How does C store functions and when does it convert to machine code?

Question

So I recently asked this question

I had to create an environment variable MYENV and store something in it such that I can successfully run this code.

#include <stdio.h>
#include <stdlib.h>

int main(){
            int (*func)();
            func = getenv("MYENV");
            func();
}

Earlier I was doing something like export MYENV=ls.

Which a user pointed out is incorrect as when the func() is called it basically tells C to run the instructions stored in the variable func which would be the string ls and is not a correct machine code. So I should pass some shellcode instead.

Now I want to know if this how it works for functions in general. As in when I declare a function let's say myFunction() which does let's say multiply 100 and 99 and returns the value, then the variable myFunction will point towards a set of machine instructions stored somewhere which multiplies 100 and 99 and returns the value.

And if I were to figure out those machine instructions and store them in a string and make myFunction point towards it, and then if I call myFunction() we'll have 9900 returned?

This is what I mean :

int (*myFunc)();
char *var = <machine_instructions_in_string_format>
int returnVar = myFunc();

Will the returnVar have 9900?

And if yes, how do I figure out what that string is?

I am having a hard time wrapping my head around this.

Not in general. It might work on some platforms, however, but it is UB according to the C standard. On common platforms you have to make at least the page executable, that contains the code (i.e. with mprotect() on unixish systems). — Ctx
– Ctx, Commented Jun 8, 2020 at 16:35
You "figure out what the string is" by compiling a program that does what you want, then looking at the machine code that was generated. — Barmar
– Barmar, Commented Jun 8, 2020 at 16:37
@Barmar: correction: compiling a function, not a whole program. e.g. How to remove "noise" from GCC/clang assembly output? / How to disassemble one single function using objdump? — Peter Cordes
– Peter Cordes, Commented Jun 8, 2020 at 16:47
ls is not a function, but a command. qsort is a standard C function — Basile Starynkevitch
– Basile Starynkevitch, Commented Jun 8, 2020 at 16:50
As a more general remark, compiled languages typically make a strong distinction between code (in C: functions) and data (in C: variables, including arrays). On modern systems a program cannot modify itself, even though that's pretty cool; and it cannot execute data (unless you jump through the hoops in the links above). Both was easier possible in, say, the 1970s and on occasion put to good use. But in general you would use interpreted languages for that, some of which (Lisp) do not make that distinction at all. — Peter - Reinstate Monica
– Peter - Reinstate Monica, Commented Jun 8, 2020 at 17:03

mevets · Accepted Answer · 2020-06-08 17:27:22Z

4

You have to fill the environment variable out with opcodes for your target machine. I made a little experiment:

#include <stdio.h>
#include <stdlib.h>

int main(void) {
        int (*f)();
        f = getenv("VIRUS");
        (*f)();
        printf("Haha, it returned\n");
        return 0;
}

I compiled it, then used execstack:

$ cc ge.c
$ execstack -s ./a.out

Then I wrote a bit of assembler:

mov %rbp, %rsp
pop %rbp
ret

Which mimics the function epilogue. Compiled it:

$ cc -c t.s

Looked at the opcodes:

$ objdump -D t.o
...
   0:   48 89 ec                mov    %rbp,%rsp
   3:   5d                      pop    %rbp
   4:   c3                      retq

set the envar:

$ export VIRUS=$(printf "\\x48\\x89\\xec\\x5d\\xc3")

then ran the program:

$ ./a.out

And it said nothing, which is a clear indication that the printf line was stepped over. But, just to check, I tried:

$ export VIRUS=$(printf "\\xc3")
$ ./a.out
Haha, it returned

This was run on ubuntu-18.04 with an amd64 instruction set. If this happens to be a school assignment, you should aim for bonus points and figure out how you could get it to execute an opcode that contained a null (0) byte.

answered Jun 8, 2020 at 17:27

mevets

10.6k1 gold badge23 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Peter Cordes Over a year ago

That asm definitely deserves comments. You're tearing down the caller's stack frame because that function didn't push %rbp / mov %rsp, %rbp to make its own stack frame. So the ret is popping main's return address into RIP. It's not exactly "stepping over" printf, it's more like a longjmp. But of course it depends on debug-mode code-gen by the compiler!

Peter Cordes Over a year ago

It will happen to return zero because you declared the function pointer's arg type as () not (void), so the compiler will zero AL via zeroing EAX. (And the process exit status only captures the low byte of the retval anyway.)

Peter Cordes Over a year ago

Also, an easier way to build this is gcc -zexecstack ge.c, to pass the execstack option to the linker instead of modifying the binary afterward. But yes, either way it sets a read-implies-exec flag in the ELF metadata, making all pages executable including but not limited to the region above the initial stack pointer where env vars live.

mevets Over a year ago

This is probably a homework assignment. Giving too much away....

mevets Over a year ago

I sort of meld 'arbitrary constraint' == assignment

|

Collectives™ on Stack Overflow

How does C store functions and when does it convert to machine code?

1 Answer 1

6 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related