A gadget is a couple of instructions already sitting in the program, ending in ret. No new code gets injected — you just point RIP at bits of code that already exist.
Each gadget's own ret doesn't return to a caller — it pops the next address YOU planted on the stack and jumps there. That's how gadgets chain into a tiny program.
Gadget chain in this exploit
🧠 Registers
Flags
ZF zero
SF sign
—
Press "Next" to begin.
🗺️ Memory Layout
Code
Data
Heap
Stack
📚 Stack
RBP
RSP
char buffer[32]; lives on the stack, right below Saved RBP and the
Return Address. Type below. Keep typing past 32 characters and watch what happens.
0/32 bytes in buffer
RIP after RET
0x0000000000000000
Every run, the OS loads this binary at a random base address (ASLR + PIE). Leak one address, then do the math.
int x = 5; int *p = &x; — p does not store 5. It stores the ADDRESS of the box that stores 5.