RSI = 0x1337beef RSP -> 0xffff0028: 0x400d00 // where we want the rsi gadget's ret to jump to now that rdi and rsi are controlled In this case however, we have a very convenient name Completo which will be at a known location in the binary (in the BSS segment). La mà d’obra