•DTOR aka
the Destructor section of the code is called at exit of a program, all elf32 file format
programs have them
•If you can insert the shellcode address into .dtors, you can
get your shellcode to execute
•nm
./fmtstr | grep DTOR
•objdump
-s -j .dtors ./fmtstr