Copy a function in memory and execute it

Question

I would like to know how in C in can copy the content of a function into memory and the execute it?

I'm trying to do something like this:

typedef void(*FUN)(int *);
char * myNewFunc;

char *allocExecutablePages (int pages)
{
    template = (char *) valloc (getpagesize () * pages);
    if (mprotect (template, getpagesize (), 
          PROT_READ|PROT_EXEC|PROT_WRITE) == -1) {
        perror ("mprotect");
    } 
}

void f1 (int *v) {
    *v = 10;
}

// allocate enough spcae but how much ??
myNewFunc = allocExecutablePages(...)

/* Copy f1 somewere else
 * (how? assume that i know the size of f1 having done a (nm -S foo.o))
 */

((FUN)template)(&val);
printf("%i",val);

Thanks for your answers

You already asked this question once here, stackoverflow.com/questions/4541419/… - why are you asking again? — David Heffernan
– David Heffernan, Commented Dec 28, 2010 at 13:15
Search the web for "embedded copy C function RAM" for more information. — Thomas Matthews
– Thomas Matthews, Commented Dec 28, 2010 at 18:07

Eugene Smith · Accepted Answer · 2010-12-28 13:08:51Z

8

You seem to have figured out the part about protection flags. If you know the size of the function, now you can just do memcpy() and pass the address of f1 as the source address.

One big caveat is that, on many platforms, you will not be able to call any other functions from the one you're copying (f1), because relative addresses are hardcoded into the binary code of the function, and moving it into a different location it the memory can make those relative addresses turn bad.

answered Dec 28, 2010 at 13:08

Eugene Smith

9,4186 gold badges39 silver badges43 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

R.. GitHub STOP HELPING ICE Over a year ago

Could always perform the relocations from the .o file.. Have fun writing your own linker though. :-)

Thomas Matthews Over a year ago

The starting address of a function is easily obtained, by using the name of the function. The length of a function is a different matter.

golosovsky · Accepted Answer · 2019-08-07 16:53:11Z

4

This happens to work because function1 and function2 are exactly the same size in memory. We need the length of function2 for our memcopy so what should be done is: int diff = (&main - &function2);

You'll notice you can edit function 2 to your liking and it keeps working just fine!

Btw neat trick. Unfurtunate the g++ compiler does spit out invalid conversion from void* to int... But indeed with gcc it compiles perfectly ;)

Modified sources:

//Hacky solution and simple proof of concept that works for me (and compiles without warning on Mac OS X/GCC 4.2.1):
//fixed the diff address to also work when function2 is variable size    
#include "stdio.h"
#include "stdlib.h"
#include "string.h"
#include <sys/mman.h>

int function1(int x){ 
   return x-5;
}   

int function2(int x){ 
  //printf("hello world");
  int k=32;
  int l=40;
  return x+5+k+l;
}   


int main(){
  int diff = (&main - &function2);
  printf("pagesize: %d, diff: %d\n",getpagesize(),diff);

  int (*fptr)(int);

  void *memfun = malloc(4096);

  if (mprotect(memfun, 4096, PROT_READ|PROT_EXEC|PROT_WRITE) == -1) {
      perror ("mprotect");
  }   

  memcpy(memfun, (const void*)&function2, diff);

  fptr = &function1;
  printf("native: %d\n",(*fptr)(6));
  fptr = memfun;
  printf("memory: %d\n",(*fptr)(6) );
  fptr = &function1;
  printf("native: %d\n",(*fptr)(6));

  free(memfun);
  return 0;
}

Output:

Walter-Schrepperss-MacBook-Pro:cppWork wschrep$ gcc memoryFun.c 
Walter-Schrepperss-MacBook-Pro:cppWork wschrep$ ./a.out 
pagesize: 4096, diff: 35
native: 1
memory: 83
native: 1

Another to note is calling printf will segfault because printf is most likely not found due to relative address going wrong...

