StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>The code is relying on knowledge of the layout of functions from the compiler - which may not be reliable with other compilers.</p> <p>The <code>func_len</code> line, once corrected to include the <code>-</code> that was originally missing, determines the length of the function <code>Demo</code> by subtracting the address in <code>_Demo</code> (which is is supposed to contain the start address of <code>Demo()</code>) from the address in <code>_main</code> (which is supposed to contain the start address of <code>main()</code>). This is presumed to be the length of the function <code>Demo</code>, which is then copied byte-wise into the buffer <code>buff</code>. The address of <code>buff</code> is then coerced into a function pointer and the function then called. However, since neither <code>_Demo</code> nor <code>_main</code> is actually initialized, the code is buggy in the extreme. Also, it is not clear that an <code>unsigned int</code> is big enough to hold pointers accurately; the cast should probably be to a <code>uintptr_t</code> from <code><stdint.h></code> or <code><inttypes.h></code>.</p> <p>This works if the bugs are fixed, if the assumptions about the code layout are correct, if the code is position-independent code, and if there are no protections against executing data space. It is unreliable, non-portable and not recommended. But it does illustrate, if it works, that code and data are very similar.</p> <p>I remember pulling a similar stunt between two processes, copying a function from one program into shared memory, and then having the other program execute that function from shared memory. It was about a quarter of a century ago, but the technique was similar and 'worked' for the machine it was tried on. I've never needed to use the technique since, thank goodness!</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload