1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

#include <stdio.h>
 
int main(int argc, char *argv[]) {
    printf("====== Argument Analysis ======\n");
    printf("argc = %d\n\n", argc);
    
    // Iterate through all arguments
    printf("Arguments (via index):\n");
    for (int i = 0; i < argc; i++) {
        printf("  argv[%d] = "%s" (addr: %p)\n", i, argv[i], (void*)argv[i]);
    }
    
    // Verify NULL terminator
    printf("\nNULL check:\n");
    printf("  argv[%d] = %p (should be NULL)\n", argc, (void*)argv[argc]);
    
    // Alternative iteration using NULL terminator
    printf("\nArguments (via pointer iteration):\n");
    for (char **p = argv; *p != NULL; p++) {
        printf("  %s\n", *p);
    }
    
    // Memory layout observation
    printf("\nMemory layout of argument strings:\n");
    for (int i = 0; i < argc; i++) {
        printf("  "%s" starts at %p, length %zu\n", 
               argv[i], (void*)argv[i], strlen(argv[i]));
    }
    
    return 0;
}
 
/* Example run:  ./program hello world
====== Argument Analysis ======
argc = 3
 
Arguments (via index):
  argv[0] = "./program" (addr: 0x7ffd1234abcd)
  argv[1] = "hello" (addr: 0x7ffd1234abd7)
  argv[2] = "world" (addr: 0x7ffd1234abdd)
 
NULL check:
  argv[3] = (nil) (should be NULL)
*/

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

/* 
 * Simplified view of what the kernel builds on the new process's stack
 * (x86-64 Linux, addresses decrease going up)
 */
 
// After exec(), the stack pointer (%rsp) points to:
//
// Higher addresses
// ┌──────────────────────────────────────────┐
// │ "LAST_ENV=value\0"                       │ ← environment strings
// │ "PATH=/usr/bin\0"                        │
// │ "HOME=/home/user\0"                      │
// │ ...                                      │
// │ "/home\0"                                │ ← argument strings  
// │ "-la\0"                                  │
// │ "ls\0"                                   │
// ├──────────────────────────────────────────┤
// │ auxv entries...                          │ ← auxiliary vector
// ├──────────────────────────────────────────┤
// │ NULL                                     │ ← end of envp
// │ pointer to "LAST_ENV=value"              │
// │ pointer to "PATH=/usr/bin"               │
// │ pointer to "HOME=/home/user"             │ ← envp[]
// ├──────────────────────────────────────────┤
// │ NULL                                     │ ← end of argv
// │ pointer to "/home"                       │
// │ pointer to "-la"                         │
// │ pointer to "ls"                          │ ← argv[]
// ├──────────────────────────────────────────┤
// │ 3 (argc)                                 │ ← %rsp points here
// └──────────────────────────────────────────┘
// Lower addresses (stack grows down)
 
// The C runtime (_start → __libc_start_main) then calls:
// main(argc, argv, envp)
// where:
//   argc = *(long*)(%rsp)
//   argv = (%rsp + 8)
//   envp = &argv[argc + 1]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
 
// Query ARG_MAX programmatically
void check_limits() {
    long arg_max = sysconf(_SC_ARG_MAX);
    printf("ARG_MAX = %ld bytes (%.2f MB)\n", 
           arg_max, arg_max / (1024.0 * 1024.0));
    
    // Calculate current environment size
    extern char **environ;
    size_t env_size = 0;
    for (char **e = environ; *e != NULL; e++) {
        env_size += strlen(*e) + 1;  // string + null terminator
        env_size += sizeof(char*);    // pointer
    }
    
    printf("Current environment uses ~%zu bytes\n", env_size);
    printf("Available for argv: ~%ld bytes\n", arg_max - env_size);
}
 
// Demonstrate hitting the limit
void test_arg_limit() {
    // Create a very long argument
    size_t len = 150000;  // 150KB - above MAX_ARG_STRLEN
    char *huge_arg = malloc(len);
    memset(huge_arg, 'x', len - 1);
    huge_arg[len - 1] = '\0';
    
    char *argv[] = {"echo", huge_arg, NULL};
    
    execv("/bin/echo", argv);
    
