RSI = 0x1337beef RSP -> 0xffff0028: 0x400d00 // where we want the rsi gadget's ret to jump to now that rdi and rsi are controlled When main returns, we want our stack to look like something had normally called system. Recall what is on the stack after a function has been called: ???????