ropshell> use 2d16e455648f41e816d1951ab7d09667 (download)
name         : ch72.exe (i386/PE)
base address : 0x401000
total gadgets: 1567

ropshell> suggest "write mem"
> 0x0040e4ea : add [ebx], eax; ret
> 0x00403979 : add [ecx], eax; pop ebp; ret 0x10
> 0x00402a65 : add [ebx + 0x5d5b5fc7], ecx; ret 4
> 0x00403376 : add [esi + 0x5b], ebx; ret
> 0x00403726 : add [edi + 0x5e], ebx; ret
> 0x00408727 : add [ebx], esi; ror [ecx + 0x5e5f0c7e], 0x5d; ret 4
> 0x00405214 : adc [edi], ecx; add [eax], al; mov al, 1; pop ebp; ret
> 0x00412e15 : add [edx + 0x47880246], ecx; add cl, [ebx + 0x5e0c2444]; pop edi; ret
> 0x00401e49 : add [ebx + 9], esi; rep stosb es:[edi], al; mov eax, [esp + 4]; mov edi, edx; ret
> 0x00409946 : add [eax + 0x5c68c301], esi; rol [ecx], -0x18; adc bl, 0xff; call [eax - 0x18]