Executing binary/elf-file directly from (shared)-memory in C - c

Question

we are trying to copy a binary/elf file into a shared-memory region of our system and then execute it thereafter. We don't want to call our "client"-program directly, since we need to execute it from the memory itself for our purpose.
While we know that our approach (described below) won't really work, we are (obviously) trying to get it to work. How would it be possible to copy a binary/elf/etc. file directly into the (shared)-memory and execute it thereafter? Maybe we just compiled it in the wrong way? Or something else was done wrong?
We also don't want to convert it into hex/shell-code, we already did that. We are looking for an easier and more practical solution.
Is anyone able to help? Would be much appreciated!
Two programs:
"Host"-Program (copy & execute client-program in shared memory)
"Client"-Program (basically a hello-world echo)
"Client"-Program:
#include <stdio.h>
int main()
{
printf("Hello, World!\n");
return 0;
}
Compiled with gcc -o binfile clientprogram.c -static.
"Host"-Program:
#include <string.h>
#include <sys/mman.h>
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char **argv)
{
FILE *fp; //filepointer
size_t size; //filesize
unsigned char *buffer; //buffer
fp = fopen("binfile","rb");
fseek(fp, 0, SEEK_END);
size = ftell(fp);
fseek(fp, 0, SEEK_SET);
buffer = (unsigned char *) malloc(size);
if (fp == NULL){ //file empty?
printf("Error: There was an Error reading the file %s \n", "binfile");
exit(1);
}
else if (fread(buffer, sizeof *buffer, size, fp) != size){
printf("Error: There was an Error reading the file %s\n", "binfile");
exit(1);
}else{
int i;
// for(i=0; i<size;i++){
// printf("%02x", buffer[i]);
// }
}
void *mem = mmap(0, size, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANONYMOUS, -1, 0);
memcpy(mem, buffer, size);
mprotect(mem, size, PROT_READ|PROT_WRITE|PROT_EXEC);
void (*func)();
func = (void (*)()) buffer;
func();
munmap(mem, size);
fclose(fp);
free(buffer);
return 0;
}
Compiled with gcc hostprogram.c.

Answer 1

Build the client as a PIE, with -rdynamic. Then you'll be able to dlopen() it and dlsym() its main symbol (dlopen() will do the mmaping and mprotecting for you, as you'll be able to see if you strace the program), after which you'll be able to run its main from within the address space of the host.
Example:
#!/bin/sh
cat > client.c <<EOF
#include <stdio.h>
#include <unistd.h>
int main()
{
printf("Hello, World!: from %ld\n", (long)getpid());
return 0;
}
EOF
gcc -fpic -c client.c
gcc -pie -rdynamic -o client client.o
cat > host.c <<EOF
#include <dlfcn.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int main()
{
printf("Hello, I'm your host: %ld\n", (long)getpid()); ;
void *client_hndl;
typedef int main_t(int, char**);
main_t *client_main;
client_hndl = dlopen("./client", RTLD_LAZY);
if (!client_hndl){
fprintf(stderr, "%s\n", dlerror());
exit(1);
}
client_main = (main_t*)dlsym(client_hndl, "main");
if (!client_main){
fprintf(stderr, "%s\n", dlerror());
exit(2);
}
return client_main(1, (char*[]){"client", 0});
}
EOF
gcc host.c -ldl
./client
echo =============
./a.out
Example output:
Hello, World!: from 14520
=============
Hello, I'm your host: 14521
Hello, World!: from 14521

Answer 2

You are looking for a solution to this GLIBC feature request.
This feature request is 7 years old, and it's somewhat unlikely that anything will happen with it any time soon.
Your best bet is probably to do roughly what you are already doing (building a fully-static binary).
Your approach doesn't work because the executable you built requires to be loaded at the address it was linked at (visible in readelf -l binfile as the address of the first PT_LOAD segment. You would need to mmap your binfile there with MAP_FIXED, no other address will do.
You also need to read and decode the Elf{32,64}_Ehdr that is found at the beginning of the file to find entry point to jump to. You currently are jumping to the ELF header itself, but that header is not where the execution should start.