How to alloc a executable memory buffer?

by

You don’t use malloc for that. Why would you anyway, in a C++ program? You also don’t use new for executable memory, however. There’s the Windows-specific VirtualAlloc function to reserve memory which you then mark as executable with the VirtualProtect function applying, for instance, the PAGE_EXECUTE_READ flag.

When you have done that, you can cast the pointer to the allocated memory to an appropriate function pointer type and just call the function. Don’t forget to call VirtualFree when you are done.

Here is some very basic example code with no error handling or other sanity checks, just to show you how this can be accomplished in modern C++ (the program prints 5):

#include <windows.h>
#include <vector>
#include <iostream>
#include <cstring>

int main()
{
    std::vector<unsigned char> const code =
    {
        0xb8,                   // move the following value to EAX:
        0x05, 0x00, 0x00, 0x00, // 5
        0xc3                    // return what's currently in EAX
    };    

    SYSTEM_INFO system_info;
    GetSystemInfo(&system_info);
    auto const page_size = system_info.dwPageSize;

    // prepare the memory in which the machine code will be put (it's not executable yet):
    auto const buffer = VirtualAlloc(nullptr, page_size, MEM_COMMIT, PAGE_READWRITE);

    // copy the machine code into that memory:
    std::memcpy(buffer, code.data(), code.size());

    // mark the memory as executable:
    DWORD dummy;
    VirtualProtect(buffer, code.size(), PAGE_EXECUTE_READ, &dummy);

    // interpret the beginning of the (now) executable memory as the entry
    // point of a function taking no arguments and returning a 4-byte int:
    auto const function_ptr = reinterpret_cast<std::int32_t(*)()>(buffer);

    // call the function and store the result in a local std::int32_t object:
    auto const result = function_ptr();

    // free the executable memory:
    VirtualFree(buffer, 0, MEM_RELEASE);

    // use your std::int32_t:
    std::cout << result << "\n";
}

It’s very unusual compared to normal C++ memory management, but not really rocket science. The hard part is to get the actual machine code right. Note that my example here is just very basic x64 code.

More Related Contents:

  1. convert malloc to new c++ for struct
  2. In what cases do I use malloc and/or new?
  3. How do malloc() and free() work?
  4. What is the difference between “new” and “malloc” and “calloc” in C++? [duplicate]
  5. How can I get the size of a memory block allocated using malloc()? [duplicate]
  6. Check if a pointer points to allocated memory on the heap
  7. dynamically allocated memory after program termination
  8. Memory allocation and deallocation across dll boundaries
  9. new, delete ,malloc & free
  10. Is delete[] equal to delete?
  11. C++ new int[0] — will it allocate memory?
  12. Finding current executable’s path without /proc/self/exe
  13. How could pairing new[] with delete possibly lead to memory leak only?
  14. How to use a C++ string in a structure when malloc()-ing the same structure?
  15. Compelling examples of custom C++ allocators?
  16. How to get available memory C++/g++?
  17. How does a C++ reference look, memory-wise?
  18. Any reason to overload global new and delete?
  19. Are memory leaks “undefined behavior” class problem in C++?
  20. What is the behavior of “delete” with stack objects? [duplicate]
  21. malloc implementation?
  22. Reason why not to have a DELETE macro for C++
  23. Why, really, deleting an incomplete type is undefined behaviour?
  24. What is “bit padding” or “padding bits” exactly?
  25. Behaviour of malloc with delete in C++
  26. How do I call the original “operator new” if I have overloaded it?
  27. When do programmers use Empty Base Optimization (EBO)
  28. vector memory allocation strategy
  29. How to reduce the size of executable produced by MinGW g++ compiler?
  30. Adding multiple executables in CMake

Leave a Comment