    // If we get here, exec failed
    perror("exec failed");
    printf("errno = %d\n", errno);
    // Likely E2BIG (Argument list too long)
    
    free(huge_arg);
}
 
int main() {
    check_limits();
    printf("\n");
    test_arg_limit();
    return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

# Problem: Too many files for single command
$ rm /path/to/dir/*
-bash: /bin/rm: Argument list too long
 
# Solution 1: Use find -exec (one rm per file - slow but works)
$ find /path/to/dir -type f -exec rm {} \;
 
# Solution 2: Use find with xargs (batches efficiently)
$ find /path/to/dir -type f -print0 | xargs -0 rm
 
# Solution 3: Use find -delete (fastest for deletion)
$ find /path/to/dir -type f -delete
 
# Solution 4: Loop (portable, flexible)
$ for f in /path/to/dir/*; do rm "$f"; done
 
# Why xargs works: it automatically batches arguments
# to stay under ARG_MAX, calling rm multiple times if needed
$ echo {1..1000000} | xargs echo | wc -c
# Runs multiple echo commands, each within limits

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
// CORRECT: Static array with known arguments
void correct_static() {
    char *argv[] = {
        "grep",           // argv[0]: program name
        "-i",             // case insensitive
        "-n",             // show line numbers
        "pattern",        // search pattern
        "file.txt",       // file to search
        NULL              // REQUIRED terminator
    };
    execv("/bin/grep", argv);
}
 
// CORRECT: Dynamic array construction
void correct_dynamic(int file_count, char **files) {
    // Allocate: prog name + flags + files + NULL
    int argc = 1 + 2 + file_count + 1;
    char **argv = malloc(argc * sizeof(char *));
    
    int i = 0;
    argv[i++] = "grep";
    argv[i++] = "-i";
    argv[i++] = "-n";
    
    for (int j = 0; j < file_count; j++) {
        argv[i++] = files[j];  // Careful: these must persist until exec
    }
    argv[i] = NULL;  // Terminate
    
    execv("/bin/grep", argv);
    // Only reached on failure; remember to free
    free(argv);
}
 
// CORRECT: Building argument strings dynamically
void correct_dynamic_strings() {
    char *argv[10];
    int i = 0;
    
    argv[i++] = "myprogram";
    
    // Dynamically build a flag argument
    int verbose_level = 3;
    char verbose_flag[20];
    snprintf(verbose_flag, sizeof(verbose_flag), "--verbose=%d", verbose_level);
    argv[i++] = verbose_flag;  // Must remain in scope until exec!
    
    // Use strdup for dynamic lifetime
    char *port_flag = NULL;
    asprintf(&port_flag, "--port=%d", 8080);  // GNU extension
    argv[i++] = port_flag;  // Dynamically allocated, persists
    
    argv[i] = NULL;
    
    execv("/path/to/myprogram", argv);
    
    free(port_flag);  // Only on failure
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

#include <unistd.h>
#include <stdio.h>
 
// MISTAKE 1: Forgetting NULL terminator
void mistake_no_null() {
    char *argv[] = {"ls", "-l"};  // Missing NULL!
    execv("/bin/ls", argv);
    // UNDEFINED BEHAVIOR: kernel reads past array bounds
}
 
// MISTAKE 2: Using string literal as argv[0] and modifying
void mistake_modify_literal() {
    char *argv[] = {"ls", "-l", NULL};
    argv[0][0] = 'L';  // CRASH: modifying read-only string literal
    execv("/bin/ls", argv);
}
 
// MISTAKE 3: Dangling pointer from inner scope
void mistake_dangling() {
    char *argv[10];
    int i = 0;
    
    {
        char buffer[100];
        snprintf(buffer, sizeof(buffer), "--port=%d", 8080);
        argv[i++] = buffer;  // DANGER: buffer goes out of scope!
    }  // buffer destroyed here
    
    argv[i++] = "other_arg";
    argv[i] = NULL;
    
    execv("/path/to/prog", argv);  // argv[0] points to garbage!
}
 
// MISTAKE 4: Not handling exec failure properly
void mistake_no_error() {
    char *argv[] = {"ls", "-l", NULL};
    execv("/bin/ls", argv);
    // If exec fails, we continue running!
    // Could lead to security issues or logic bugs
    printf("This runs if exec failed!\n");
}
 
