TL;DR: Search for rop gadgets in random chunk, set registers, and raise execve syscall.

[https://github.com/fab1ano/square-20/tree/master/jimi-jamming](https://github.com/fab1ano/square-20/tree/master/jimi-jamming)

Original writeup (https://github.com/fab1ano/square-20/tree/master/jimi-jamming).