When Gadgets Are Scarce: ret2csu

• Sometimes the binary lacks pop rsi ; ret or pop rdx ; ret, so you cannot set args 2 and 3.
• __libc_csu_init (present in most non-PIE ELF binaries before recent glibc) contains a universal gadget pair:
• a "pop many registers" epilogue (rbx, rbp, r12, r13, r14, r15),
• a body that moves those into rdi/rsi/rdx and calls [r12+...].
• By carefully choosing the popped values you control the first three arguments and the call target — enough to invoke almost any function.
• Newer toolchains drop __libc_csu_init; then you lean on libc gadgets or one_gadget instead.