ropshell> use 8e66be0a3125f7c3c5a2d303da18c35c (download)
name         : libc.so.6 (x86_64/ELF)
base address : 0x287c0
total gadgets: 17230

ropshell> suggest "stack pivoting"
> 0x0006310f : mov rsp, rdx; ret
> 0x00048777 : xchg eax, esp; ret
> 0x00063110 : mov esp, edx; ret
> 0x0007e4a9 : mov esp, edi; jmp rcx
> 0x00171e8b : lea rsp, [rbp - 0x10]; pop rbx; pop r12; pop rbp; ret
> 0x0007e959 : mov esp, esi; mov edx, 1; jmp rcx
> 0x00171e8c : lea esp, [rbp - 0x10]; pop rbx; pop r12; pop rbp; ret
> 0x00045a19 : mov rsp, r8; mov rbp, r9; nop ; jmp rdx
> 0x00045a1a : mov esp, eax; mov rbp, r9; nop ; jmp rdx
> 0x001448d3 : mov esp, ebx; idiv edi; lea rax, [rip - 0x8231e]; cmove rax, rdx; ret
> 0x0012af82 : mov esp, ecx; push rbx; mov rbx, rdi; mov rdi, rcx; call rsi
> 0x000aaa23 : xchg esp, eax; add [rax], al; add [rbx + 0x31], bl; rol [rcx + 0x5c], 0x5d; ret
> 0x0017a931 : push rdi; pop rsp; lea rsi, [rdi + 0x48]; mov rdi, rax; mov rcx, [rcx + 0x18]; jmp rcx
> 0x0008f255 : xchg esi, esp; add [rax], al; add [rcx - 0x2076b72f], cl; xor edx, edx; call [rax + 0x48]
> 0x00092677 : xchg esp, esi; add [rax], eax; add [rcx + rcx*4 - 1], cl; call [rbx + 0x20]
> 0x001807f8 : lea esp, [rax - 1]; mov rax, [r15 + 0xd0]; mov [r15 + 0xa8], r12d; call [rax + 0x18]
> 0x00029bb0 : leave ; ret