C / C++ / MFC

Re: Copying and executing code of a function [modified]

22-Apr-11 1:40

Hi guys(and girls Wink | ;)

),

i want to copy the data of a function, with the whole data, i mean, the whole function and execute it on the target memory. How do i realize it?
Is there a possibility to determine when the function ends? Is it possible to copy the function into the heap and execute it there ? Or has it have to be the Stack ?

I tried to look into it with a Debugger and so on, but couldnt get any information regarding the matter.

thanks in advance for every answer =)

btw. i use C (gcc)

Code-o-mat22-Apr-11 3:20

22-Apr-11 3:20

Are you working on windows?

[EDIT] If you had said yes then i would have suggested the same thing as barneyman did "below". Smile | :)

[/EDIT]

> The problem with computers is that they do what you tell them to do and not what you want them to do. <
> //TODO: Implement signature here<

modified on Friday, April 22, 2011 9:42 AM

barneyman22-Apr-11 3:20

barneyman

22-Apr-11 3:20

have a look at the VirtualAlloc and VirtualProtect winAPI functions - you'll need to grant PAGE_EXEC rights (I assume you're doing this in Windows)

You'll know when the code finishes because the function will return back to you

Bashilein22-Apr-11 6:40

22-Apr-11 6:40

thanks, but i am working under ubuntu.

And yes the function will return, but i have to copy it beforehand, before i execute it.

Code-o-mat22-Apr-11 9:04

22-Apr-11 9:04

Try googling for linux equivalents of those methods. I hit mmap[^] for example, maybe that can do what you wish for VirtualAlloc, for VirtualProtect mprotect[^] might work.

> The problem with computers is that they do what you tell them to do and not what you want them to do. <
> //TODO: Implement signature here<

Bashilein22-Apr-11 22:06

22-Apr-11 22:06

damn, me silly =)thanks Smile | :)

but how about to determine the end of the function. Also i want to copy it into the heap and execute it there, but the heap is read not the same way the stack does. Would that cause any problems?

barneyman23-Apr-11 2:22

barneyman

23-Apr-11 2:22

as long as the function executes a RET (or whatever is appropriate for the chipset you're using) you know when it finishes, because code execution will come back to you

Both the heap and the stack are still physical memory areas, it's largely down to what the OS will let you do with each

Bashilein24-Apr-11 2:25

24-Apr-11 2:25

Ok i was analyzing the asm code in a debugger and found a solution. I used code from here: <a href="clickme">http://www.devmaster.net/codespotlight/show.php?id=25</a>
and modified it slightly to check on 0xC3(RETN), the return changed to func(in the end) - func(when you call the function). And vuala you have the length of the function in bytes Wink | ;)

Now it is possible to just get the length without doing any marker whatsoever, btw i considered the markerthing, but that wouldnt be possible, not so easy anyways, because every opcode can differentiate between op length and so on.

David198724-Apr-11 8:01

David1987

24-Apr-11 8:01

The ret may not be at the end (address-wise) and in fact frequently isn't (well, depending on what compiler you use)

Code-o-mat23-Apr-11 7:37

23-Apr-11 7:37

I'm not sure what you mean by the heap and stack read difference thing.
Finding out where your function ends (basicly, finding out its size) seems to be trickier than it sounds. I guess what you can do is simply query how big a page is and then guess how many pages your function uses up, or maybe have some special value somehow embedded into the code, like 0xDEADBEEF and look for it during runtime...have no better idea yet.

> The problem with computers is that they do what you tell them to do and not what you want them to do. <
> //TODO: Implement signature here<

barneyman23-Apr-11 23:12

barneyman

23-Apr-11 23:12

i understand the 'function end' reference now Smile | :)

You have a number of options, either hard-code the length of the function-copy as a result of manually analysing the map file, (or using the GCC equivalent of #pragma code-seg, put the function(s) in their own code segment) or insert (as code-o-mat says) a magic number at the end and emit a JMP opcode to get passed it

If you're doing some runtime code decryption, i'd go with the code-seg option

Code-o-mat24-Apr-11 5:26

24-Apr-11 5:26

I wonder if this could work and how reliable it would be:

#include "stdafx.h"
#include "windows.h"
#include "conio.h"

//If this method is called with pSize set to non-null, it should returns its near its full size in it
long ThisIsAFunction(unsigned long *pSize, int other_parameters)
{
  if (pSize != NULL) goto ThisIsTheEnd;
  
  //---- Actual program code ----
  return other_parameters + 1;

ThisIsTheEnd:
  unsigned long EndAddress;

  __asm {
    push eax
    mov eax, ThisIsTheEnd
    mov EndAddress, eax
    pop eax
  }
  *pSize = (EndAddress - (unsigned long)(unsigned long long)ThisIsAFunction);
  return 0;
}

int _tmain(int argc, _TCHAR* argv[])
{
  unsigned long Size;
  ThisIsAFunction(&Size, 0);

  printf("Start of function: %p\nLength: %d bytes\n", ThisIsAFunction, Size);
  getch();

	return 0;
}

Also, i wonder if compile-time optimization(s) could ruin it, if it works at all.

> The problem with computers is that they do what you tell them to do and not what you want them to do. <
> //TODO: Implement signature here<

Bashilein24-Apr-11 6:57

24-Apr-11 6:57

Yeah Compiler optimizations could ruin that Wink | ;)

especially inlining. Look at my approach, i posted it about 4h ago in reply to the post of barneyman.

Code-o-mat24-Apr-11 7:11

24-Apr-11 7:11

Interesting. What about if you have more returns in the code, like:

...
switch (x)
{
case 1: return A;
case 2: return B;
case 3: return C;
...
}
...

Wouldn't that produce more RETN? Of course, if you know that the function contains only one then i guess it's Ok. Am just asking "theoretically".

> The problem with computers is that they do what you tell them to do and not what you want them to do. <
> //TODO: Implement signature here<

Bashilein25-Apr-11 22:21

25-Apr-11 22:21

Crap, ill check it out, thx. But i have another Problem, After copying the function into my (with virtualalloc) allocated memory every callfunction in the method doesn't work. The ret works however. I am trying to figure out a solution.

Code-o-mat26-Apr-11 7:39