be compiled by a compiler before execution.<\/p>\n\n\n\n

    \n\n
    \n
    \n
    \n <\/span>\n <\/span>\n <\/span>\n <\/div>\n \n
    \n
    \n \u2699\ufe0f<\/span>\n <\/div>\n \n
    \n Example: main.c<\/span>\n <\/div>\n <\/div>\n <\/div>\n\n
    \n
    \n