ropshell> use 7ae5fa298772964cf408d1fac5dc4180 (download)
name         : libc-2.29.so.6 (x86_64/ELF)
base address : 0x25320
total gadgets: 17444

ropshell> suggest "load reg"
> 0x00047cf8 : pop rax; ret
> 0x000314f9 : pop rbx; ret
> 0x0010b31e : pop rcx; ret
> 0x0012bda6 : pop rdx; ret
> 0x00026f9e : pop rsi; ret
> 0x00026542 : pop rdi; ret
> 0x000253a6 : pop rbp; ret
> 0x00030e4e : pop rsp; ret
> 0x0012bda5 : pop r10; ret
> 0x00030e4d : pop r12; ret
> 0x00026a25 : pop r13; ret
> 0x00026f9d : pop r14; ret
> 0x00026541 : pop r15; ret
> 0x001484f6 : pop r11; pop rbp; pop r12; ret
> 0x00121112 : mov rax, [rsp]; add rsp, 0x38; ret
> 0x00121113 : mov eax, [rsp]; add rsp, 0x38; ret
> 0x00136f03 : mov rsi, [rsp]; call r12
> 0x00151443 : mov rdi, [rsp]; call rax
> 0x00136f04 : mov esi, [rsp]; call r12
> 0x00151444 : mov edi, [rsp]; call rax
> 0x0014bf4f : mov rcx, [rsp + 0x28]; call rcx
> 0x0015e5c8 : mov rdx, [rsp + 0x10]; call rdx
> 0x0014bf50 : mov ecx, [rsp + 0x28]; call rcx
> 0x0015e5c9 : mov edx, [rsp + 0x10]; call rdx
> 0x00148078 : pop r8; add rsp, 8; sub esi, eax; pop rbx; pop rbp; mov eax, esi; ret
> 0x000bc24a : mov r9, [rsp + 0x10]; mov rdi, rbp; mov rsi, [rsp + 0x18]; call rbx
> 0x00108435 : mov r10, [rsp + 0x30]; movsxd rax, [rdx + rax*4]; add rax, rdx; jmp rax
> 0x000455b1 : mov rbx, [rsp + 8]; nop cs:[rax + rax]; mov rsi, r14; mov rdi, r15; mov rdx, r13; call rbp
> 0x000455b2 : mov ebx, [rsp + 8]; nop cs:[rax + rax]; mov rsi, r14; mov rdi, r15; mov rdx, r13; call rbp
> 0x0014f5db : mov r15, [rsp + 0x80]; mov rdi, [rax]; mov rsi, r15; mov rax, [rdi + 0x38]; call [rax + 8]
> 0x000308d2 : mov r8, [rsp + 0x40]; mov rdx, [rsp + 0x48]; mov rsi, [rsp + 0x38]; mov rdi, [rsp + 0x30]; call rbp
> 0x0014f593 : mov r14, [rsp + 0x80]; mov rax, [rbx + 0x60]; mov [rbx + 0x58], 0; mov esi, [rbx + 0x88]; mov rdi, r14; call [rax + 0x28]