ropshell> use 68f7ab3cef06859204cfb8eb975fb52b (download)
name         : vuln1 (i386/ELF)
base address : 0x8049100
total gadgets: 56

ropshell> suggest
call
    > 0x08049180 : call eax
    > 0x080491cd : call edx
    > 0x080493d8 : call [eax + 0x6a]
jmp
    > 0x08049223 : jmp esp
    > 0x0804912b : push esp; mov ebx, [esp]; ret
load reg
    > 0x08049226 : pop ebp; ret
    > 0x08049465 : popal ; cld ; ret
    > 0x08049468 : mov eax, [esp]; ret
    > 0x0804912d : mov ebx, [esp]; ret
    > 0x08049462 : pop ebx; pop ebp; lea esp, [ecx - 4]; ret
pop pop ret
    > 0x08049226 : pop ebp; ret
    > 0x08049462 : pop ebx; pop ebp; lea esp, [ecx - 4]; ret
    > 0x08049461 : pop ecx; pop ebx; pop ebp; lea esp, [ecx - 4]; ret
stack pivoting
    > 0x08049464 : lea esp, [ecx - 4]; ret
    > 0x0804945e : lea esp, [ebp - 8]; pop ecx; pop ebx; pop ebp; lea esp, [ecx - 4]; ret
    > 0x08049185 : leave ; ret