TL;DR: Search for rop gadgets in random chunk, set registers, and raise execve syscall.
[https://github.com/fab1ano/square-20/tree/master/jimi-jamming](https://github.com/fab1ano/square-20/tree/master/jimi-jamming)