What does this invocation of a char array cast as a function do?

Question

I came across this piece of code:

char code[] = "\xb0\x01\x31\xdb\xcd\x80";
int main(int argc, char **argv)
{
    int (*func)();
    func = (int (*)()) code;
    (int)(*func)();
}

It is copied from Writing Shellcode for Linux and Windows Tutorial.

Could someone explain that what this function invocation (int)(*func)(); is doing?

It calls a function whose machine code is in the array `code`. — Jean-Baptiste Yunès, Feb 23 '15 at 06:43
The other question explains what `(int)(*func)();` is doing in the question body (he asks what it's doing and then correctly answers his own question). It's the exact same code — M.M, Feb 23 '15 at 07:03
@MattMcNabb; I was more interested in how it is executing that . — haccks, Feb 23 '15 at 07:09
do you mean you're asking what the assembly instructions represented by `\xb0\x01\x31\xdb\xcd\x80` are? In either case I'd suggest commenting on the other question's Answer asking for further explanation if needed — M.M, Feb 23 '15 at 07:11
Possible reason for downvote: the title was too generic. Tried to improve that in my edit. — Ciro Santilli OurBigBook.com, Aug 27 '15 at 08:55
@CiroSantilli六四事件法轮功纳米比亚威视; Thanks. Agreed with your comment and profile. — haccks, Aug 27 '15 at 09:18

score 3 · Accepted Answer · edited May 23 '17 at 11:43

It calls a function whose machine code is in the array code. The string contains some machine-level instructions ((three I think, have a look at x86 instruction set). func is declared as a pointer to a function that takes no argument and returns an int. func is then set to the address of the first byte of that string (machine instructions remember). Then func is called, so a function call to the first instruction of the string is made.

I don't now x86 instruction set very well, but it seems to make a system call (don't know which one); 0xcd 0x80 is a trap to the system.

As @etheranger said, it is a call to the _exit system call.

Beware that this is Linux-dependent, see What does "int 0x80" mean in assembly code?

A short explanation for this mechanism is available here: http://www.linfo.org/system_call_number.html

The source linked in the question implies that it's an `exit` call. — etheranger, Feb 23 '15 at 06:49

What does this invocation of a char array cast as a function do?

1 Answers1

Linked

Related