What You Will Learn

• Why a function must occupy memory, and what its address means
• How to obtain the function address in C using only the function name
• The correct, portable way to print a function address on modern systems
• Why the printed numbers change between runs on Linux but stay fixed on a microcontroller
• How to find function addresses with the nm tool

Prerequisites

You should know how functions are defined and called (the Functions chapter), what a pointer and an address are, and how to compile with gcc. If needed, go back through the earlier lectures of this free C tutorial.

Why Every Function Has an Address

When you compile a program, each function is translated into machine instructions. Those instructions must live somewhere in memory when the program runs: in the code section of an executable on Linux, or in flash memory on a microcontroller. The CPU executes a function by loading the address of its first instruction into the program counter. A function call is therefore nothing more than “jump to that address, and remember where to come back”.

Getting a Function Address in C

The rule is easy: write the function name without parentheses. With parentheses you call the function; without them you get its address. This is similar to an array name, which also turns into an address when used in an expression. Writing &led_on with the address-of operator gives the same value, and both forms are legal.

Expression	Meaning
led_on()	Call the function
led_on	Address of the function
&led_on	Also the address of the function (same value)
*led_on	Also the same function designator again

Complete Example: Printing Function Addresses

Save this as func_addr.c. It prints the addresses of three functions and then uses a variable to hold one of them.

#include <inttypes.h>
#include <stdint.h>
#include <stdio.h>

static void led_on(void)
{
    puts("LED on");
}

static void led_off(void)
{
    puts("LED off");
}

int main(void)
{
    printf("address of main   : %#" PRIxPTR "\n", (uintptr_t)main);
    printf("address of led_on : %#" PRIxPTR "\n", (uintptr_t)led_on);
    printf("address of led_off: %#" PRIxPTR "\n", (uintptr_t)led_off);

    void (*handler)(void) = led_on;     /* name alone is the address */
    void (*handler2)(void) = &led_on;   /* explicit & gives the same value */
    printf("handler == handler2: %d\n", handler == handler2);

    led_on();
    led_off();
    handler();                          /* call through the pointer */
    return 0;
}

Build and Run

$ gcc -std=c11 -Wall -Wextra -Wpedantic -o func_addr func_addr.c
$ ./func_addr
address of main   : 0x55b4883df19d
address of led_on : 0x55b4883df169
address of led_off: 0x55b4883df183
handler == handler2: 1
LED on
LED off
LED on

Your hexadecimal numbers will not match these, and that is expected. The last line shows the interesting part: handler() printed “LED on” because the variable holds the address of led_on, and calling through it runs that function.

Why the Output Differs Between Runs

Modern Linux distributions build programs as position-independent executables and randomise where they are loaded (ASLR). The start of the program moves each time, but the distance between two functions inside the same program never changes. Run it twice and you will see different upper digits but the same last three digits, such as 169, 183 and 19d. If you want fixed addresses for experiments, build without PIE:

$ gcc -std=c11 -no-pie -o func_addr func_addr.c
$ ./func_addr
address of main   : 0x40118a
address of led_on : 0x401156
address of led_off: 0x401170
...
$ nm func_addr | grep -E ' (main|led_on|led_off)$'
0000000000401170 t led_off
0000000000401156 t led_on
000000000040118a T main

The symbol table agrees with the program. A lowercase t means a function with internal linkage (static); an uppercase T is a global one. On an ARM microcontroller you would run arm-none-eabi-nm on the ELF file, or read the linker map, to get the same information.

Printing the Address Correctly

Older books print function addresses with %u. That was acceptable on 16-bit and some 32-bit systems, but on a 64-bit machine an address does not fit in an unsigned int, so the output is truncated or undefined. Use one of the following instead.

Approach	Notes
(uintptr_t)fn with PRIxPTR	Used in this lecture. Standard C, no warnings with strict flags.
%p with (void *)fn	Works on common platforms and is required to work on POSIX systems, but ISO C does not guarantee it, so -Wpedantic may warn.
%u or %d	Wrong on 64-bit targets. Avoid.

Function Addresses in Embedded C Programming

This topic is not an academic curiosity. On a microcontroller, function addresses are everywhere:

• Interrupt vector table: an array in flash whose entries are the addresses of the reset handler and all interrupt service routines. When an interrupt fires, the hardware reads the matching entry and jumps there.
• Callbacks: a driver stores the address of a function supplied by the application and calls it when data arrives.
• State machines and command tables: each state or command maps to the address of its handler.
• Bootloaders: after verifying an application image, the loader reads a stored address and jumps to it.

Reading a Function Address in C from the Linker Map

When you build firmware for a microcontroller, the linker can produce a map file that lists every function and its final address. Open it and search for a function name, for example your timer interrupt handler. The number you find there is the same function address in C that your program would print, because both come from the same link step. Comparing the two is a quick way to confirm that the handler really ended up in the memory region you planned, such as flash for normal code or a fast RAM region for time-critical routines.

The same habit helps on Linux. If a crash report shows a faulting address, subtract the load base and look the offset up with nm or addr2line. Understanding that a function address in C is just a number that maps to a symbol is the first step towards reading stack traces and fault registers with confidence.

Common Mistakes with a Function Address in C

Mistake	Result	Fix
Writing handler = led_on();	Calls the function and stores its (void) result; compile error here	Drop the parentheses to store the address
Printing with %u	Truncated or wrong output on 64-bit	Use uintptr_t and PRIxPTR
Comparing addresses between two runs	Confusion due to ASLR	Compare offsets, or use -no-pie
Doing arithmetic on a function address	Undefined and non-portable	Treat it as an opaque value
Converting between function and data pointers casually	Not guaranteed by ISO C	Keep function pointers as function pointers

Best Practices and Security Notes

• Use function names without parentheses to get addresses, and keep them in properly typed pointer variables (next lecture).
• Print addresses only for debugging. Logging them in production helps attackers defeat ASLR.
• Use static for functions that are only used inside one file, as we did with led_on.
• Use nm, objdump -d or the linker map to cross-check what you see at run time.
• On small devices, place frequently-called handlers in the correct memory region using the linker script, but only when measurements show a need.

Summary and Key Takeaways

• Every function occupies memory and therefore has an address.
• Writing the function name without parentheses gives that address.
• Print it with uintptr_t and PRIxPTR, not %u.
• On Linux the base address moves with every run, but offsets between functions stay constant.
• Vector tables, callbacks and state machines in embedded C programming are all built on function addresses.

Now that you can get a function address in C, the next lecture shows how to store it properly: you will declare a variable of pointer-to-function type, assign an address to it, and call a function through it. Keep going with this free C tutorial to learn C programming for embedded systems.

Frequently Asked Questions

How do I get the address of a function in C?

Use the function name without parentheses, or the address-of operator with the name. Both give the same address.

Why do function addresses change every time I run my program?

Linux loads position-independent executables at a random base address for security. Distances between functions remain constant.

Can I print a function address with %p?

On most systems yes, after casting to void pointer. ISO C does not guarantee the conversion, so converting to uintptr_t and using PRIxPTR is the strictly portable choice.

What is stored in an interrupt vector table?

The addresses of the exception and interrupt handler functions. The CPU reads the entry for the active interrupt and jumps to that address.

Are function addresses the same on a microcontroller?

They are fixed by the linker script and the build, so they do not move between runs. On Cortex-M a Thumb function address also has its lowest bit set.

What is the difference between led_on and led_on()?

The first is the address of the function; the second calls the function and produces its return value.