ropshell> use 0252f4bc9558505f6d1da5678b109f95 (download)
name         : final0 (i386/ELF)
base address : 0x8048cb0
total gadgets: 47

ropshell> suggest
call
    > 0x08048d5f : call eax
    > 0x080493d4 : call [ebp - 0x77]
jmp
    > 0x08049174 : jmp [esi - 0x77]
load reg
    > 0x08048d33 : pop ebp; ret
    > 0x08048d32 : pop ebx; pop ebp; ret
    > 0x08049907 : pop edi; pop ebp; ret
    > 0x08049906 : pop esi; pop edi; pop ebp; ret
    > 0x0804990a : mov ebx, [esp]; ret
pop pop ret
    > 0x08048d33 : pop ebp; ret
    > 0x08048d32 : pop ebx; pop ebp; ret
    > 0x08049906 : pop esi; pop edi; pop ebp; ret
    > 0x08049905 : pop ebx; pop esi; pop edi; pop ebp; ret
stack pivoting
    > 0x08049922 : xchg eax, esp; lodsb al, [esi]; add al, 8; nop ; sub ebx, 4; call eax
    > 0x08048d61 : leave ; ret
write mem
    > 0x08048d2e : add [ebx + 0x5d5b04c4], eax; ret