1

I was wondering if it was possible to restart a program (ignoring previously mapped files) with different argument by either calling main() or a glibc entry point function.

7
  • I think the problem is about initializing what is already initialized (like the stack or the heap) isn’t it? May 13, 2017 at 20:04
  • 1
    It depends on what stage are you restarting. There would be issues with the program's internal constants, command parameters, all the threads that have been already spawn, all the allocated memory and etc... but technically you can do it, yes.
    – PhoeniX
    May 14, 2017 at 4:45
  • @ph0sec my program doesn't spawn threads, however, it manage it's heap without glibc so that calling malloc can corrupt the heap. That's why I was thinking at restarting at an earlier entry point than point in order to allocate a new heap area. May 14, 2017 at 10:17
  • are you planning to do fuzzing this way by any chance?
    – Igor Skochinsky
    May 15, 2017 at 16:12
  • @IgorSkochinsky fuzz what? May 15, 2017 at 16:13

1 Answer 1

1

Well, while it's definitely possible to jump to the entrypoint of the program to try restarting it, there may be various consequences preventing correct execution, e.g.:

  • library initialization has been run already, and running it a second time is not something most libraries expect
  • various resources may have been allocated and variables initialized, so doing it again may not work.

So what you can do is to cause the program to simulate termination without actually exiting and then jump to the entry point. Microsoft CRT provides functions _c_exit and _cexit for such cpurpose, but it seems glibc does not have anything similar. So you may have to simulate calling of the atexit handlers manually to perform cleanup.

2
  • except in my case I can only call one function. May 16, 2017 at 10:01
  • well, you can always just try and see if it works. If not, you'll need to figure out how to chain execution of multiple functions.
    – Igor Skochinsky
    May 16, 2017 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.