2byte canary A ret_aaddress C XOR 2 byte random num B B Cret_aaddress B C 2byte canary A 2 byte random num B C XOR