Calling a function in C without naming it
Student write-up demonstrates calling execve in C without naming the symbol, bypassing an automated code grader's AST-based function allowlist checks.
A blog post details how to defeat a school's remote code execution grading environment that uses clang AST parsing to restrict which C functions submissions may reference. The technique leaks a fixed memory offset between an allowed symbol (printf, replaced by ASan interceptors) and a target libc function, then reconstructs the target address at runtime to call it without naming it. The author also discusses using mmap to allocate W^X-compliant executable memory for arbitrary shellcode, working around ASLR's randomization of segment mapping addresses. The approach relies on function ordering within segments remaining intact under ASLR.
- Defeats AST-based function allowlist checks in an automated C grading environment
- Leaks fixed offset between allowed symbol and target libc function despite ASLR
- ASan interceptor symbols complicate offset calculations but can be leveraged
- mmap used to obtain write-and-execute memory page bypassing W^X policy
From the original article
7 min read at wiro.worldMy school has a controlled remote code execution environment to automatically grade the code we submit. The system checks execution, verifies proper formatting and surely has other checks not shown to the user (e. g.
By wiro.world by mrnossiom · wiro.world
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.