RSP -> 0xffff0010: 0x400c03 // Address that the rdi gadget's ret will return to - the pop rsi gadget In this case however, we have a very convenient name Total which will be at a known location in the binary (in the BSS segment). Stage 1: Demarcation Line: This line https://ropafamilia12334.blogdomago.com/27995761/conseguir-mi-ropa-familia-a-juego-to-work