ropshell> use 40f241ba0b3f4812c3ddab15e1e70138 (download)
name         : ntdll.dll (i386/PE)
base address : 0x6b281000
total gadgets: 9198

ropshell> suggest "write mem"
> 0x6b36abcd : adc [ebx], edi; ret
> 0x6b2c820c : add [ecx], eax; ret
> 0x6b311f75 : adc [edx], ebp; lahf ; ret
> 0x6b29959f : add [eax + 0x5dc03308], ecx; ret 0x10
> 0x6b2829ea : add [ebx + 0x3b6602c1], eax; ret
> 0x6b2fd80e : adc [ebx + 0x33f703c7], ecx; ret
> 0x6b2a7f17 : add [esi + 0x5b], ebx; ret
> 0x6b2fb58d : add [esi + 0x5e5ffffc], edx; ret
> 0x6b2e755c : add [edi + 0x5d], ebx; ret 8
> 0x6b315bae : adc [edi + 0x16], esi; ret
> 0x6b32909e : add [ebp + 0x63880ff6], eax; ret
> 0x6b2dae46 : add [edi], ecx; test cl, dh; ret
> 0x6b2bde22 : add [eax + eax], edx; call fs:[0xc0]; ret 0x10
> 0x6b289748 : add [ebp + 0x754e0449], ecx; pop esi; pop ebp; ret 4
> 0x6b2d62ac : add [ebx], esi; jmp [esi - 0x7b]
> 0x6b34f805 : adc [ecx], esi; imul ecx, [edi], -0x4a; ret
> 0x6b374bd8 : adc [edx], eax; add [eax], al; pop ebp; ret 8
> 0x6b2e21cb : add [eax + 0x4518901], esi; mov esp, ebp; pop ebp; ret 8
> 0x6b28f25a : add [edx + 0x5b0b2444], ecx; mov esp, ebp; pop ebp; ret 0x10
> 0x6b356006 : add [edx], ecx; inc [edx + 8]; mov esp, ebp; pop ebp; ret 8
> 0x6b34e267 : add [edi], esi; xor eax, eax; pop edi; pop esi; pop ebx; pop ebp; ret 8
> 0x6b37d971 : add [esi + 0x5f], eax; mov eax, esi; pop esi; pop ebx; pop ebp; ret 4
> 0x6b334e53 : adc [eax], edi; imul eax, [ecx], 0; add [eax], al; ret
> 0x6b351008 : add [ebp + 5], esi; push 9; pop ecx; int 0x29; mov esp, ebp; pop ebp; ret
> 0x6b28addb : add [edx + 5], edi; add [eax - 0x73], dl; inc esi; or [ebx], al; ret
> 0x6b286a16 : add [eax + 0xa], ebx; add [ebp - 0x16b7b], cl; call [eax - 0x18]
> 0x6b354f6f : adc [ebx + 9], esi; mov eax, [ebp + 8]; mov [edx], eax; add [ecx + 4], 4; xor eax, eax; pop ebp; ret 8