ropshell> use 52fbcb8af97fb6833dd31f885616dfa0 (download)
name         : libc.so (i386/ELF)
base address : 0x22250
total gadgets: 12486

ropshell> suggest
call
    > 0x00023d87 : call eax
    > 0x00029e7b : call ebx
    > 0x00023e72 : call ecx
    > 0x00025959 : call edx
    > 0x00023e1b : call esi
jmp
    > 0x0003212b : push esp; ret
    > 0x00024137 : jmp eax
    > 0x00060864 : jmp ebx
    > 0x00030845 : jmp ecx
    > 0x00035880 : jmp edx
load mem
    > 0x0007947b : mov eax, [edx]; ret
    > 0x00086d00 : mov eax, [ecx]; mov [edx], eax; ret
    > 0x00086d4d : mov eax, [ecx + 8]; sub eax, edx; ret
    > 0x0010e040 : mov eax, [edx + 8]; and eax, 0x100f; ret
    > 0x00040c31 : mov ebx, [eax + 0x34]; xor eax, eax; ret
load reg
    > 0x00110ddc : pop eax; ret
    > 0x00023614 : pop ebx; ret
    > 0x0004335d : pop ecx; ret
    > 0x0003aca5 : pop edx; ret
    > 0x00023ce9 : pop esi; ret
pop pop ret
    > 0x00110ddc : pop eax; ret
    > 0x0003b4ee : pop ebx; pop edi; ret
    > 0x0010d276 : pop ebp; pop edi; pop ebx; ret
    > 0x0005073a : pop eax; pop ebx; pop esi; pop edi; ret
    > 0x00028e1f : pop esp; pop ebx; pop esi; pop edi; pop ebp; ret
sp lifting
    > 0x0013d4e4 : add esp, 0x11c; ret
    > 0x0013d4e4 : add esp, 0x11c; ret
    > 0x00176013 : add esp, 0x20; ret
    > 0x00117064 : add esp, 0x3c; ret
    > 0x0010a929 : add esp, 0x4c; ret
stack pivoting
    > 0x0002f2be : xchg eax, esp; ret
    > 0x000272ba : lea esp, [ecx - 4]; ret
    > 0x0003ae23 : mov esp, ecx; jmp edx
    > 0x00041360 : lea esp, [edi - 8]; pop edi; ret
    > 0x0013d0b8 : lea esp, [ebp - 8]; pop ebx; pop edi; pop ebp; ret
syscall
    > 0x00096609 : call gs:[0x10]; ret
write mem
    > 0x000a62d5 : add [eax], edi; ret
    > 0x00067309 : add [ecx], eax; ret
    > 0x0002b309 : add [ecx], edi; ret
    > 0x0011d90a : add [ecx], ebp; ret
    > 0x00136937 : add [eax + 2], edi; ret