Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

c generate function and call it

#include <stdio.h>

#define uint unsigned int
#define AddressOfLabel(sectionname,out) __asm{mov [out],offset sectionname};

void* CreateFunction(void* start,void *end) {
    uint __start=(uint)start,__end=(uint)end-1
        ,size,__func_runtime;
    void* func_runtime=malloc(size=(((__end)-(__start)))+1);
    __func_runtime=(uint)func_runtime;
    memcpy((void*)(__func_runtime),start,size);
    ((char*)func_runtime)[size]=0xC3; //ret
    return func_runtime;
}
void CallRuntimeFunction(void* address) {
    __asm {
        call address
    }
}

main() {
    void* _start,*_end;
    AddressOfLabel(__start,_start);
    AddressOfLabel(__end,_end);
    void* func = CreateFunction(_start,_end);
    CallRuntimeFunction(func); //I expected this method to print "Test"
    //but this method raised exception
    return 0;
__start:
    printf("Test");
__end:
}

CreateFunction - takes two points in memory (function scope), allocate, copy it to the allocated memory and returns it (The void* used like a function to call with Assembly)

CallRuntimeFunction - runs the functions that returns from CreateFunction

#define AddressOfLabel(sectionname,out) - Outs the address of label (sectionname) to variable (out)

When I debugged this code and stepped in the call of CallRuntimeFunction and go to disassembly , I saw alot of ??? instead of assembly code of between __start and __end labels.

I tried to copy machine code between two labels and then run it. But I don't have any idea why I can't call function that allocated with malloc.

Edit:

I changed some code and done part of the work. Runtime Function's memory allocate:

void* func_runtime=VirtualAlloc(0, size=(((__end)-(__start)))+1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);

Copy from function scope:

CopyMemory((void*)(__func_runtime),start,size-1);

But when I ran this program I can that:

mov         esi,esp  
push        0E4FD14h  
call        dword ptr ds:[0E55598h] ; <--- printf ,after that I don't know what is it
add         esp,4  
cmp         esi,esp  
call        000B9DBB  ; <--- here
mov         dword ptr [ebp-198h],0  
lea         ecx,[ebp-34h]  
call        000B9C17  
mov         eax,dword ptr [ebp-198h]
jmp         000D01CB  
ret  

At here it enters to another function and weird stuff.

like image 554
MessyCode Avatar asked Jul 31 '12 11:07

MessyCode


People also ask

How do you create a function and call it?

You call the function by typing its name and putting a value in parentheses. This value is sent to the function's parameter. e.g. We call the function firstFunction(“string as it's shown.”);

How do you call a function in C?

Function Calling:It is only called by its name in the main() function of a program. We can pass the parameters to a function calling in the main() function. Syntax: Add(a, b) // a and b are the parameters.

What is predefine function in C?

Library function: These function are the built-in functions i.e., they are predefined in the library of the C. These are used to perform the most common operations like calculations, updation, etc. Some of the library functions are printf, scanf, sqrt, etc.

What is the difference between calling and declaring a function?

declare and define are the same, and they mean when you write all the code for your function. At that point the function just sits there doing nothing. call is when you tell the JavaScript interpreter to run the code in your function.


1 Answers

void CallRuntimeFunction(void* address) {
    __asm {
        call address
    }
}

here address is a "pointer" to a parameter of this function which is also a pointer.

pointer to a pointer

use:

void CallRuntimeFunction(void* address) {
_asm {
    mov ecx,[address] //we get address of "func"
    mov ecx,[ecx]   //we get "func"
    call [ecx]      //we jump func(ecx is an address. yes)
    }
}

you wanna call func which is a pointer. when passed in your CallRunt... function, this generates a new pointer to point to that pointer. Pointer of second degree.

void* func = CreateFunction(_start,_end);

yes func is a pointer

Important: check your compilers "calling convention" options. Try the decl one

like image 57
huseyin tugrul buyukisik Avatar answered Sep 23 '22 03:09

huseyin tugrul buyukisik