C: Run machine code from memory

Question

I want to execute some code from memory; my long-term goal is to create a self-desoldering application. To understand the essence of the issue, I started with the roots. I created the following code:

#define UNENCRYPTED true

#define sizeof_function(x) ( (unsigned long) (&(endof_##x)) - (unsigned long) (&x))
#define endof_function(x) void volatile endof_##x() {}
#define DECLARE_END_OF_FUNCTION(x) void endof_##x();

#include <unistd.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/types.h>

unsigned char *bin;

#ifdef UNENCRYPTED
void hexdump(char *description, unsigned char *toDump, unsigned long length) {
    printf("Hex-dump of \"%s\":\n", description);
    for (int i = 0; i < length; i++) {
        printf("%02x", toDump[i]);
    }
    printf("\n");
}


void hello_world() {
    printf("Hello World!\n");
}
endof_function(hello_world);
#endif

int main (void) {
    errno = 0;
    unsigned long hello_worldSize = sizeof_function(hello_world);
    bin = malloc(hello_worldSize);

    //Compute the start of the page
    size_t pagesize = sysconf(_SC_PAGESIZE);
    uintptr_t start = (uintptr_t) bin;
    uintptr_t end = start + (hello_worldSize);
    uintptr_t pagestart = start & -pagesize;
    bin = (void *)pagestart;

    //Set mprotect for bin to write-only
    if(mprotect(bin, end - pagestart, PROT_WRITE) == -1) {
        printf("\"mprotect\" failed; error: %s\n", strerror(errno));
        return(1);
    }

    //Get size and adresses
    unsigned long hello_worldAdress = (uintptr_t)&hello_world;
    unsigned long binAdress = (uintptr_t)bin;

    printf("Address of hello_world %lu\nSize of hello_world %lu\nAdress of bin:%lu\n", hello_worldAdress, hello_worldSize, binAdress);

    //Check if hello_worldAdress really points to hello_world()
    void (*checkAdress)(void) = (void *)hello_worldAdress;
    checkAdress();

    //Print memory contents of hello_world()
    hexdump("hello_world", (void *)&hello_world, hello_worldSize);

    //Copy hello_world() to bin
    memcpy(bin, (void *)hello_worldAdress, hello_worldSize);

    //Set mprotect for bin to read-execute
    if(mprotect(bin, end - pagestart, PROT_READ|PROT_EXEC) == -1) {
        printf("\"mprotect\" failed; error: %s\n", strerror(errno));
        return(1);
    }

    //Check if the contents at binAdress are the same as of hello_world
    hexdump("bin", (void *)binAdress, hello_worldSize);

    //Execute binAdress
    void (*executeBin)(void) = (void *)binAdress;
    executeBin();

    return(0);
}

However, I get a segfault error; The output of the programs is as follows:

(On OS X; i86-64):

Address hello_world 4294970639

Size of hello_world 17
Adress of bin:4296028160
Hello World!
Hex-dump of "hello_world":
554889e5488d3d670200005de95a010000
Hex-dump of "bin":
554889e5488d3d670200005de95a010000
Program ended with exit code: 9

And on my Raspi (Linux with 32-bit ARM):

Adress of hello_world 67688
Size of hello_world 36
Hello World!
Hello World!
Hex-dump of "hello_world":
00482de90db0a0e108d04de20c009fe512ffffeb04008de50bd0a0e10088bde8d20b0100
Hex-dump of "bin":
00482de90db0a0e108d04de20c009fe512ffffeb04008de50bd0a0e10088bde8d20b0100
Speicherzugriffsfehler //This is german for memory access error

Where is my mistake?

---

The problem was that the printf call in hello_world is based on the relative branch address, which, of course, does not work in the copied function. For testing purposes, I changed hello_world to:

int hello_world() {
    //_printf("Hello World!\n");
    return 14;
}

and the code in the section // Run binAdress:

int (*executeBin)(void) = (void *)binAdress;
int test = executeBin();
printf("Value: %i\n", test);

which outputs 14: D

Answer 1

ARM , cacheflush, . JIT-, x86.

, , . , .

, . , , . : , .