Assignments & Orals
Onboarding
requiredGet set up, agree to the rules, and prove your environment works.
Reverse Engineering + Cavity Virus
10%5% code + 5% oralRead x86, reason about memory layout, and plant a virus in a binary without changing its size.
Buffer Overflow + Format String
10%5% code + 5% oralHijack control flow two different ways — arc injection and a format-string write.
ROP + Obfuscation
10%5% code + 5% oralBuild a ROP chain against a non-executable stack, then study where AI deobfuscation breaks.
Web Security: Attack → Patch → Break
10%5% code + 5% oralAttack a vulnerable web app, defend a fresh instance, then break a classmate's defense.
Threat Evasion
10%5% code + 5% oralWrite detection rules for real attacker behaviour, then evade a classmate's rules.
Prompt-Injection Tournament
bonusBonus — build a guarded LLM app, then attack everyone else's. The most AI-proof assignment in the course.
Oral evaluations
A five-minute conversation about code you already submitted — this is where your understanding is checked, not by inspecting your submission (which we can't verify anyone actually wrote).
The format
- Five minutes, one student, one grader, your own submission open on the screen in front of you.
- Held in office hours in a later week — not in class. The calendar says which week.
- The date on the calendar (Oral A1 · last day) is the deadline, not the appointment. Come to any office hour that week; the tag marks the last day that round can still be taken.
- It is not a gotcha. You know the format from day one, you can look at your own code while we talk, and you can point and draw. It’s a whiteboard conversation, not an oral exam in prose.
We ask you to change something and predict the outcome, then run it. Recall questions are weak; prediction questions can't be faked. If you did the work, this is a conversation you'll enjoy.
Each round is worth 5% of the course grade. A low oral score is a grade, not an accusation — there’s no honor referral attached to it. The structure handles the integrity question without anyone having to prove anything.
Fairness
- SDAC accommodations are honored — extended time, alternative format, whatever your letter specifies.
- Non-native English speakers are graded on technical explanation, not fluency. If you can point at the right line and say “this one, because 76,” that’s a 2.
- A practice viva is available on request.
Why this exists
A person’s understanding of the code in front of them is visible in about ninety seconds, so the grade moves to where it can be observed directly rather than inferred from a submission nobody can verify the authorship of. It’s also the one point in the semester where every student has a one-on-one technical conversation with course staff. The full reasoning is in the AI policy.