0

I am trying to malloc some heap space (size of the file bytes) and copy the contents of a binary file into the allocated memory. Once the binary is copied, I would like to execute that piece of code.

So as a part of this, I tried to write some assembly code to jump to that location(virt address returned from malloc). I am facing a seg fault, I am not sure is this the correct way to do it??

can someone help me in this scenario?

any help/pointers is appreciated! P.S: I don't want to do exec calls to run those binaries.

Raj
  • 41
  • 5
  • instead of exec..() can you use fork() or system()? AFAIK, jump would take you to data segment, hence segv, and many other things (e.g. env) will not be setup for the binary, and this approach will not be portable. – Sameer Naik Aug 30 '15 at 01:25
  • 4
    Normally you use `dlopen()`, [`dlsym()`](http://man7.org/linux/man-pages/man3/dlsym.3.html) etc. for dynamic code (plugins etc.). However, assuming this is for learning, exploration, and investigation only: Allocate the memory using [`mmap(NULL, length, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0)`](http://man7.org/linux/man-pages/man2/mmap.2.html) where `length` is a multiple of `sysconf(_SC_PAGESIZE)`, write the binary code into the region, then use [`mprotect(addr, length, PROT_READ|PROT_EXEC)`](http://man7.org/linux/man-pages/man2/mprotect.2.html) to make it executable. – Nominal Animal Aug 30 '15 at 01:37

2 Answers2

2

The only way I can think to do anything like this is described in this answer: https://stackoverflow.com/a/5602143/3598119

I think you can't simply load a binary into memory and then hope to run it. First of all it has some kind of header to find dynamic libraries in it (in linux this is ELF, in other platforms it's different), and you need to process that yourself (hard, you need to duplicate DLL lookup in your application!) or expect it to crash.

If you want to run external binaries, either use exec or some related OS function, or make them DLL's and link with them dynamically, load their symbols and call them. (Or compile them to assembly by hand and hard code them into executable and cast them as function pointers and call them, and get fired :p )

Community
  • 1
  • 1
Chris Beck
  • 15,614
  • 4
  • 51
  • 87
1

If you're trying to JIT-compile something, search for / ask about that directly. It's a common enough thing to want to do that you don't need to implement the mmap / memory protection yourself.

Even if the file you loaded did start with machine code, rather than ELF headers, you'd still segfault because malloc()ed memory is not marked as executable, as an extra layer of defence against bugs turning into security exploits. You'd have to mprotect the memory, as Nominal Animal says in comments.

If this isn't for JIT-compiling, but rather runtime loading of modules / libraries, then you can use dlopen / dlsym to load a library and get a function pointer to a function it contains. This should be much easier than implementing it yourself.

Peter Cordes
  • 328,167
  • 45
  • 605
  • 847