ropshell> use 67b2026b5d9009b183a8f4eb23a6180e (download) name : KernelBase.dll (x86_64/PE) base address : 0x180001000 total gadgets: 17820
ropshell> suggest "write mem" > 0x180035242 : add [rbx], eax; ret > 0x1800e88b3 : adc [rbx], edi; ret > 0x180097557 : adc [rcx], eax; ret > 0x1800a8486 : adc [rdx], eax; ret > 0x180068190 : add [rax + 0xf], ecx; ret > 0x18015e778 : add [rax + 0x7f], edi; ret > 0x180167311 : adc [rcx + 0x10], eax; ret > 0x1800ba169 : adc [rdx + 0x18], ecx; ret > 0x1800c48e2 : add [rbp + 0x3b], ecx; ret > 0x18006818f : add [r8 + 0xf], ecx; ret > 0x1800c48e1 : add [r13 + 0x3b], ecx; ret > 0x1800f9e48 : add [rdi], ecx; xchg eax, esp; ret > 0x1800bbc44 : add [rax], r8; add [rbp - 0x75], al; ret > 0x1800578de : add [r15], ecx; fmul [r11 - 0x3b7cb73d]; pop rbx; ret > 0x180146761 : add [rdx + 0x20], rax; xor eax, eax; ret > 0x180146762 : add [rdx + 0x20], eax; xor eax, eax; ret > 0x1800b8656 : add [rbp + 6], esi; add rax, 2; ret > 0x18003205c : add [rbx], esi; jmp [rsi - 0x7d] > 0x1800ae81c : add [rdi], eax; test cl, ah; mov eax, 0x5a; ret > 0x1800b1fef : add [r8], eax; mov eax, 1; add rsp, 0x28; ret > 0x180022d5d : adc [rbx + rcx], eax; add [rax - 0x7d], cl; ret > 0x1800a31b9 : adc [rdi + 0x78], edx; xor cl, [rdi - 0x3fcc4aa8]; ret > 0x1800a97dc : add [rdi], ebp; mov [rax + rdi*4 - 0x7fffbffb], ah; ret > 0x180136d75 : adc [rdx], ecx; mov [r10 + 0x10], ecx; add rsp, 0x28; ret > 0x180093151 : add [rbx + 0xfe8d0], ecx; add [rax], al; add rsp, 0x38; ret > 0x18009d3cc : adc [rsi], ecx; cmp esi, esp; mov [rdx], 2; xor eax, eax; ret > 0x180101e4c : add [rdi], ebx; add bl, al; int3 ; lea rax, [rip + 0x1f0210]; ret > 0x18014d6e9 : adc [rcx + 0x1c], edx; rol [rdi], 1; cld ; fnstcw [rax - 0x7ff8ff81]; ret > 0x180101edb : adc [rdi + rbx], eax; add bl, al; int3 ; lea rax, [rip + 0x1f0410]; ret > 0x1800a25dc : adc [rsi + 0x7b995c8], ecx; add [rax], al; add ch, cl; sub [rax - 0x7fff0001], edi; ret > 0x1801694ee : add [rcx + 0x7f], edi; call [rip + 0xd28e5]; nop [rax + rax]; xor eax, eax; add rsp, 0x28; ret