Thread: How to map machine instctions in memory and execute them? (like a loader does)

I'm not sure what you expect this to do, but it certainly won't load 8 consecutive bytes starting at code_long+24:

Code:

  code_long[24] = (long)data;

Try something like this (untested) :

Code:

#include "stdio.h"
#include "string.h"
#include "stdlib.h"
#include "sys/mman.h"
 
#define null (void*)0
 
int main() {
  char* data = mmap(null, 15, PROT_READ|PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
  memset(data, 0x0, 15); // Default value
 
  memcpy(data, "Hello world!", 12);
 
  void* code = mmap(null, 500, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0);
  char* code_byte = (char*)code;
  long* code_long = (long*)code;
 
  memset(code, 0xc3, 500); // Default value
 
  /* Call the "write" and "exit" system calls*/
 
  // mov rax, 0x04
  memcpy(code_byte, "\x48\xC7\xC0\x04\x00\x00\x00", 7);
 
  // mov rbx, 0x01
  memcpy(code_byte+7, "\x48\xC7\xC3\x01\x00\x00\x00", 7);
 
  // mov rdx, 12 (hardcoded)
  memcpy(code_byte+14, "\x48\xC7\xC2\x0C\x00\x00\x00", 7);
 
  // mov rdx, 
  memcpy(code_byte+21, "\x48\xC7\xC1", 3);
  memcpy(code+24, &data, 8);
  code_byte[32] = 0;
 
  // int 0x80 (which calls the "write" system call on linux)
  code_byte[33] = 0xcd;
  code_byte[34] = 0x80;
 
  /* Execute the code */
  ((void(*)(void))code)();
 
  return 0;
}

Thanks for trying to help but it still doesn't work.

That doesn't surprise me.
However, the error I pointed out still needed to be fixed.

> ((void(*)(void))code)();
Put a breakpoint here, then use the debugger to disassemble code to see if it's what you expected.

Then maybe even single step it.

I assume you mean you got a seggy when you tried to single step the code after the breakpoint you created.
Did you disassemble the code you created in memory? Did it look correct?
Also, in single stepping the code past your breakpoint, you need to single step the individual machine language instructions, not the C program lines!

This doesn't segfault (or give an illegal instruction or anything).

Code:

#include "stdio.h"
#include "string.h"
#include "stdlib.h"
#include "sys/mman.h"
 
#define null (void*)0
 
int main() {
  void* code = mmap(null, 500, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0);
  char* code_byte = (char*)code;
 
  // mov rax, 0x01  (code for sys_exit)
  memcpy(code_byte, "\x48\xC7\xC0\x01\x00\x00\x00", 7);
 
  // int 0x80  (execute system call)
  memcpy(code_byte+7, "\xCD\x80", 2);
 
  // Execute the code
  ((void(*)(void))code)();
 
  return 0;
}

Disassembling the generated code looks correct.
On your original code, it shows a bad instruction after the one that loads the address.

Here's a new version of your program that might be easier to work with.
To show the disassembly of the code in memory:
gcc program.c -g
gdb a.out
l (to list the program, keep hitting return until you see the line that runs the code)
b 58 (assuming it is line 58)
r (to run up to the breakpoint)
x/i code (shows first disassembled line; hit enter for the next, etc.)

Code:

#include "stdio.h"
#include "string.h"
#include "stdlib.h"
#include "sys/mman.h"
 
#define null (void*)0
 
void putbytes(void *code, int *pos, const void *bytes, int len) {
  memcpy((char*)code + *pos, (const char*)bytes, len);
  *pos += len;
}
 
int main() {
  char* data = mmap(null, 15, PROT_READ|PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
  memset(data, 0x0, 15); // Default value
  memcpy(data, "Hello world!", 12);
 
  void* code = mmap(null, 500, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0);
 
  memset(code, 0xc3, 500); // Default value
 
  int pos = 0;
 
  // Call the "write" and "exit" system calls
 
  // mov rax, 0x04   (sys_write)
  putbytes(code, &pos, "\x48\xC7\xC0\x04\x00\x00\x00", 7);
 
  // mov rbx, 0x01   (stdout)
  putbytes(code, &pos, "\x48\xC7\xC3\x01\x00\x00\x00", 7);
 
  // mov rdx, 12     (string length)
  putbytes(code, &pos, "\x48\xC7\xC2\x0C\x00\x00\x00", 7);
 
  // mov rcx, data   (string address)
  putbytes(code, &pos, "\x48\xC7\xC1", 3);
  putbytes(code, &pos, &data, 8);
  putbytes(code, &pos, "\x00", 1);
 
  // int 0x80
  putbytes(code, &pos, "\xCD\x80", 2);
 
  // mov rax, 0x01
  putbytes(code, &pos, "\x48\xC7\xC0\x01\x00\x00\x00", 7);
 
  // int 0x80
  putbytes(code, &pos, "\xCD\x80", 2);
 
  // Execute the code
  ((void(*)(void))code)();
 
  return 0;
}

It looks like your machine code to load the string address is only for 4 bytes of the address, which leaves the next 4 bytes to be interpreted as an (illegal) instruction. You need to find the correct machine code to load an 8 byte address.

