ropshell> use 18403538a12facf8aced1dcfcccef1ba (download)
name         : libcrypto.so.1.0.0 (x86_64/ELF)
base address : 0x61e00
total gadgets: 13436

ropshell> suggest "stack pivoting"
> 0x00062317 : xchg eax, esp; ret
> 0x000f3488 : lea rsp, [r10 - 8]; ret
> 0x000f3489 : lea esp, [rdx - 8]; ret
> 0x000669f0 : lea esp, [rbp - 1]; call rax
> 0x00155708 : push rsp; sub edi, ebp; dec [rcx + 0x415d5bd8]; pop rsp; ret
> 0x001694b1 : mov esp, eax; mov eax, r12d; pop rbx; pop rbp; pop r12; ret
> 0x0017ecb1 : mov esp, ebx; mov rax, r12; pop rbx; pop rbp; pop r12; ret
> 0x000b2da9 : mov esp, edx; mov rdx, rax; call r13
> 0x000b4f8d : mov esp, esi; mov rsi, r13; call r14
> 0x000c022a : push rdx; sbb al, [rip - 0x3b7cb800]; or [rcx + 0x415d5be8], cl; pop rsp; pop r13; ret
> 0x000df5c6 : mov esp, edi; movsxd rax, [rsi + rcx*4]; add rax, rsi; jmp rax
> 0x000b5991 : lea esp, [rsp + 0x20]; mov [rsp + 0x18], r8; mov rdx, [rsp]; mov rdi, rbx; mov rsi, r12; call r14
> 0x00125cb3 : mov esp, ecx; xor [rax], eax; lea rdx, [rip + 0x2ff6c2]; test [rax + 7], 2; lea rax, [rip + 0x2ff717]; cmove rax, rdx; ret
> 0x00167b93 : leave ; ret