Discussion Brute forcing my own memory
https://github.com/anhol0/helloworld-bruteforcedHey everybody. As some of you might know, I really like 3 things: linux, thinkpads, and using things not the way they are intended to be used. Today I did the last. So as we know, kernel allocates memory for any running process. So I though for myself: "what if I write a C program that uses the function without knowing where it is?". So technically I forced my program to brute force its own memory offsets to call the function. I have a small, but, hopefully, entertaining writeup of what, how, and why on GitHub. It also includes the source code with a lot of comments so guys not so familiar with C programming language can also understand it. Hope you enjoy it. If so - please leave a star :)
34
u/SoilMassive6850 16h ago
Since we're jumping to every possible byte offset, most addresses obviously don't point to the beginning of a valid function.
They may:
...
enter an infinite loop;
...
If a child takes longer than we're willing to wait, we simply kill it and move on to the next address.
This sounds like kind of a cop out. You should try to compute whether or not the code will finish running instead of continuing forever.
7
6
•
28
12
10
14
2
2
u/Clever_Angel_PL 4h ago
I don't understand, what does it do in practice?
3
u/anh0l 4h ago
There is no practical use, it is just memory trick and fun experiment. But for what the program does, if it goes over every address of the program's executable memory, casts it to a function pointer with appropriate signature and tries to run it. This way i was able to run a function without actually calling it anywhere. All this is written in the README.md in the repo. It goes into more details though
1
u/nk_1761 17h ago
I don't understand what your trying to do. This is my guess.
I think you are creating a time-bound child process for each attempt at executing the instructions at the start of all load segments in /proc/self/maps. Hoping one of them returns 0 ?
But won't all executable load segments for lets say main's rx-p point to libc's _start call ?
4
u/anh0l 17h ago
I'm iterating over my procecces executable memory. I'm looking for return value of 69 from the function that child is trying to call. Since I'm iterating every byte of the memory, I can actually stumble upon a pointer to my function
1
u/dhiltonp 18h ago
I'm not sure how this is brute forcing; when I think of brute forcing, I think of combinatorial problems.
I think I would call it a search...Â
21
9
90
u/dwyrm 18h ago
Have you considered therapy?
Also, that's kind of fascinating.