If i remember correctly, some memory address that needs to be overridden by the exploit is randomized on startup. The only way to find it is to just write to a random address, which often fails