About "We need to add a ret instruction because the stack is misaligned" in Pwn-Labyrinth about writeups HOT 2 CLOSED

Thank you for your kind words and your question. I'm glad that you found my write-up helpful.

To answer your question,
Some versions of GLIBC uses movaps instructions to move data onto the stack in certain functions. The 64 bit calling convention requires the stack to be 16-byte aligned before a call instruction but this is easily violated during ROP chain execution, causing all further calls from that function to be made with a misaligned stack. movaps triggers a general protection fault when operating on unaligned data, so try padding your ROP chain with an extra ret before returning into a function or return further into a function to skip a push instruction (Reference).

I hope that helps! Let me know if you have any further questions.

from writeups.

I hope that helps! Let me know if you have any further questions.

from writeups.