RSI = 0x1337beef RSP -> 0xffff0028: 0x400d00 // where we want the rsi gadget's ret to jump to now that rdi and rsi are controlled In this case however, we have a very convenient name Integral which will be at a known location in the binary (in the BSS segment). https://lanefpajr.mappywiki.com/838680/conseguir_mi_rop_to_work