ropshell> use 0a2391c58b1ba096bb08006817b606ae (download)
name         : babyrop_level6.0 (x86_64/ELF)
base address : 0x4011f0
total gadgets: 51

ropshell> suggest
call
    > 0x004022aa : call [rdi + rbx*8]
    > 0x004022a9 : call [r15 + rbx*8]
    > 0x004014cc : call [rax - 0x179a72b8]; pop rbx; pop r12; pop r13; pop rbp; ret
jmp
    > 0x0040124c : jmp rax
load reg
    > 0x00402077 : pop rcx; ret
    > 0x00402067 : pop rdx; ret
    > 0x0040205f : pop rsi; ret
    > 0x0040206f : pop rdi; ret
    > 0x004012bd : pop rbp; ret
pop pop ret
    > 0x004022c2 : pop r15; ret
    > 0x004014d5 : pop r13; pop rbp; ret
    > 0x004014d3 : pop r12; pop r13; pop rbp; ret
    > 0x004022bc : pop r12; pop r13; pop r14; pop r15; ret
    > 0x004022bb : pop rbp; pop r12; pop r13; pop r14; pop r15; ret
stack pivoting
    > 0x004014ce : lea rsp, [rbp - 0x18]; pop rbx; pop r12; pop r13; pop rbp; ret
    > 0x004014cf : lea esp, [rbp - 0x18]; pop rbx; pop r12; pop r13; pop rbp; ret
    > 0x004016cb : leave ; ret