GoKawiilMartin Uecker details GCC hack for nested-function callbacks without executable stack
A technical blog post by Martin Uecker examines how GCC compiles nested functions using trampolines placed on the stack, which normally require the stack to be executable. He shows that by extracting the code address and static chain values embedded in the trampoline and passing them to the __builtin_call_with_static_chain built-in, developers can indirectly call nested functions on older GCC versions without needing an executable stack.
GoKawiil's interpretation of the reporting above, not reported fact.
Executable stacks are a long-standing security weakness that many hardened systems disable by default, so finding a workaround lets developers use convenient nested-function callbacks in C without sacrificing this protection on older compilers. This kind of low-level technique matters for systems programmers who need portability across GCC versions while maintaining strong exploit mitigations.
- GCC implements nested function pointers using runtime-generated trampolines stored on the stack.
- These trampolines normally require an executable stack, a common security liability.
- Extracting the trampoline's code address and static chain lets calls bypass the executable stack requirement via __builtin_call_with_static_chain.
Computer Systems: A Programmer's Perspective — If assembly dumps, stack frames and trampolines fascinate you, this classic bridges C code and the machine underneath it. It walks through x86-64 calling conventions, stack layout and memory protection — exactly the concepts behind executable-stack workarounds like the one in this article.
See Computer Systems: A Programmer's Perspective on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: uecker.codeberg.page, 2026-08-29
Published there as: “Indirect Calling of Nested Functions on GCC Without Executable Stack”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.