Indirect Calling of Nested Functions on GCC Without Executable Stack

The article shows how to invoke GCC nested functions without relying on an executable-stack trampoline by extracting the static-chain and code pointers from the generated trampoline and calling the target with __builtin_call_with_static_chain. This technique works on older GCC versions, and after use the stack can be marked non-executable via patchelf --clear-execstack.