Manually loading compiled code

Question

Today I had the idea to try to manually load compiled code in C. What I had in my mind, was to read a compiled object file and store it into a buffer, get the position in the buffer of what could be the entry point, get the adress of that element, and cast it to a function pointer and call the function trough the pointer. However, I found an obstacle: how to get the adress of the main function (or of any arbitrary function) from the array of bytes containing the compiled code?

thank you

P.s. I know I could dynamically load using APIs, but I want to do it manually...if it is not an overwhelming effort. It is just a proof of concept project, so I have no problem to keep in simple! Thanks again!

Answer 1

You can search the binary for function prologues, which will give you all the functions, but you won't be able to tell which is the entry point. Hypothetically, you can also search for function calls, then assume the one that goes un-called throughout the object file is your entry point. Seems a little masochistic, but then again, so is manually loading and calling an object file instead of shelling an exe or loading a DLL, in which case there is no need to know the entry point. Here are the two functions I was talking about:

/*
 prologue:
     push ebp    ; 55
     mov ebp esp ; 8B EC

 functionCall:
     call foo    ; E8 &foo
*/
const unsigned char prologueBin[] = {0x55, 0x8B, 0xEC};
const unsigned char callOpcode = 0xE8;


inline bool isThisAfunction(unsigned char* pBin) {
    return (pBin[0] == prologueBin[0] && pBin[1] == prologueBin[1] && pBin[2] == prologueBin[2]);
};
inline bool isThisCall(unsigned char* pBin) {
    return *pBin == callOpcode;
};

isThisCall() can turn up lots of false positives, but since you'd be using it to cull your list of functions turned up by isThisAfunction(), it's unlikely to eliminate a function that isn't really being called.

Basically, I only recommend this if you really need to load a chunk of bits that you know nothing else about and call it as a function.