#include #include #include #include #include typedef void (*fn)(void); #define SLABSIZE 4096 int main(int argc, char *argv[]) { int value = 41; void *slab = malloc(SLABSIZE); if (!slab) err(1, "malloc"); memset(slab, 0xC3, SLABSIZE); // RET not INT3 if (mprotect(slab, SLABSIZE, PROT_EXEC) != 0) err(1, "mprotect"); fn call = slab; call(); printf("%d\n", value); }