ropshell> use 147134e164e0d8e0d405a4bc5f1fa8af (download)
name         : SERVER.exe (i386/PE)
base address : 0x10471000
total gadgets: 4587

ropshell> suggest "stack pivoting"
> 0x1049b470 : xchg eax, esp; ret
> 0x104c1fb9 : mov esp, ecx; ret
> 0x104bffd3 : mov esp, ebx; pop ebx; ret
> 0x10476d0a : mov esp, ebp; pop ebp; ret
> 0x104bf449 : lea esp, [esp]; ret
> 0x104b6f83 : lea esp, [eax + 0xbfffff8]; ret
> 0x10485938 : lea esp, [ebx + edi*8 - 0x3f170001]; ret
> 0x104aa862 : xchg esp, edi; call [eax + 0x6a]
> 0x10477511 : leave ; ret