((void (*)())char array)();

Hi guys..

I've seen some sourcer around the web, and sometimes I've found this:
((void (*)())char array)();

where "char array" was always an initialized one.

How does that work?
Is that some king of function call?

Please, could you explain me?
Thanks a lot.

That's a syntax error. Looks like the parentheses are unbalanced.

Code:

---

((void (*)())char array)();

---

Code:

---

C:\Documents and Settings\User>gcc -c a.c
a.c:1:3: error: expected identifier or '(' before 'void'
a.c:1:14: error: expected ')' before 'char'

---

If you're typing this from memory I would advise against it. I can't even begin to parse something you make up.

haha
sorry...

the "char array" is an array of type char...
sorry, I separated them

((void (*)())char_array)();

I don't know if you're being cute or what. That's the same number of parentheses. Go here - cdecl.org - Find out on whatever it really is your own.

here:
what is it exactly??

Code:

---

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
 
char code[] = "\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xeb\x2a\x59\xbb\x04\x28\x96\x75\x51\xff\xd3\xeb\x2f\x59\x51\x50\xbb\xd7\x17\x96\x75\xff\xd3\xeb\x34\x59\x31\xd2\x52\x51\x51\x52\xff\xd0\x31\xd2\x50\xb8\x6f\x2a\x96\x75\xff\xd0\xe8\xd1\xff\xff\xff\x75\x73\x65\x72\x33\x32\x2e\x64\x6c\x6c\x00\xe8\xcc\xff\xff\xff\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x41\x00\xe8\xc7\xff\xff\xff\x54\x65\x73\x65\x64\x20\x66\x6f\x72\x20\x48\x61\x63\x6b\x69\x6e\x67\x20\x77\x69\x6e\x37\x20\x2d\x20\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x00";
 
int main(int argc, char **argv)
{
    ((void (*)())code)();
    printf("Printing MsgBox");
    return 0;
}

---

Quote:

---

Originally Posted by ekosix

here:
what is it exactly??

---

Bad code.


Quzah.

Quote:

---

Originally Posted by quzah

Bad code.

---

You mean, it does not work?

We can't test it without more context. Post a link to where you found it.

If it works at all then it might be from some obfuscated code. Maybe the char_array has bytes in it that can be interpreted as a function address. In that case it represents a cast and call on that address.

You can't typecast things to be function pointers. It's undefined behavior. There's some lengthy debate around some place on this topic amongst the thousands of threads here if you really care to look.


Quzah.

ok, thanks!

oogabooga, I was browsing around Pastebin.

Quote:

---

You can't typecast things to be function pointers. It's undefined behavior.

---

That sounds reasonable to me. I didn't mean to suggest that it was good code, but it might run somewhere! I'm not sure what the rules of obfuscated C contests are, whether or not they must conform to the standard or just run on a particular compiler. That stuff just gives me a headache anyway.

Another shellcode wannabe.
There is nothing useful to learn from this.

Ahhhh, okay. Now I get it.

Quote:

---

Originally Posted by Salem

There is nothing useful to learn from this.

---

Security. :)