C - array address used to execute code

Question

If the following array contained shell code in a C program on a LINUX machine

char buf [100]

then how does the following execute this shell code :

((void(*)())buf)()

@Joachim Why do you conclude that this makes it impossible? Most JIT compilers will do something just like that. Also, I don't think that root rights are required. — Stefan
– Stefan, Commented Sep 18, 2014 at 5:23

Jim Garrison · Accepted Answer · 2014-09-18 05:20:54Z

3

Simple. It casts buf to a pointer-to-function taking no arguments and returning void, and then invokes that function.

However, that probably won't work since the page containing buf is highly unlikely to be marked as executable.

answered Sep 18, 2014 at 5:20

Jim Garrison

87k20 gold badges162 silver badges197 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Stefan Over a year ago

You'll want to use mprotect() to give the memory location PROD_READ|PROD_EXEC rights. This works on page boundaries, so I'd recommend allocating buf with mmap().

Collectives™ on Stack Overflow

C - array address used to execute code

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related