// MISTAKE 5: Passing mutable static to multiple threads (if multi-threaded)
void mistake_shared_argv() {
    static char *argv[] = {"prog", NULL, NULL};
    argv[1] = "something";  // NOT thread-safe!
    execv("/path/prog", argv);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
 
// Basic manual parsing
int main(int argc, char *argv[]) {
    // Default values
    int verbose = 0;
    const char *output = "stdout";
    const char *input = NULL;
    
    // Parse arguments
    for (int i = 1; i < argc; i++) {
        if (strcmp(argv[i], "-v") == 0 || 
            strcmp(argv[i], "--verbose") == 0) {
            verbose = 1;
        }
        else if (strcmp(argv[i], "-o") == 0) {
            if (i + 1 < argc) {
                output = argv[++i];  // Consume next argument as value
            } else {
                fprintf(stderr, "Error: -o requires a filename\n");
                return 1;
            }
        }
        else if (strncmp(argv[i], "--output=", 9) == 0) {
            output = argv[i] + 9;  // Skip prefix
        }
        else if (argv[i][0] == '-') {
            fprintf(stderr, "Unknown option: %s\n", argv[i]);
            return 1;
        }
        else {
            // Positional argument
            input = argv[i];
        }
    }
    
    // Use parsed values
    printf("verbose: %d\n", verbose);
    printf("output: %s\n", output);
    printf("input: %s\n", input ? input : "(none)");
    
    return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <getopt.h>
 
void print_usage(const char *progname) {
    fprintf(stderr, "Usage: %s [options] <input_file>\n", progname);
    fprintf(stderr, "Options:\n");
    fprintf(stderr, "  -h, --help          Show this help\n");
    fprintf(stderr, "  -v, --verbose       Enable verbose output\n");
    fprintf(stderr, "  -o, --output=FILE   Write output to FILE\n");
    fprintf(stderr, "  -n, --count=NUM     Process NUM items\n");
}
 
int main(int argc, char *argv[]) {
    // Default values
    int verbose = 0;
    const char *output = NULL;
    int count = 10;
    
    // Define long options
    static struct option long_options[] = {
        {"help",    no_argument,       NULL, 'h'},
        {"verbose", no_argument,       NULL, 'v'},
        {"output",  required_argument, NULL, 'o'},
        {"count",   required_argument, NULL, 'n'},
        {NULL,      0,                 NULL,  0 }
    };
    
    // Parse options
    int opt;
    while ((opt = getopt_long(argc, argv, "hvo:n:", 
                               long_options, NULL)) != -1) {
        switch (opt) {
            case 'h':
                print_usage(argv[0]);
                return 0;
            case 'v':
                verbose = 1;
                break;
            case 'o':
                output = optarg;  // optarg set by getopt
                break;
            case 'n':
                count = atoi(optarg);
                if (count <= 0) {
                    fprintf(stderr, "Error: count must be positive\n");
                    return 1;
                }
                break;
            default:  // '?' for unknown option
                print_usage(argv[0]);
                return 1;
        }
    }
    
    // Remaining arguments (optind points to first non-option)
    if (optind >= argc) {
        fprintf(stderr, "Error: input file required\n");
        print_usage(argv[0]);
        return 1;
    }
    
    const char *input = argv[optind];
    
    printf("Configuration:\n");
    printf("  verbose: %d\n", verbose);
    printf("  output: %s\n", output ? output : "(stdout)");
    printf("  count: %d\n", count);
    printf("  input: %s\n", input);
    
