ropshell> use 266517f836b39b60c49844d388337f81 (download)
name         : vuln (i386/RAW)
base address : 0x0
total gadgets: 493

ropshell> suggest
call
    > 0x000049ac : call edi
    > 0x00001511 : call esp
    > 0x000014d6 : call [ebx]
    > 0x0000aee8 : call [ecx]
    > 0x0000967e : call [edx]
jmp
    > 0x000010be : jmp eax
    > 0x00001749 : jmp edx
    > 0x00003174 : jmp esi
    > 0x0000a295 : jmp [eax + eax]
    > 0x000051cb : jmp [edx - 0x1c]
load mem
    > 0x00001784 : mov eax, [ecx]; dec eax; mov [edi], eax; ret
    > 0x00004aaa : mov eax, [ebx + 0x50]; mov edx, 1; pop ebx; jmp eax
load reg
    > 0x00001001 : pop eax; ret
    > 0x00003e72 : pop ebx; ret
    > 0x0000c909 : pop edx; ret
    > 0x00004653 : pop esi; ret
    > 0x00002bca : pop edi; ret
pop pop ret
    > 0x00001001 : pop eax; ret
    > 0x000014e5 : pop ebx; pop ebp; ret
sp lifting
    > 0x000014b4 : add esp, 0x158; ret
    > 0x000014b4 : add esp, 0x158; ret
    > 0x00004241 : add esp, 0x28; ret
stack pivoting
    > 0x00001273 : leave ; ret
write mem
    > 0x0001aa29 : add [ebx], eax; ret
    > 0x00019d5a : add [ecx], eax; ret
    > 0x000045a8 : adc [edi + 0x20], eax; ret
    > 0x0000c904 : add [ebp + 0x5a00000f], esi; ret
    > 0x000042e4 : adc [eax + 1], edi; pop ebx; ret