The call / ret Mechanism

• call target does two things atomically:

push rip_of_next_instruction   ; save return address
jmp  target                    ; transfer control

• ret reverses it:

pop  rip     ; take return address off the stack, jump back

• The return address is the single most important value on the stack for exploitation.
• If an attacker overwrites it, ret jumps wherever they choose.