ret2win Technique

Updated 13 Sep 2026

•
What it is
- •
  Overwrite a saved return address to redirect execution to an existing useful function, such as win(). Because the destination is existing code, injected shellcode is unnecessary.
•
How it works
- •
  Find the offset from the buffer start to the saved return address (see Stack Frame Layout, or a cyclic pattern).
- •
  Find the target function's address — trivial if the binary isn't PIE (address is fixed and visible via nm/objdump, or auto-resolved by pwntools if the binary is unstripped).
- •
  Overflow the buffer with padding up to the offset, then the target address packed little-endian (p64(...)).
- •
  On return, the function's epilogue pops the corrupted "return address" into rip and jumps straight there instead of back to the real caller.
•
When to use it
- •
  A reachable return-address overwrite and a useful existing function make ret2win possible; a canary must be preserved or bypassed if crossed.
- •
  A non-PIE binary commonly has a fixed code address. With PIE, establish the runtime target using a leak or a valid partial overwrite.
•
Examples
- •
  With a known 56-byte offset and win address: b'A' * 56 + p64(win).
- •
  A guarded win_authed() may allow a jump past its check, but first verify the landing instruction and required stack/register state.

pwntools

elf = ELF('./vuln')
payload = b'A' * offset + p64(elf.sym['win'])  # Requires a known runtime address.