ropshell> use 6d7540510395dd36bd884a8036cc8396 (download)
name         : libc.so.6 (arm/ELF)
base address : 0x1efc0
total gadgets: 5523

ropshell> suggest "write mem"
> 0x00058347 : str r2, [r0]; pop {r3, r4, r5, pc}
> 0x0003d109 : str r3, [r0]; pop {r3, r4, r5, pc}
> 0x000e7c4f : str r5, [r0]; pop {r3, r4, r5, pc}
> 0x000582b7 : str r3, [r1]; pop {r4, pc}
> 0x00076017 : str r4, [r1]; pop {r4, r5, pc}
> 0x000ce129 : str r1, [r2]; pop {r3, pc}
> 0x00084873 : str r3, [r2]; pop {r3, r4, r5, pc}
> 0x000d623b : str r0, [r3]; pop {r3, pc}
> 0x0003d393 : str r1, [r3]; pop {r3, pc}
> 0x000dffc1 : str r2, [r3]; pop {r3, r4, r5, pc}
> 0x0009a085 : str r6, [r3]; pop {r4, r5, r6, pc}
> 0x000de955 : str r0, [r4]; pop {r4, pc}
> 0x000562d5 : str r1, [r4]; pop {r4, pc}
> 0x00052945 : str r2, [r4]; pop {r3, r4, r5, pc}
> 0x0001ff53 : str r3, [r4]; pop {r3, r4, r5, pc}
> 0x0005fa9b : str r5, [r4]; pop {r3, r4, r5, pc}
> 0x000e21bb : str r0, [r5]; pop {r3, r4, r5, r6, r7, pc}
> 0x00030f61 : str r3, [r5]; pop {r3, r4, r5, pc}
> 0x000c0be5 : str r4, [r5]; pop {r3, r4, r5, pc}
> 0x0006f9a9 : str r3, [r6]; pop {r3, r4, r5, r6, r7, pc}
> 0x00070791 : str r4, [r6]; pop {r4, r5, r6, pc}
> 0x000745c7 : str r4, [r7]; pop {r3, r4, r5, r6, r7, pc}
> 0x000735e9 : str.w r3, [lr]; pop {r4, pc}
> 0x0007362b : str.w r5, [lr]; pop {r4, r5, r6, pc}
> 0x0004c3ab : str r6, [r2, r5]; pop {r4, r5, r6, pc}
> 0x000a79f9 : str r6, [r4, r3]; pop {r4, r5, r6, pc}
> 0x000e51d3 : str r2, [r5, r3]; pop {r3, r4, r5, pc}
> 0x000bfbcd : str r6, [r5, r3]; pop {r4, r5, r6, pc}
> 0x000e673d : str r0, [r6, r6]; pop {r3, r4, r5, r6, r7, pc}
> 0x000a2a0f : strh.w fp, [r0, #4]; pop {r4, pc}
> 0x0005ef4d : str r0, [r1, #0x78]; pop {r4, pc}
> 0x0006b42d : str r2, [r1, #0x10]; pop {r4, pc}
> 0x000a6ee9 : str r5, [r1, #8]; pop {r3, r4, r5, r6, r7, pc}
> 0x000b8a6f : str r7, [r1, r0]; bx ip
> 0x0005db9d : str r4, [r3, #0xc]; pop {r4, pc}
> 0x0003f46d : str r7, [r5, #4]; pop {r3, r4, r5, r6, r7, pc}
> 0x0006b621 : str r1, [r6, #0x34]; pop {r3, r4, r5, r6, r7, pc}
> 0x000a6f0d : str r7, [r6, #0x24]; pop {r3, r4, r5, r6, r7, pc}
> 0x000c0eb9 : str.w r1, [ip, #0xc]; pop {r4, r5, pc}
> 0x0002915f : str.w r2, [ip, r3]; bx lr
> 0x000beb09 : str.w r3, [ip, #4]; pop {r3, r4, r5, pc}
> 0x000bf5f9 : str r1, [r0, r0]; mov r0, r4; pop {r3, r4, r5, r6, r7, pc}
> 0x000f00ab : str r4, [r0, r4]; orrs r1, r5; pop {r4, r5, pc}
> 0x000cba07 : str r4, [r2, r3]; mov r0, r4; pop {r3, r4, r5, pc}
> 0x000966e3 : str.w r5, [r2, r3, lsl #2]; pop {r3, r4, r5, pc}
> 0x000c79e7 : str.w r1, [r5, r6, lsl #2]; pop {r3, r4, r5, r6, r7, pc}
> 0x00031c27 : str r5, [r6]; movs r0, #0; pop {r3, r4, r5, r6, r7, pc}
> 0x0006893d : str.w r0, [ip, #0x10]; bx lr
> 0x000cf1cf : str r0, [r2, r3]; add sp, #8; pop {r4, pc}
> 0x000cf41f : str r2, [r6, r3]; add sp, #0x14; pop {r4, r5, r6, r7, pc}
> 0x000cf5ff : str r2, [r7, r3]; add sp, #0x34; pop {r4, r5, r6, r7, pc}
> 0x000de5f3 : str.w r2, [r8, #0xc]; blx r3
> 0x000e3715 : str.w r3, [fp, #0x24]; blx r5
> 0x0005cc95 : str r7, [r0, #0x50]; str r3, [r4]; pop {r4, r5, r6, pc}
> 0x00064aab : strh r7, [r3, #4]; movs r0, #1; pop {r3, r4, r5, r6, r7, pc}
> 0x0006fc29 : strh r0, [r7, #0x1e]; mov r0, r6; blx r3
> 0x0005dd6f : str r7, [r4, #8]; str.w r3, [r4, #0xa0]; pop {r3, r4, r5, r6, r7, pc}
> 0x000c0eb5 : str.w lr, [ip, #8]; str.w r1, [ip, #0xc]; pop {r4, r5, pc}
> 0x000a2e03 : str.w r5, [r3, r1, lsl #2]; str.w r6, [r3, r2, lsl #2]; pop {r4, r5, r6, pc}
> 0x000e6129 : str.w r8, [r5, #8]; mov r0, r7; ldr r3, [r3, #0x14]; blx r3
> 0x000a16c1 : str r7, [r2, #0xc]; str r3, [r2, #0x10]; str r1, [r4, #4]; pop {r3, r4, r5, r6, r7, pc}
> 0x000c0eb1 : str.w r4, [ip, #4]; str.w lr, [ip, #8]; str.w r1, [ip, #0xc]; pop {r4, r5, pc}
> 0x000dfad3 : str r6, [r1, r0]; mov r1, r5; mov r3, r4; adds r0, #0x14; pop.w {r4, r5, r6, lr}; bx r3
> 0x000e59e9 : str.w sl, [r1, #0xc]; ldr r3, [r3, #0xc]; strd sl, sl, [r1, #4]; blx r3
> 0x00053ebf : str.w lr, [r6, #0x7c2]; str r3, [r0, #8]; str r3, [r0]; mov r0, r4; add sp, #0xc; pop {r4, r5, r6, r7, pc}
> 0x0009fe09 : strh r5, [r7, #6]; addw r8, pc, #0xc; ldr.w r4, [r8, r4, lsl #2]; add r8, r4; bx r8