ropshell> use 837b1e310f2aa8b20f07a9b1ce90ac4f (download)
name         : msvcr71.dll (i386/PE)
base address : 0x7c361000
total gadgets: 2987

ropshell> suggest
call
    > 0x7c361037 : call eax
    > 0x7c361c41 : call ebx
    > 0x7c3615e7 : call ecx
    > 0x7c362520 : call esi
    > 0x7c365f43 : call edi
jmp
    > 0x7c3936e5 : push esp; ret
    > 0x7c3610da : jmp eax
    > 0x7c376188 : jmp ebx
    > 0x7c39478b : jmp ecx
    > 0x7c375f1a : jmp edi
load mem
    > 0x7c37640a : mov eax, [ecx + 0xc]; ret
    > 0x7c393334 : mov eax, [edx + 4]; ret
    > 0x7c37094d : mov eax, [esi + 0x28]; pop esi; ret
    > 0x7c36d546 : mov eax, [ebp + 0x10]; pop ebp; ret
    > 0x7c380d90 : movzx eax, [ecx]; add eax, esi; pop esi; ret
load reg
    > 0x7c365b99 : pop eax; ret
    > 0x7c361c79 : pop ebx; ret
    > 0x7c361594 : pop ecx; ret
    > 0x7c386c47 : pop edx; ret
    > 0x7c3615b7 : pop esi; ret
pop pop ret
    > 0x7c365b99 : pop eax; ret
    > 0x7c371cbd : pop eax; pop ebp; ret
    > 0x7c38d56e : pop ebp; pop ebx; pop ecx; ret
    > 0x7c36615b : pop ebp; pop ebx; pop ecx; pop ecx; ret
    > 0x7c396472 : pop eax; pop edi; pop esi; pop ebx; pop ebp; ret
sp lifting
    > 0x7c3828cc : add esp, 0x100; ret
    > 0x7c3828cc : add esp, 0x100; ret
    > 0x7c3755f3 : add esp, 0x20; ret
    > 0x7c364e2c : add esp, 0x48; ret
stack pivoting
    > 0x7c361350 : xchg eax, esp; ret
    > 0x7c396f34 : mov esp, ebx; pop ebx; ret
    > 0x7c365dc6 : mov esp, ebp; pop ebp; ret
    > 0x7c361af3 : lea esp, [ebp - 8]; pop edi; pop esi; pop ebp; ret 0xc
    > 0x7c361554 : mov esp, ecx; mov ecx, [eax]; mov eax, [eax + 4]; push eax; ret
write mem
    > 0x7c362a08 : add [ebx], eax; ret
    > 0x7c380b49 : add [eax + 0x3a414606], ecx; ret
    > 0x7c36fd25 : add [ebx + 0x5d5e5fc6], ecx; ret
    > 0x7c38b4b7 : add [esi + 0x5b], ebx; ret
    > 0x7c36bd34 : add [edi + 0x5e], ebx; ret