ヒープに実行権限を与えるテスト

a.c

#include<stdio.h>
#include<stdlib.h>

#include<sys/mman.h>
#include<unistd.h>


void run(){
    unsigned char *code;
    int code_length = 64;
    
    if (posix_memalign((void**)&code,sysconf(_SC_PAGESIZE),sizeof(char) * code_length)){
        fprintf(stderr,"ERROR MEMALIGN\n");
        exit(1);
    }
    if (mprotect((void*)code,sizeof(char) * 32,PROT_READ | PROT_WRITE | PROT_EXEC)){
       fprintf(stderr,"ERROR MEMPROTECT \n");
        exit(1);
    }
    
    //MOV EAX, 28
    code[0] = 0xb8; code[1] = 0x1c; code[2] = 0x00; code[3] = 0x00; code[4] = 0x00;
    
    //RET
    code[5] = 0xc3;

    int res = ((int(*)(void))(code))();
    printf("%d\n",res);
}


int main(void){
    run();
    return 0;
}