ropshell> use a2c449286604d015b8755793c929120a (download)
name         : ntdll.dll (x86_64/PE)
base address : 0x180001000
total gadgets: 6419

ropshell> suggest
call
    > 0x1800781f3 : call rax
    > 0x18001e918 : call rbx
    > 0x180035719 : call rcx
    > 0x1800b3982 : call rbp
    > 0x180092346 : call rsp
jmp
    > 0x180014c00 : push rsp; ret
    > 0x18008e13c : jmp rax
    > 0x1800acf8d : jmp rbx
    > 0x18000ce6e : jmp rcx
    > 0x1800a307e : jmp rdx
load mem
    > 0x180072020 : movzx eax, [rcx]; ret
    > 0x180083056 : mov eax, [rcx + 0x16b0]; ret
    > 0x180103d15 : mov eax, [rdx + 0x38]; ret
    > 0x180094006 : movzx ecx, [rdx]; sub eax, ecx; ret
    > 0x18007fd40 : mov rax, [rdx]; mov [rcx], rax; ret
load reg
    > 0x180002933 : pop rax; ret
    > 0x180001090 : pop rbx; ret
    > 0x180090c15 : pop rcx; ret
    > 0x1800b5352 : pop rdx; ret
    > 0x180001146 : pop rsi; ret
pop pop ret
    > 0x18008e158 : pop r11; ret
    > 0x18008e156 : pop r10; pop r11; ret
    > 0x18002d923 : pop r12; pop rbp; pop rbx; ret
    > 0x180021d8d : pop r12; pop rdi; pop rbx; pop rbp; ret
    > 0x180012a7d : pop r12; pop rdi; pop rsi; pop rbp; pop rbx; ret
sp lifting
    > 0x1800a3d28 : add rsp, 0x10; ret
    > 0x1800a3d28 : add rsp, 0x10; ret
    > 0x18008a6df : add rsp, 0x238; ret
    > 0x1800015ab : add rsp, 0x38; ret
    > 0x180080806 : add rsp, 0x438; ret
stack pivoting
    > 0x18000d587 : xchg eax, esp; ret
    > 0x180027b36 : mov rsp, r11; pop r14; ret
    > 0x180027b37 : mov esp, ebx; pop r14; ret
    > 0x18011a0b2 : lea rsp, [rbp + 0x10]; pop rbp; ret
    > 0x1800e25dd : xchg esp, ebx; lahf ; xor eax, eax; ret
syscall
    > 0x18009eaa2 : syscall ; ret
write mem
    > 0x1800fa8bf : adc [rax], r10; ret
    > 0x1800fa8c0 : adc [rax], edx; ret
    > 0x180002c9f : add [rbx], edi; ret
    > 0x1800a5d88 : adc [rdx], eax; ret
    > 0x18007be48 : add [rdi], ecx; ret