RSI = 0x1337beef RSP -> 0xffff0028: 0x400d00 // where we want the rsi gadget's ret to jump to now that rdi and rsi are controlled In this case however, we have a very convenient name Total which will be at a known location in the binary (in the BSS segment). https://paxtonalvfo.levitra-wiki.com/835092/nuevo_paso_a_paso_mapa_ropa_a_juego_familia