Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

4
  • 1
    \$\begingroup\$ As I'm intentionally avoiding reputation, I don't have the reputation to mark the cop as cracked. Could someone do that for me? \$\endgroup\$ Commented May 20, 2022 at 4:19
  • \$\begingroup\$ Incredible crack! I shall do that. I thought that I had ruled out this solution with the { character, but I forgot about string literals! \$\endgroup\$ Commented May 20, 2022 at 4:42
  • 1
    \$\begingroup\$ This doesn't work on newer Linux systems. More modern Linux kernels only apply -zexecstack to the actual stack, instead of having it set the READ_IMPLIES_EXEC process personality. See How to get c code to execute hex machine code?. (The reason it used to not require -zexecstack is that older ld versions linked the .rodata section into the same ELF segment as .text. Newer ld avoids that, to minimize Spectre / ROP gadget surface area by not having any bytes in executable pages that don't need to be.) \$\endgroup\$ Commented May 20, 2022 at 13:20
  • 1
    \$\begingroup\$ For modern GCC/ld/kernel, one way that works is to add __attribute__((section(".text"))) to the source before the array. as outputs "Warning: ignoring changed section attributes for .text", probably because GCC used a .section .text directive without the usual attributes that make it executable. Since as ignores it, we end up with this symbol in an executable .text section, with your custom machine code, so that Just Works without -zexecstack. It also works with tcc, with no warning; it seems it supports that attribute. \$\endgroup\$ Commented May 20, 2022 at 13:34