Hijacking Control Flow

• When a function returns, ret pops the saved return address into RIP and jumps there.
• If we overwrote that saved address, ret jumps to our chosen location.
• We did not change any code — we changed where execution goes next.