ropshell> use 911ddf2e16761643a47225f654d811e5 (download)
name         : ntdll.dll (i386/PE)
base address : 0x7c901000
total gadgets: 6968

ropshell> search xchg esp %
found 2 gadgets
> 0x7c975809 : xchg esp, edx; add [eax], al; add [ebx], bh; ret
> 0x7c94f924 : xchg esp, esi; sar ch, 1; jmp [ebx]