A System for Visualizing the Process Address Space in the Context of Teaching Secure Coding in C.

Seemingly small coding errors can create significant vulnerabilities in C programs. This often occurs due to memory being overwritten in unexpected ways. If a student understands where program variables appear in the process address space, then she can understand the effect of writing beyond the memory allocated to a variable. With this understanding, she can tie her code to its effect within an executing process and is more likely to appreciate the significance of these seemingly harmless errors and to avoid them. We have developed a program analysis and visualization tool to help students understand the impact of common memory errors with the goal to help students avoid introducing these errors into their code. The visualization is through the Program Address Space (PAS) window within a larger system for analysis and visualization of security issues in C programs. The larger system is called SecureCvisual. In this paper, we describe our experience with teaching students fundamental concepts about process address spaces and the impact of buffer overflows using the PAS window. We also present the results from an evaluation of the tool. Our results indicate that students found the tool useful and that it enhanced the course in which it was used.