RSI = 0x1337beef RSP -> 0xffff0028: 0x400d00 // where we want the rsi gadget's ret to jump to now that rdi and rsi are controlled In this case however, we have a very convenient name Integral which will be at a known location in the binary (in the BSS segment). https://ropa-a-juego-familia90011.nico-wiki.com/821068/la_mejor_parte_de_ropa_familia_a_juego