64-bit ret2libc: Arguments Go in Registers (System V)

• On x86-64, the first six integer/pointer args are passed in registers, not on the stack: RDI, RSI, RDX, RCX, R8, R9
• So system("/bin/sh") needs RDI = &"/bin/sh" before we call system.
• A plain "return into system" no longer works — nothing sets RDI for us.
• We need a gadget that loads RDI from the stack, typically: pop rdi ; ret
• This is the doorway from ret2libc into full ROP.