•DTOR aka the Destructor section of the code is called at exit of a program, all elf32 file format programs have them
•If you can insert the shellcode address into .dtors, you can get your shellcode to execute
•nm ./fmtstr | grep DTOR
•objdump -s -j .dtors ./fmtstr