    // Handle additional positional arguments
    for (int i = optind + 1; i < argc; i++) {
        printf("  extra file: %s\n", argv[i]);
    }
    
    return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

#include <unistd.h>
#include <stdio.h>
 
/*
 * When the SHELL runs: grep "hello world" *.txt
 * The shell:
 *   1. Removes quotes → "hello world" becomes the string: hello world (with space)
 *   2. Expands *.txt → file1.txt, file2.txt, ...
 *   3. Calls exec with the processed arguments
 * 
 * When YOU call exec() directly, no shell processing happens.
 * You pass exactly what you want, including special characters.
 */
 
void exec_with_spaces() {
    // Passing argument with spaces - no quotes needed
    char *argv[] = {
        "grep",
        "hello world",  // String with space - works fine
        "file.txt",
        NULL
    };
    execv("/bin/grep", argv);
    // grep receives "hello world" as pattern - searches for that phrase
}
 
void exec_with_special_chars() {
    // All these work directly - no shell escaping needed
    char *argv[] = {
        "echo",
        "price: $100",     // $ has no special meaning to exec
        "file*.txt",       // * is literal, not glob
        "(parens)",        // Literal parentheses
        "|pipe|",          // Literal pipe character
        "a	b
c",         // Actual tab and newline characters
        NULL
    };
    execv("/bin/echo", argv);
    // Prints literally: price: $100 file*.txt (parens) |pipe| a    b
    //                                                       ^tab ^newline
}
 
void shell_processing_needed() {
    // If you WANT shell processing, you must invoke the shell
    execlp("sh", "sh", "-c", "echo *.txt", NULL);
    // Now the shell will expand *.txt before running echo
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
// Pattern 1: Forward all arguments to another program
void forward_all(int argc, char *argv[]) {
    // Simply replace program name, keep rest of argv
    argv[0] = "real_program";
    execv("/path/to/real_program", argv);
    perror("exec failed");
}
 
// Pattern 2: Forward arguments after processing some
void forward_remaining(int argc, char *argv[], int first_to_forward) {
    // Build new argv starting from specified index
    char **new_argv = malloc((argc - first_to_forward + 2) * sizeof(char*));
    
    new_argv[0] = "target_program";
    for (int i = first_to_forward; i < argc; i++) {
        new_argv[i - first_to_forward + 1] = argv[i];
    }
    new_argv[argc - first_to_forward + 1] = NULL;
    
    execv("/path/to/target_program", new_argv);
    free(new_argv);
}
 
// Pattern 3: Insert additional arguments
void add_arguments(int argc, char *argv[]) {
    // Original command: wrapper file1 file2
    // We want:         real_program --verbose --log=debug file1 file2
    
    int extra_args = 2;
    char **new_argv = malloc((argc + extra_args + 1) * sizeof(char*));
    
    new_argv[0] = "real_program";
    new_argv[1] = "--verbose";
    new_argv[2] = "--log=debug";
    
    // Copy original arguments (skipping argv[0])
    for (int i = 1; i < argc; i++) {
        new_argv[i + extra_args] = argv[i];
    }
    new_argv[argc + extra_args] = NULL;
    
    execv("/path/to/real_program", new_argv);
    free(new_argv);
}
 
// Pattern 4: Wrapper that processes flags then forwards
int main(int argc, char *argv[]) {
    // Process our own flags, then forward the rest
    int verbose = 0;
    int forward_start = 1;
    
    while (forward_start < argc && argv[forward_start][0] == '-') {
        if (strcmp(argv[forward_start], "--wrapper-verbose") == 0) {
            verbose = 1;
            forward_start++;
        } else if (strcmp(argv[forward_start], "--") == 0) {
            forward_start++;  // Skip the '--'
            break;  // Everything after is for child
        } else {
            break;  // Unknown flag - belongs to child
        }
    }
    
    if (verbose) {
        fprintf(stderr, "Wrapper running in verbose mode\n");
        fprintf(stderr, "Forwarding %d arguments to child\n", 
                argc - forward_start);
    }
    
    // Forward remaining arguments
    forward_remaining(argc, argv, forward_start);
    
    return 1;  // Only reached on exec failure
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

#include <stdio.h>
#include <string.h>
#include <libgen.h>  // for basename()
 
