pop <reg>gadget, you can then use this
xchggadget to swap the values with the ones in RSP. Requires about 16 bytes of stack space after the saved return pointer:
main) is ended with a
leaveis equivalent to
leave. How does that help us?
leaveagain, we noticed the value in RBP gets moved to RSP! So if we call overwrite RBP then overwrite RIP with the address of
leave; retagain, the value in RBP gets moved to RSP. And, even better, we don't need any more stack space than just overwriting RIP, making it very compressed.