News for hackers. Stuff that matters.

A comment on Can I exec an new process without an executable file? (2015).

Re:Can I exec an new process without an executable file? (2015) by impl on Thursday November 03, 2022 @12:46AM (#33447119)
If anyone's looking for an example, I used this trick a few months ago to embed a tiny helper binary[0] directly into my application[1] so I wouldn't have to ship two executables or add "hidden" behavior to the main program. It works really well (on Linux)!

[0]: https://github.com/impl/systemd-user-sleep/blob/666cf29871b1...

[1]: https://github.com/impl/systemd-user-sleep/blob/666cf29871b1...

[ Parent | on HN ]
Re:Can I exec an new process without an executable file? (2015) by jart on Thursday November 03, 2022 @04:32AM (#33448417)
Here's a simple concrete example for folks who don't know Rust:

    int main(int argc, char *argv[]) {
    #define TINY_ELF_PROGRAM "\
    \177\105\114\106\002\001\001\000\000\000\000\000\000\000\000\000\
    \002\000\076\000\001\000\000\000\170\000\100\000\000\000\000\000\
    \100\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\
    \000\000\000\000\100\000\070\000\001\000\000\000\000\000\000\000\
    \001\000\000\000\005\000\000\000\000\000\000\000\000\000\000\000\
    \000\000\100\000\000\000\000\000\000\000\100\000\000\000\000\000\
    \200\000\000\000\000\000\000\000\200\000\000\000\000\000\000\000\
    \000\020\000\000\000\000\000\000\152\052\137\152\074\130\017\005"
      int fd = memfd_create("foo", MFD_CLOEXEC);
      write(fd, TINY_ELF_PROGRAM, sizeof(TINY_ELF_PROGRAM)-1);
      fexecve(fd, argv, environ);
    }
Who here is brave enough to run my C string?
[ Parent | on HN ]
Re:Can I exec an new process without an executable file? (2015) by anshargal on Thursday November 03, 2022 @06:07AM (#33449014)
I had to add

  #define _GNU_SOURCE
  #include <sys/mman.h>
  #include <unistd.h>
I've tested in Fabrice Bellard JSLinux with tcc (x86 arch) and on https://replit.com/languages/c (x64). I failed to see any side effect at all. gdb "catch syscall" doesn't show anything interesting too. Looks like TINY_ELF_PROGRAM is not doing anything.
[ Parent | on HN ]
Re:Can I exec an new process without an executable file? (2015) by enriquto on Thursday November 03, 2022 @06:15AM (#33449038)
you can disassemble the code portion, they are single-byte instructions

    push 0x2a
    pop edi
    push 0x3c
    pop eax
    db 0x0f, 0x05 ; invalid?
[ Parent | on HN ]
Re:Can I exec an new process without an executable file? (2015) by qguv on Thursday November 03, 2022 @06:32AM (#33449124) 

    ; set the first syscall argument to 42
    push   0x2a
    pop    edi

    ; select syscall 60 (sys_exit)
    push   0x3c
    pop    eax

    ; sys_exit(42)
    syscall
[ Parent | on HN ]
Re:Can I exec an new process without an executable file? (2015) by enriquto on Thursday November 03, 2022 @06:37AM (#33449162)
LOL my asm is rusty, didn't even know about the syscall instruction (I'd have used int 0x80 here)
[ Parent | on HN ]
Re:Can I exec an new process without an executable file? (2015) by mFixman on Thursday November 03, 2022 @09:56AM (#33451027)
What's the point of `push`ing constants to the stack and `pop`ing them to registers instead of `mov`ing them directly?
[ Parent | on HN ]
Re:Can I exec an new process without an executable file? (2015) by saagarjha on Thursday November 03, 2022 @11:01AM (#33452065)
I think they encode smaller?
[ Parent | on HN ]
Re:Can I exec an new process without an executable file? (2015) by anshargal on Thursday November 03, 2022 @10:00AM (#33451098)
That's cool - I wonder why exit code is not set to 42 in practice? binary still returns 0, must be a bug somewhere.
[ Parent | on HN ]
Re:Can I exec an new process without an executable file? (2015) by saagarjha on Thursday November 03, 2022 @11:01AM (#33452060)
A successful run not exiting with EXIT_SUCCESS usually requires a good reason to justify it.
[ Parent | on HN ]
Re:Can I exec an new process without an executable file? (2015) by tralarpa on Thursday November 03, 2022 @06:18AM (#33449063)
It returns the answer to an important question :)

Edit: Wouldn't mov be shorter than push/pop? (I am not very familar with x86)

[ Parent | on HN ]
Re:Can I exec an new process without an executable file? (2015) by kubanczyk on Friday November 04, 2022 @04:04PM (#33472976)
No, mov is longer. Push stores the constant as just one byte and omits the three zero bytes. https://stackoverflow.com/questions/56618815/why-use-push-po...
[ Parent | on HN ]