ropshell> use 59fe3aa4bc734c502858e4e5a0381c1d (download)
name         : level05 (i386/ELF)
base address : 0x1920
total gadgets: 196
ropshell> suggest
call
    > 0x00001c5f : call eax
    > 0x00001b8e : call [eax + 0x51]
    > 0x00002ecf : call [ebp + 0x57]
jmp
    > 0x00001b9c : push esp; mov ebx, [esp]; ret
    > 0x00001f64 : jmp [esi + 0x31]
load reg
    > 0x0000195b : pop ebx; ret
    > 0x00002710 : pop esi; ret
    > 0x00002cf8 : pop edi; ret
    > 0x00001c2e : pop ebp; ret
    > 0x00003184 : pop esp; ret
pop pop ret
    > 0x00001c2e : pop ebp; ret
    > 0x00001c64 : pop ebx; pop ebp; ret
    > 0x00001c2c : pop ebx; pop esi; pop ebp; ret
    > 0x00001e8d : pop ebx; pop esi; pop edi; pop ebp; ret
sp lifting
    > 0x00002841 : add esp, 0x1c; ret
    > 0x00002841 : add esp, 0x1c; ret
    > 0x0000263e : add esp, 0x3c; ret
    > 0x00003182 : add esp, 0x5c; ret
stack pivoting
    > 0x000041c9 : leave ; setne al; ret
write mem
    > 0x00001c28 : add [ebx + 0x5e5b10c4], eax; pop ebp; ret