ropshell> use 1a01fd3e49ee5952eeef3c56c8c2ff7b (download)
name         : fotaClient (arm/ELF)
base address : 0xc4c8
total gadgets: 638

ropshell> suggest
jmpcall
    > 0x0000c794 : bx r2
    > 0x0000dfac : bx r3
    > 0x00022f71 : bx r4
    > 0x0000c848 : bx lr
    > 0x0000c824 : blx r1
load mem
    > 0x0001c4e6 : ldr r0, [r4]; pop {r3, r4, r5, pc}
    > 0x00015a42 : ldr r3, [r2]; blx r3
    > 0x0000d67e : ldr r0, [pc, #0x2c]; pop {r4, pc}
    > 0x00017632 : ldr r2, [r0, #8]; bxeq lr
    > 0x0000dfaa : ldr r3, [ip, #0x84]; bx r3
pop pop ret
    > 0x00034978 : pop {r0, pc}
    > 0x0002d8b1 : pop {r2, r7, pc}
    > 0x0001ccb1 : pop {r0, r3, r5, pc}
    > 0x0001cc29 : pop {r0, r1, r3, r6, pc}
    > 0x0001ca4d : pop {r0, r3, r5, r6, r7, pc}
write mem
    > 0x000154be : str r1, [r0]; pop {r3, r4, r5, pc}
    > 0x0000d62e : strh r2, [r3]; pop {r4, pc}
    > 0x000177a6 : str r2, [r0, #4]; pop {r4, pc}
    > 0x00017a56 : strne r3, [r0, #0xc]; pop {r3, pc}
    > 0x00017aaa : str r4, [r0, #0xc]; pop {r4, pc}