ropshell> use 6a6713c481767e299c1940faecd5a173 (download)
name         : libc-2.19.so (i386/ELF)
base address : 0x17490
total gadgets: 16772

ropshell> suggest
call
    > 0x00019af2 : call eax
    > 0x0001fabc : call ebx
    > 0x000332b1 : call ecx
    > 0x0001b187 : call edx
    > 0x00019a68 : call esi
jmp
    > 0x00125c36 : push esp; ret
    > 0x0001a930 : jmp eax
    > 0x0007bbb4 : jmp ebx
    > 0x0004d326 : jmp ecx
    > 0x0002c811 : jmp edx
load mem
    > 0x0006c4f7 : mov eax, [edx]; ret
    > 0x0001b5fb : mov eax, [ecx + 0x3664]; ret
    > 0x000c56b7 : mov eax, [edx + 8]; pop ebx; pop esi; ret
    > 0x000fbacf : mov ebp, [ecx + 0xc]; jmp edx
    > 0x00137bc2 : mov ecx, [eax]; mov [edx], ecx; pop ebx; ret
load reg
    > 0x00024628 : pop eax; ret
    > 0x0001991e : pop ebx; ret
    > 0x00053c33 : pop ecx; ret
    > 0x0002dca8 : pop edx; ret
    > 0x00019676 : pop esi; ret
pop pop ret
    > 0x00024628 : pop eax; ret
    > 0x00140a0b : pop ebp; pop ebx; ret
    > 0x000a7177 : pop eax; pop edi; pop esi; ret
    > 0x000301ba : pop eax; pop ebx; pop esi; pop edi; ret
    > 0x0001d4e8 : pop esp; pop ebx; pop esi; pop edi; pop ebp; ret
sp lifting
    > 0x0007b8d1 : add esp, 0x100; ret
    > 0x0007b8d1 : add esp, 0x100; ret
    > 0x0001a5cf : add esp, 0x24; ret
    > 0x000daee2 : add esp, 0x3c; ret
    > 0x00118d15 : add esp, 0x4c; ret
stack pivoting
    > 0x00035064 : xchg eax, esp; ret
    > 0x0002e2ed : mov esp, ecx; jmp edx
    > 0x00117b5a : lea esp, [ebp - 8]; pop ebx; pop edi; pop ebp; ret
    > 0x0012b31b : xchg esp, ebx; add eax, [eax]; add ebx, [ebx + ecx*4]; add edx, ecx; jmp ebx
    > 0x00127cea : mov esp, esi; dec [ebp + 0x468b0076]; dec esp; mov [esp], esi; call [eax + 0x44]
syscall
    > 0x000b8035 : call gs:[0x10]; ret
    > 0x000ec381 : int 0x80; pop ebp; pop edi; pop esi; pop ebx; ret
write mem
    > 0x0009571c : add [eax], edx; ret
    > 0x0009573c : add [eax], esi; ret
    > 0x00089891 : add [eax + 0x5f028d02], ecx; ret
    > 0x0008b3a5 : add [ebx + 0x5b5fffd8], eax; ret
    > 0x00108074 : adc [esi + 0x5f], ebx; ret