0
void print( char * str ){ printf("%s",str); }

void some_function(){
    ... Loads a file into `char * buffer` ...
    ... Stores the function print before `buffer` address ...
    ((void(*)(void))buffer();
}

In the file, there is a "Hello World" in it, and some unreadable characters. Executing the buffer will print "Hello World".

I know you can execute a pointer like this:

void (*foo)(int) = &bar; // such that void bar(int)
(*foo)(123);

But executing void(int) function as a void(void) function with its function and parameters in memory is new to me.

Is there a standard of how a function look like in memory (like a string is terminated by a null character) such that you can execute it in this way?

4
  • Why do you want to do whatever you are trying to do?
    – Jay
    Sep 27, 2012 at 1:47
  • 3
    Casting a function pointer to a different prototype will produce "undefined results". It might work, or it might cause the end of the universe as we know it. (Or was that crossing the streams?)
    – Hot Licks
    Sep 27, 2012 at 1:51
  • There is no standard for how a function looks in memory. Read this, please: en.wikipedia.org/wiki/Assembly_language It may give you more understanding how all this stuff is organized.
    – Serge
    Sep 27, 2012 at 2:04
  • Friend's assignment. I followed his instructor's written instructions very closely to print that message out, otherwise it prints out garbage. His next question is: Prompts user for a command (cmd ...), loads arguments (delimited by null) into memory that is accessible by char * getargs(int), stores getargs into a specific address, and execute the cmd. I am stuck at executing the cmd, and I thought this question might help. I doubt it's going to be system(input_string). Sounds too easy for a graduate level course and does not justify the existence of getargs and everything stored in memory
    – swtdrgn
    Sep 27, 2012 at 4:04

1 Answer 1

2

But executing void(int) function as a void(void) function with its function and parameters in memory is new to me.

Good. It's undefined behavior and you should never do it. It might happen to work on some implementation, but there's no guaranteed result.

Is there a standard of how a function look like in memory (like a string is terminated by a null character) such that you can execute it in this way?

No, there isn't. More relevantly, there is no standard for how arguments are passed to functions -- it's up to the implementation, and there is no requirement that it be implemented in such a way that functions with different types are compatible.

But in this case, the programmer is taking advantage of knowledge of what a function looks like in memory, and has prepared the file in such a way that it does the right thing when loaded into memory and run in this particular implementation. This is, after all, what loaders do ... they read programs from files into memory and then execute them. This method is also used by exploits that take advantage of bugs in programs to load nefarious code into the program's memory and get the program to execute it.

1
  • Thanks, seems like everyone agree on that there is no standard on how a function with arguments look like in memory to execute as a void(void).
    – swtdrgn
    Sep 27, 2012 at 4:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.