cpivvDb4lWUmhqgECpIhd9EY6Lc8dlDAfTknAE6nOL+kRz+Ii5aLg ZxdiJiCRuhagHZqb8m34CSoC24c4fUGkWFGcmEPd0nIUA5J0oG3Orqhebq0vTRqEQkizXQzksgOn rHZl/8Apf1h88pTLQ0yK9jf7kimaEl5tiOVHuuNfbn0tQOf/QvmA3GEcIpnnWTz7+q5tGhfKDJaj Gcsl9guyHn6I0p4e49YxuakG5EANZ056B2HVUC+ASKhEbeRW5bNawbCQpFMb8...
NGTww0EnuZiJpITSbpI56IX2wI47nAdl05pFyYcnJbUjptZEkql+GJqgbFQ5aXVRA6XLSTqgSna8 P107KExsKjTCtC3sFHgVlLLJ/ptY5ESqBS0UUUD4ButTh8cXZ5bIysqowvIiRHpZmVg9swbHHl0b ApWbIYlOOTrMsTA4EVH9XbAVtCbEloPZNvCckcUCdOeS9sAmuAYNXtwhTfRsjCF4Y/NBvkysyIvZ H+IKVB8immak2h21dCkP20RFxAjPrhbdiT61hcfAOORE9...
(it would otherwise crash into the beginning of the heap, because the stack grows down): "ret 0xffb8;" - the third gadget that we execute, 0x401100, calls _dl_runtime_resolve() and _dl_fixup() with our own "relocarg" (this effectively calls system() with the command located at ...