Read/copy/call a functions machine code?

[MisterE]

Is it possible to create a pointer to a function, and then get its size (the
actual size the function takes in machine code), such that you can copy the
function to another memory location. You could then modify it (I know it
would be modifing the machine code) and then call the modified function via
a function pointer?

[Guillaume Dargaud]

There's also the fact that on some modern processors, you'd need (?) to copy
the code in a data segment, and this is non-executable. And the code segment
is non-writable, or should be, so you can't copy it back.
--
Guillaume Dargaud
http://www.gdargaud.net/

[vippstar]

On Feb 18, 12:12 pm, "MisterE" <[e-mail]:

Is it possible to create a pointer to a function

Sure, T (*ptr)(T); declares ptr as a function pointer that takes T and
returns T.

and then get its size (the actual size the function takes in machine code),

Nope, that cannot be done. There is not even machine code in a
function pointer, and a function pointer does not have to point to
actual memory in the implementation.

such that you can copy the function to another memory location. You could then modify it (I know it

You can do that

int (*ptr)(int) = putchar;
T (*tmp)(T) = (T (*)(T))ptr; /* any type T is, this is guaranteed to
work, cast is not needed */
ptr = getchar;
ptr();
ptr = (int (*)(int))tmp; /* this is guaranteed to work too, cast not
needed */
ptr('\n');

What my code demonstrates here is that there is no 'void *' for
function pointers because you can store any function pointer to any
other function pointer and back.

would be modifing the machine code) and then call the modified function via
a function pointer?

ISO C does not define 'machine code'.
Why do you ask here? try it!
It doesn't seem to me you care about ISO C or portability, rather than
getting that 'hack' work.

[Malcolm McLean]

"MisterE" <Mi*****@nimga.comwrote in message news:

Is it possible to create a pointer to a function, and then get its size
(the actual size the function takes in machine code), such that you can
copy the function to another memory location. You could then modify it (I
know it would be modifing the machine code) and then call the modified
function via a function pointer?

Yes and no.
If you cast the function pointer to an unsigned char *, then most compilers
will allow you to read the instructions until you hit upon a return
instruction, which will be the end of the function.
However it is not guaranteed, and most modern Oses frown on allowing code to
be modified on the fly. There are ways around this, of course, or the OS
itself wouldn't be able to load programs into memory.

--
Free games and programming goodies.
http://www.personal.leeds.ac.uk/~bgy1mm

[Chris Dollin]

Malcolm McLean wrote:

"MisterE" <Mi*****@nimga.comwrote in message news:

>Is it possible to create a pointer to a function, and then get its size
(the actual size the function takes in machine code), such that you can
copy the function to another memory location. You could then modify it (I
know it would be modifing the machine code) and then call the modified
function via a function pointer?

Yes and no.
If you cast the function pointer to an unsigned char *, then most compilers
will allow you to read the instructions until you hit upon a return
instruction, which will be the end of the function.

Not necessarily.

(a) A function may have multiple return points -- there's no need for there
to be a single exit point in the code.

(b) The compiler is at liberty to put returns in front of the function
body, if that leads to more efficient code.

(c) A tail-optimised function may have no returns at all, just jumps to
other functions.

A Poul Anderson quote occurs to me, but I can't remember where it comes
from.

--
"Well begun is half done." - Proverb

Hewlett-Packard Limited Cain Road, Bracknell, registered no:
registered office: Berks RG12 1HN 690597 England

[Walter Roberson]

In article <L-******************************@bt.com>,
Malcolm McLean <re*******@btinternet.comwrote:

>If you cast the function pointer to an unsigned char *, then most compilers
will allow you to read the instructions until you hit upon a return
instruction, which will be the end of the function.

Qui?? Many a function would have multiple return instructions.

On all of the machines that I have had experience with that allowed
the code to be examined under program control, there was no limit
such as "until a return instruction: reading was possible until
you ran off the end of the readable memory in that address block
(the exact end of which was not necessarily predicatable and might
not have anything to do with the location of return instructions.)

But then I've used processors that didn't -have- return
instructions, just branch instructions that took the destination
location from memory or a register.

Some systems might put a "guard page" (or guard segment) after the
end of a routine to catch overruns, but that's more common for
data segments than for instruction segments.
--
"The slogans of an inadequate criticism peddle ideas to fashion"
-- Walter Benjamin

[Bartc]

"Malcolm McLean" <re*******@btinternet.comwrote in message
news:L-******************************@bt.com...

"MisterE" <Mi*****@nimga.comwrote in message news:

>Is it possible to create a pointer to a function, and then get its size
(the actual size the function takes in machine code), such that you can
copy the function to another memory location. You could then modify it (I
know it would be modifing the machine code) and then call the modified
function via a function pointer?

Yes and no.
If you cast the function pointer to an unsigned char *, then most
compilers will allow you to read the instructions until you hit upon a
return instruction, which will be the end of the function.

I take it you've never actually tried this? :-)

--
Bart

[Richard Tobin]

In article <77******************************@bt.com>,
Malcolm McLean <re*******@btinternet.comwrote:

>Embedded or multiple returns are a bit more complex. Often machine code
obeys the one in one out rule of a single point of entry and a single point
of exit, and you can pick up the real return by looking for the stack
manipulation that immediately precedes it.

Just as a data point, if I give gcc the -fomit-frame-pointer option on
my x86 Mac, there's no stack manipulation before a return, and
(presumably as a consequence) it's happy to emit multiple return
instructions.

-- Richard
--
:wq

[Flash Gordon]

Jack Klein wrote, On 19/02/08 03:35:

<snip>

But it is way beyond the scope of standard C, where there are only two
things you can do with a function, call it or take its address. And
the only thing you can do with its address, after taking it, is use it
to call the function.

You can also store it for later use ;-)
--
Flash Gordon