ropshell> use 85c35a73ee353a8dda7ec1ab8e7012c6 (download)
name         : ch21 (i386/ELF)
base address : 0x8048460
total gadgets: 30

ropshell> suggest
call
    > 0x0804852f : call eax
load reg
    > 0x08048503 : pop ebp; ret
    > 0x08048502 : pop ebx; pop ebp; ret
    > 0x08048737 : pop edi; pop ebp; ret
    > 0x08048736 : pop esi; pop edi; pop ebp; ret
    > 0x0804873a : mov ebx, [esp]; ret
pop pop ret
    > 0x08048503 : pop ebp; ret
    > 0x08048502 : pop ebx; pop ebp; ret
    > 0x08048736 : pop esi; pop edi; pop ebp; ret
    > 0x08048735 : pop ebx; pop esi; pop edi; pop ebp; ret
stack pivoting
    > 0x080484a8 : leave ; ret
write mem
    > 0x080484fe : add [ebx + 0x5d5b04c4], eax; ret