Unwinding the Stack for Fun and Profit
summary
Claims that exception unwinding can be hijacked to restore return-based exploits using a technique called Chop (Handler Oriented Programming), which corrupts return addresses so the unwinder invokes another catch or cleanup handler. Large-scale analysis of ~3,000 Debian binaries finds ~10% use exceptions, about half have ≥40% throwing functions, ~80% expose controllable free gadgets and ~50% expose fully controllable write gadgets. Demonstrated exploit targets libraw EXIF parsing to pivot into ROP and spawn a shell (golden Gadget, libraw exploit).
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:30Control Flow Hijacking
- 9:00Control local variables
- 11:33Abuse the chop
- 21:53Summary
- 26:58Review
- 30:48Demo
- 32:21Recap
