ropshell> use 29d9638b98dea49b7739cd6d3ad26132 (download)
name         : ntdll.dll (i386/RAW)
base address : 0x0
total gadgets: 12744

ropshell> suggest "stack pivoting"
> 0x0003e596 : xchg eax, esp; ret
> 0x0002b7db : mov esp, ebx; pop ebx; ret
> 0x000230b9 : mov esp, ebp; pop ebp; ret
> 0x0006b0bf : lea esp, [eax + eax + 0x5de58b00]; ret 0xc
> 0x00096648 : lea esp, [esp + 0x80]; pop ecx; ret
> 0x000e269d : push esi; pop esp; add [eax], eax; ret
> 0x000732e6 : mov esp, esi; pop ebx; pop edi; pop esi; pop ebp; ret 0x10
> 0x0003c67e : lea esp, [edi + edi*8 - 1]; jmp [eax]
> 0x0002343c : leave ; ret