What does `((void (*)())0x1000)();` mean? [duplicate]

Question

Here is a code that purpose is to set the program counter to jump to address 0x1000. I know what it does but I don't understand how. It is related to my lack of C language knowledge. May be you can enlighten me. Here is the statement/function (I even don't know what it is :))

((void (*)())0x1000)();

I thing it is pointer to a functions that returns void and accepts no argument. Please correct me if I am wrong.

Answer 1

C declarations are decoded from inside out using a simple rule: start from the identifier and check on the right side for [] (array) or () (function) then check on the left side for the type of the values (stored in the array or returned by the function), without crossing the parentheses; escape from the parentheses and repeat.

For example:

void (*p)()

p is (nothing on the right) a pointer (on the left, don't cross the parentheses) to (escape the parentheses, read the next level) a function (right) that returns nothing (left).

When the identifier (p in this case) is missing, all that remains is a type declaration.

A type enclosed in parentheses, put in front of a value is a type cast.

(void (*)())0x1000

converts the number 0x1000 to a pointer to a function that doesn't return anything (see what's outside the parentheses in the paragraph about the declaration of p above).

On the next level, the expression above (a pointer to a function can be used in the same way as a function name) is used to execute the code pointed at.

See below the entire expression de-composed:

(
  (
    void (*)()   /* type: pointer to function that doesn't return anything     */
  )0x1000        /* value 0x1000 treated as a value of the type declared above */
)                /* enclose in parentheses to specify the order of evaluation  */ 
();              /* the pointer above used as a function name to run the code  */

Answer 2

(void (*)()) is a pointer to a function returning void and taking an unspecified, but fixed, number of arguments.

(void (*)())0x1000 is casting the literal 0x1000 to the above type.

Finally, the suffixed () calls that function. The expression preceding that needs to be in brackets otherwise the suffixed () will bind to the 0x1000 which is not syntactically valid.

It's down to you to check if the casting is actually valid. If not then the behaviour of your program is undefined.

Answer 3

A constant

0x1000

gets cast to a type:

(type)0x1000

The type is void (*)() — a pointer (asterisk) to a function which takes no (oops, see the comment by pmg) unspecified number of parameters (empty parentheses on the right) and returns no value (void on the left). Additional parens on the asterisk prevent associating it to void, which would incorrectly create a void * type here.

So after the cast you have a pointer to a parameter-less void function at the addres 0x1000:

(void (*)())0x1000

And that function...

((void (*)())0x1000)

gets called by adding an empty parameters list:

((void (*)())0x1000)()

Finally, the semicolon added at the end transforms this function-call expression into a complete instruction:

((void (*)())0x1000)();