RSI = 0x1337beef RSP -> 0xffff0028: 0x400d00 // where we want the rsi gadget's ret to jump to now that rdi and rsi are controlled In this case however, we have a very convenient name Completo which will be at a known location in the binary (in the BSS segment). https://paxtonmjueo.wikimidpoint.com/4140080/examine_este_informe_sobre_ropa_a_juego_familia