// Individual tool implementations
int cat_main(int argc, char *argv[]) {
    printf("[cat implementation would run here]\n");
    return 0;
}
 
int echo_main(int argc, char *argv[]) {
    for (int i = 1; i < argc; i++) {
        printf("%s%s", argv[i], (i < argc - 1) ? " " : "\n");
    }
    return 0;
}
 
int ls_main(int argc, char *argv[]) {
    printf("[ls implementation would run here]\n");
    return 0;
}
 
// Dispatch table
struct applet {
    const char *name;
    int (*main)(int, char**);
};
 
static const struct applet applets[] = {
    {"cat",  cat_main},
    {"echo", echo_main},
    {"ls",   ls_main},
    {NULL,   NULL}
};
 
int main(int argc, char *argv[]) {
    // Get just the filename, not the path
    // "/usr/bin/cat" → "cat"
    // "./echo" → "echo"
    char *name = basename(argv[0]);
    
    // Handle "multicall <applet> <args>" invocation
    if (strcmp(name, "multicall") == 0 && argc > 1) {
        name = argv[1];
        argc--;
        argv++;
    }
    
    // Find and run the applet
    for (const struct applet *a = applets; a->name; a++) {
        if (strcmp(name, a->name) == 0) {
            return a->main(argc, argv);
        }
    }
    
    // Unknown applet
    fprintf(stderr, "Unknown applet: %s\n", name);
    fprintf(stderr, "Available: cat, echo, ls\n");
    return 1;
}
 
/*
Setup:
$ gcc -o multicall multicall.c
$ ln -s multicall cat
$ ln -s multicall echo
$ ln -s multicall ls
 
Usage:
$ ./cat file.txt        # Runs cat_main via symlink
$ ./echo hello world    # Runs echo_main via symlink
$ ./multicall ls -la    # Runs ls_main via direct call
 
All three symlinks point to the same binary, saving disk space
while providing multiple commands.
*/

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

#include <unistd.h>
#include <stdio.h>
#include <string.h>
 
void demonstrate_null_problem() {
    // This argument is truncated at the null byte
    char arg[] = "hello\0world";
    // Despite containing "hello\0world" in memory,
    // strlen(arg) returns 5, and exec sees only "hello"
    
    char *argv[] = {"echo", arg, NULL};
    execv("/bin/echo", argv);
    // echo receives "hello", not "hello\0world"
}
 
void workaround_with_encoding() {
    // If you need to pass binary data with null bytes,
    // you must encode it (base64, hex, etc.)
    
    // Original data: "hello\0world" (12 bytes including both nulls)
    char *encoded = "aGVsbG8Ad29ybGQA";  // base64 encoded
    
    char *argv[] = {"decoder_program", encoded, NULL};
    execv("/path/to/decoder_program", argv);
    // decoder_program can base64-decode to get original bytes
}
 
// For arbitrary binary data, file-based communication works
void pass_binary_via_file() {
    // Write binary data to temp file
    FILE *f = fopen("/tmp/binary_data", "wb");
    char data[] = {'h', 'e', 'l', 'l', 'o', '\0', 'w', 'o', 'r', 'l', 'd'};
    fwrite(data, 1, sizeof(data), f);
    fclose(f);
    
    // Tell the child where to find it
    char *argv[] = {"processor", "--input=/tmp/binary_data", NULL};
    execv("/path/to/processor", argv);
}
 
// Or use pipes/file descriptors
void pass_binary_via_pipe() {
    int pipefd[2];
    pipe(pipefd);  // Create pipe
    
    if (fork() == 0) {
        // Child: reads from pipe
        close(pipefd[1]);  // Close write end
        dup2(pipefd[0], STDIN_FILENO);  // Pipe → stdin
        close(pipefd[0]);
        execlp("some_program", "some_program", NULL);
        _exit(1);
    }
    
    // Parent: writes binary data to pipe
    close(pipefd[0]);  // Close read end
    char data[] = {'h', 'e', 'l', 'l', 'o', '\0', 'w', 'o', 'r', 'l', 'd'};
    write(pipefd[1], data, sizeof(data));
    close(pipefd[1]);  // Signal EOF
    
    // Wait for child... (omitted)
}