0x7000 · Exploitation Techniques
ret2csu: Borrowing the Runtime's Universal Gadget
No pop rdx gadget? The C runtime's startup code has a universal sequence that loads several registers and makes a controlled call. Build it with pwntools, and see where it's gone.