RSP -> 0xffff0010: 0x400c03 // address that the rdi gadget's ret will return to - the pop rsi gadget In this case however, we have a very convenient name General which will be at a known location in the binary (in the BSS segment). ​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​