I know other people have done it in different languages but I cannot find a C code example at all, the most common was in Perl and it was really confusing because I don't know Perl and I just want to load a binary file (from disk) into memory and then execute it https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html
1 Answer
Here you go, an example writen in C (compiled on linux 5.4 and run as expected):
#define _GNU_SOURCE
#define _POSIX_C_SOURCE 200809L
#include <sys/types.h>
#include <sys/mman.h>
#include <unistd.h>
#include <err.h>
#include <errno.h>
size_t min(size_t x, size_t y)
{
return x > y ? y : x;
}
/**
* @param len != 0
*/
void fdput(int fd, const char *str, size_t len)
{
size_t cnt = 0;
do {
ssize_t result = write(fd, str + cnt, min(len - cnt, 0x7ffff000));
if (result == -1) {
if (errno == EINTR)
continue;
err(1, "%s failed", "write");
}
cnt += result;
} while (cnt != len);
}
#define fdputc(fd, constant_str) fdput((fd), (constant_str), sizeof(constant_str) - 1)
int main(int argc, char* argv[])
{
int fd = memfd_create("script", 0);
if (fd == -1)
err(1, "%s failed", "memfd_create");
fdputc(fd, "#!/bin/bash\necho Hello, world!");
{
const char * const argv[] = {"script", NULL};
const char * const envp[] = {NULL};
fexecve(fd, (char * const *) argv, (char * const *) envp);
}
err(1, "%s failed", "fexecve");
}
I also tested with calling fork() just before fexecve, and it also works as expected.
Here's the code (mostly identical to the one provides above):
#define _GNU_SOURCE
#define _POSIX_C_SOURCE 200809L
#include <sys/types.h>
#include <sys/mman.h>
#include <sys/wait.h>
#include <unistd.h>
#include <err.h>
#include <errno.h>
size_t min(size_t x, size_t y)
{
return x > y ? y : x;
}
/**
* @param len != 0
*/
void fdput(int fd, const char *str, size_t len)
{
size_t cnt = 0;
do {
ssize_t result = write(fd, str + cnt, min(len - cnt, 0x7ffff000));
if (result == -1) {
if (errno == EINTR)
continue;
err(1, "%s failed", "write");
}
cnt += result;
} while (cnt != len);
}
#define fdputc(fd, constant_str) fdput((fd), (constant_str), sizeof(constant_str) - 1)
int main(int argc, char* argv[])
{
int fd = memfd_create("script", 0);
if (fd == -1)
err(1, "%s failed", "memfd_create");
fdputc(fd, "#!/bin/bash\necho Hello, world!");
pid_t pid = fork();
if (pid == 0) {
const char * const argv[] = {"script", NULL};
const char * const envp[] = {NULL};
fexecve(fd, (char * const *) argv, (char * const *) envp);
err(1, "%s failed", "fexecve");
} else if (pid == -1)
err(1, "%s failed", "fork");
wait(NULL);
return 0;
}
-
I think the
fdputcmacro and thefpdutfunction are useless, since all I/O operations on thememfdshould be blocking. Other than that, the answer is very good– ceztkoCommented Feb 5, 2021 at 21:00 -
I write fdput because the API of write says that the bytes writen can be smaller than requested and this syscall can be interpreted by signal. I know that it probably can’t happen in a small program like this, but I just want to make sure it is properly writen and its code isn’t misleading. Commented Jun 6, 2021 at 0:53
-
Yes, I understand. Still, I am expecting all operations writing in a
memfdeither works or fail, meaning there should be no partial writing support, because memory either can be allocated or not. Of course this should be documented somewhere before assuming it's like this.– ceztkoCommented Jun 6, 2021 at 16:35 -
Unfortunately, memfd only has generic write/read support, and AFAIK linux doesn’t provide any special semantics for any fd in read/write to have a stable API and be posix compatible. So the safe way is to just check the m like any other piece of code. Commented Jun 8, 2021 at 0:09
memfd_create, you write the contents of the binary to it, then you callfexecveon it. There's really nothing complicated. If you tried that and it didn't work, then post the code you tried and a description of exactly what happened.execve. What are you actually trying to achieve?