2

I know other people have done it in different languages but I cannot find a C code example at all, the most common was in Perl and it was really confusing because I don't know Perl and I just want to load a binary file (from disk) into memory and then execute it https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html

2
  • You do memfd_create, you write the contents of the binary to it, then you call fexecve on it. There's really nothing complicated. If you tried that and it didn't work, then post the code you tried and a description of exactly what happened. Commented Aug 2, 2020 at 0:45
  • > I just want to load a binary file (from disk) into memory and then execute it -- that is literally a one-liner: the load from disk part will be done automatically for you, and all you have to do is call execve. What are you actually trying to achieve? Commented Aug 2, 2020 at 16:26

1 Answer 1

3

Here you go, an example writen in C (compiled on linux 5.4 and run as expected):

#define _GNU_SOURCE
#define _POSIX_C_SOURCE 200809L

#include <sys/types.h>
#include <sys/mman.h>

#include <unistd.h>

#include <err.h>
#include <errno.h>

size_t min(size_t x, size_t y)
{
    return x > y ? y : x;
}

/**
 * @param len != 0
 */
void fdput(int fd, const char *str, size_t len)
{
    size_t cnt = 0;
    do {
        ssize_t result = write(fd, str + cnt, min(len - cnt, 0x7ffff000));
        if (result == -1) {
            if (errno == EINTR)
                continue;
            err(1, "%s failed", "write");
        }
        cnt += result;
    } while (cnt != len);
}
#define fdputc(fd, constant_str) fdput((fd), (constant_str), sizeof(constant_str) - 1)

int main(int argc, char* argv[])
{
    int fd = memfd_create("script", 0);
    if (fd == -1)
        err(1, "%s failed", "memfd_create");

    fdputc(fd, "#!/bin/bash\necho Hello, world!");

    {
        const char * const argv[] = {"script", NULL};
        const char * const envp[] = {NULL};
        fexecve(fd, (char * const *) argv, (char * const *) envp);
    }

    err(1, "%s failed", "fexecve");
}

I also tested with calling fork() just before fexecve, and it also works as expected.

Here's the code (mostly identical to the one provides above):

#define _GNU_SOURCE
#define _POSIX_C_SOURCE 200809L

#include <sys/types.h>
#include <sys/mman.h>
#include <sys/wait.h>

#include <unistd.h>

#include <err.h>
#include <errno.h>

size_t min(size_t x, size_t y)
{
    return x > y ? y : x;
}

/**
 * @param len != 0
 */
void fdput(int fd, const char *str, size_t len)
{
    size_t cnt = 0;
    do {
        ssize_t result = write(fd, str + cnt, min(len - cnt, 0x7ffff000));
        if (result == -1) {
            if (errno == EINTR)
                continue;
            err(1, "%s failed", "write");
        }
        cnt += result;
    } while (cnt != len);
}
#define fdputc(fd, constant_str) fdput((fd), (constant_str), sizeof(constant_str) - 1)

int main(int argc, char* argv[])
{
    int fd = memfd_create("script", 0);
    if (fd == -1)
        err(1, "%s failed", "memfd_create");

    fdputc(fd, "#!/bin/bash\necho Hello, world!");

    pid_t pid = fork();
    if (pid == 0) {
        const char * const argv[] = {"script", NULL};
        const char * const envp[] = {NULL};
        fexecve(fd, (char * const *) argv, (char * const *) envp);

        err(1, "%s failed", "fexecve");
    } else if (pid == -1)
        err(1, "%s failed", "fork");

    wait(NULL);

    return 0;
}
4
  • I think the fdputc macro and the fpdut function are useless, since all I/O operations on the memfd should be blocking. Other than that, the answer is very good
    – ceztko
    Commented Feb 5, 2021 at 21:00
  • I write fdput because the API of write says that the bytes writen can be smaller than requested and this syscall can be interpreted by signal. I know that it probably can’t happen in a small program like this, but I just want to make sure it is properly writen and its code isn’t misleading.
    – JiaHao Xu
    Commented Jun 6, 2021 at 0:53
  • Yes, I understand. Still, I am expecting all operations writing in a memfd either works or fail, meaning there should be no partial writing support, because memory either can be allocated or not. Of course this should be documented somewhere before assuming it's like this.
    – ceztko
    Commented Jun 6, 2021 at 16:35
  • Unfortunately, memfd only has generic write/read support, and AFAIK linux doesn’t provide any special semantics for any fd in read/write to have a stable API and be posix compatible. So the safe way is to just check the m like any other piece of code.
    – JiaHao Xu
    Commented Jun 8, 2021 at 0:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.