Why the Program Must Loop Back
- The leak in Stage 1 only becomes useful after you read it and recompute — but by then your first ROP chain has run.
- So the standard pattern ends Stage 1 by returning to 0 (or to a vulnerable read loop), giving you a second chance to send a fully-computed payload.
- Stage 2 uses the now-known libc addresses to build a real
system("/bin/sh")chain or GOT overwrite. - This is why you often see
ret2mainor two calls to the same overflow in real chains.
Key Takeaway
One interaction leaks; the next interaction wins. Structure your script as leak, then re-attack with computed addresses.