Why Overwriting Saved RIP Hijacks Control

• call foo stores the legitimate return address on the stack.
• Inside foo, a buffer overflow overwrites that stored address with an attacker-chosen value X.
• foo finishes and executes ret.
• ret pops X into RIP: the CPU now executes at X — shellcode, a libc function, or a ROP chain.