Somewhat more simplified version of the program. Still not working since I do not know the machine instructions for loading an 8-byte address.

Code:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/mman.h> 
 
#define null (void*)0
 
void putbytes(char **code, const char *bytes) {
  unsigned byte;
  for (int i = 0, n; sscanf(bytes + i, "%x%n", &byte, &n) == 1; i += n)
      *(*code)++ = byte;
}
 
void putdata(char **code, const void *data, int len) {
    memcpy(*code, data, len);
    *code += len;
}
 
int main() {
  char *data = mmap(null, 15, PROT_READ|PROT_WRITE,
                    MAP_PRIVATE|MAP_ANON, -1, 0);
  memcpy(data, "Hello world!", 12);
 
  char *code = mmap(null, 500, PROT_READ|PROT_WRITE|PROT_EXEC,
                    MAP_PRIVATE|MAP_ANON, -1, 0);
 
  char *pos = code;
  
  // Call the "write" and "exit" system calls
 
  // mov rax, 0x04   (sys_write)
  putbytes(&pos, "48 C7 C0 04 00 00 00");
 
  // mov rbx, 0x01   (stdout)
  putbytes(&pos, "48 C7 C3 01 00 00 00");
 
  // mov rdx, 12     (string length)
  putbytes(&pos, "48 C7 C2 0C 00 00 00");
 
  // mov rcx, data   (string address)
  putbytes(&pos, "48 C7 C1");
  putdata(&pos, &data, sizeof data);
 
  // int 0x80
  putbytes(&pos, "CD 80");
 
  // mov rax, 0x01
  putbytes(&pos, "48 C7 C0 01 00 00 00");
 
  // int 0x80
  putbytes(&pos, "CD 80");
 
  // Execute the code
  ((void(*)(void))code)();
 
  return 0;
}

This works. Note that I had to change to the modern syscall interface (instead of the old 32-bit int 0x80).

Code:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/mman.h> 
 
#define null (void*)0
 
void putbytes(char **code, const char *bytes) {
  unsigned byte;
  for (int i = 0, n; sscanf(bytes + i, "%x%n", &byte, &n) == 1; i += n)
      *(*code)++ = byte;
}
 
#define putdata(pos, data) putdata2(pos, &data, sizeof data);
 
void putdata2(char **code, const void *data, int len) {
    memcpy(*code, data, len);
    *code += len;
}
 
int main() {
  char *data = mmap(null, 15, PROT_READ|PROT_WRITE,
                    MAP_PRIVATE|MAP_ANON, -1, 0);
  strcpy(data, "Hello world!\n");
  char *code = mmap(null, 500, PROT_READ|PROT_WRITE|PROT_EXEC,
                    MAP_PRIVATE|MAP_ANON, -1, 0);
  char *pos = code;
 
  // Call the "write" and "exit" system calls
  putbytes(&pos, "48 C7 C0 1 0 0 0");  // mov rax, 0x01     (write syscall)
  putbytes(&pos, "48 C7 C7 1 0 0 0");  // mov rbx, 0x01     (stdout)
  putbytes(&pos, "48 C7 C2 D 0 0 0");  // mov rdx, 13       (string length)
  putbytes(&pos, "48 BE");             // movabs rcx, data  (string address)
  putdata(&pos, data);
  putbytes(&pos, "0F 05");             // syscall
  putbytes(&pos, "48 C7 C0 3C 0 0 0"); // mov rax, 0x3C     (exit syscall)
  putbytes(&pos, "0F 05");             // syscall 
  
  // Execute the code
  ((void(*)(void))code)();
 
  return 0;
}

The comments showing the assembly code above have some incorrect registers.
For the syscall interface, rbx should be rdi and rcx should be rsi.
The machine language is correct.

I'm 100% sure that the instructions work

Apparently you were running either in 32-bit mode or in some kind of small memory model that was limited to 32-bit addresses.

Your original code only stored one byte of the 8 bytes, so that didn't work.
My correction stored 8 bytes but your opcode was only using 4 bytes of it so the next 4 bytes were interpreted as an instruction.
Changing the opcode to use all 8 bytes and switching to the 64-bit syscall fixed it.