ropshell> use 28ef6b87bfb3ed38c5d06399ec0b5c27 (download)
name         : pwn4 (x86_64/ELF)
base address : 0x4006c0
total gadgets: 45

ropshell> suggest
call
    > 0x004007ae : call rax
    > 0x004007b5 : call [rbp + 0x48]
    > 0x00400949 : call [r12 + rbx*8]
jmp
    > 0x00400715 : jmp rax
load reg
    > 0x00400963 : pop rdi; ret
    > 0x00400720 : pop rbp; ret
    > 0x00400962 : pop r15; ret
    > 0x00400961 : pop rsi; pop r15; ret
    > 0x00400960 : pop r14; pop r15; ret
pop pop ret
    > 0x00400962 : pop r15; ret
    > 0x00400960 : pop r14; pop r15; ret
    > 0x0040095e : pop r13; pop r14; pop r15; ret
    > 0x0040095c : pop r12; pop r13; pop r14; pop r15; ret
    > 0x0040095b : pop rbp; pop r12; pop r13; pop r14; pop r15; ret
stack pivoting
    > 0x004008fe : leave ; ret