On: Can I exec a new process without an executable fil...

[jart]

Here's a simple concrete example for folks who don't know Rust:

    int main(int argc, char *argv[]) {
    #define TINY_ELF_PROGRAM "\
    \177\105\114\106\002\001\001\000\000\000\000\000\000\000\000\000\
    \002\000\076\000\001\000\000\000\170\000\100\000\000\000\000\000\
    \100\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\
    \000\000\000\000\100\000\070\000\001\000\000\000\000\000\000\000\
    \001\000\000\000\005\000\000\000\000\000\000\000\000\000\000\000\
    \000\000\100\000\000\000\000\000\000\000\100\000\000\000\000\000\
    \200\000\000\000\000\000\000\000\200\000\000\000\000\000\000\000\
    \000\020\000\000\000\000\000\000\152\052\137\152\074\130\017\005"
      int fd = memfd_create("foo", MFD_CLOEXEC);
      write(fd, TINY_ELF_PROGRAM, sizeof(TINY_ELF_PROGRAM)-1);
      fexecve(fd, argv, environ);
    }

Who here is brave enough to run my C string?

[anshargal → jart]

I had to add

  #define _GNU_SOURCE
  #include <sys/mman.h>
  #include <unistd.h>

I've tested in Fabrice Bellard JSLinux with tcc (x86 arch) and on https://replit.com/languages/c (x64). I failed to see any side effect at all. gdb "catch syscall" doesn't show anything interesting too. Looks like TINY_ELF_PROGRAM is not doing anything.

[enriquto → anshargal]

you can disassemble the code portion, they are single-byte instructions

    push 0x2a
    pop edi
    push 0x3c
    pop eax
    db 0x0f, 0x05 ; invalid?

[qguv → enriquto]

    ; set the first syscall argument to 42
    push   0x2a
    pop    edi

    ; select syscall 60 (sys_exit)
    push   0x3c
    pop    eax

    ; sys_exit(42)
    syscall

[enriquto → qguv]

LOL my asm is rusty, didn't even know about the syscall instruction (I'd have used int 0x80 here)

[mFixman → qguv]

What's the point of `push`ing constants to the stack and `pop`ing them to registers instead of `mov`ing them directly?

[saagarjha → mFixman]

I think they encode smaller?

[anshargal → qguv]

That's cool - I wonder why exit code is not set to 42 in practice? binary still returns 0, must be a bug somewhere.

[saagarjha → anshargal]

A successful run not exiting with EXIT_SUCCESS usually requires a good reason to justify it.

[tralarpa → jart]

It returns the answer to an important question :)

Edit: Wouldn't mov be shorter than push/pop? (I am not very familar with x86)

[kubanczyk → tralarpa]

No, mov is longer. Push stores the constant as just one byte and omits the three zero bytes. https://stackoverflow.com/questions/56618815/why-use-push-po...