dlopen is a dynamically linked function, so they would have to find that too. Its location will also be randomized. Note we are talking about exploit code here

dlopen is a dynamically linked function, so they would have to find that too. Its location will also be randomized. Note we are talking about exploit code here, i.e. you have just exploited a buffer overflow, not ELF code loaded in a well behaved fashion.