edited Aug 7, 2019 at 16:53

golosovsky

7381 gold badge7 silver badges22 bronze badges

answered Mar 2, 2012 at 18:00

Walter Schreppers

492 bronze badges

1 Comment

jcsahnwaldt Reinstate Monica Over a year ago

Nice answer! Minor problem: malloc(4096) is not guaranteed to return memory aligned to 4096-byte pages (although I think it usually will with most allocators), but mprotect() usually requires its first argument to be aligned to a page. To be sure, you may want to use aligned_alloc() (available since C11) and use getpagesize() instead of the constant 4096. en.cppreference.com/w/c/memory/aligned_alloc

Brian · Accepted Answer · 2012-01-09 20:32:22Z

1

Hacky solution and simple proof of concept that works for me (and compiles without warning on Mac OS X/GCC 4.2.1):

#include "stdio.h"
#include "stdlib.h"
#include "string.h"
#include <sys/mman.h>

int function1(int x){
   return x-5;
}

int function2(int x){
  return x+5;
}


int main(){
  int diff = (&function2 - &function1);
  printf("pagesize: %d, diff: %d\n",getpagesize(),diff);

  int (*fptr)(int);

  void *memfun = malloc(4096);

  if (mprotect(memfun, 4096, PROT_READ|PROT_EXEC|PROT_WRITE) == -1) {
      perror ("mprotect");
  }

  memcpy(memfun, (const void*)&function2, diff);

  fptr = &function1;
  printf("native: %d\n",(*fptr)(6));
  fptr = memfun;
  printf("memory: %d\n",(*fptr)(6) );
  fptr = &function1;
  printf("native: %d\n",(*fptr)(6));

  free(memfun);
  return 0;
}

answered Jan 9, 2012 at 20:32

Brian

1,05612 silver badges18 bronze badges

1 Comment

jcsahnwaldt Reinstate Monica Over a year ago

Nice answer! Minor problem: malloc(4096) is not guaranteed to return memory aligned to 4096-byte pages (although I think it usually will with most allocators), but mprotect() usually requires its first argument to be aligned to a page. To be sure, you may want to use aligned_alloc() (available since C11) and use getpagesize() instead of the constant 4096. en.cppreference.com/w/c/memory/aligned_alloc

Thomas Matthews · Accepted Answer · 2010-12-28 18:04:18Z

0

I have tried this issue many times in C and came to the conclusion that it cannot be accomplished using only the C language. My main thorn was finding the length of the function to copy.

The Standard C language does not provide any methods to obtain the length of a function. However, one can use assembly language and "sections" to find the length. Once the length is found, copying and executing is easy.

The easiest solution is to create or define a linker segment that contains the function. Write an assembly language module to calculate and publicly declare the length of this segment. Use this constant for the size of the function.

There are other methods that involve setting up the linker, such as predefined areas or fixed locations and copying those locations.

In embedded systems land, most of the code that copies executable stuff into RAM is written in assembly.

answered Dec 28, 2010 at 18:04

Thomas Matthews

58.1k18 gold badges105 silver badges165 bronze badges

1 Comment

Ponkadoodle Over a year ago

You don't need assembly to figure out the length of a function - you can do that part with a linker script.

gumby · Accepted Answer · 2011-09-12 16:07:55Z

0

This might be a hack solution here. Could you make a dummy variable or function directly after the function (to be copied), obtain that dummy variable's/function's address and then take the functions address to do sum sort of arithmetic using addresses to obtain the function size? This might be possible since memory is allocated linearly and orderly (rather than randomly). This would also keep function copying within a ANSI C portable nature rather than delving into system specific assembly code. I find C to be rather flexible, one just needs to think things out.

answered Sep 12, 2011 at 16:07

gumby

312 bronze badges

Collectives™ on Stack Overflow

Copy a function in memory and execute it

5 Answers 5

2 Comments

1 Comment

1 Comment

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

2 Comments

1 Comment

1 Comment

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related