stack unwinding can lead to leakless code execution

The stack unwinding process can lead to leakless code execution. Enzo Cut, after seeing a writeup from a challenge, shared a solution involving byte swapping relative to the stack. This allowed unvariant to control arguments to the read function. The read function is a POSIX cancellation point, which means it can be postponed until the next cancellation point, such as when a thread is canceled using pthread_cancel.

However, canceling a thread is complicated, particularly if the thread has C++ objects allocated on its stack. Destructing these objects is not a simple task, as it may involve running destructors, which could leave file descriptors open or mutexes locked. To circumvent this complexity, unvariant employed a technique known as a "forced unwind" or "forced stack unwinding".

By hijacking the DWARF (Debugging With Aid Of Runtime Frame) VM and manipulating the .eh_frame_hdr section, it was possible to control the contents of a large malloc and perform out-of-bounds null byte writes. These two primitives enabled the attacker to execute arbitrary code, even in a sandboxed environment where traditional methods like one_gadget or system() calls may not be feasible.