ropshell> use 9042649d1f5489ba94a85363efd26e22 (download)
name         : ntdll.dll (i386/PE)
base address : 0x4b281000
total gadgets: 11260

ropshell> suggest "stack pivoting"
> 0x4b2bb24d : xchg eax, esp; ret
> 0x4b2ad944 : mov esp, ebx; pop ebx; ret
> 0x4b2a6a8e : mov esp, ebp; pop ebp; ret
> 0x4b304f28 : lea esp, [esp + 0x80]; pop ecx; ret
> 0x4b2f0466 : mov esp, esi; pop ebx; pop edi; pop esi; pop ebp; ret 0x10
> 0x4b317d75 : lea esp, [edi + edi*8 - 1]; jmp [eax]
> 0x4b329625 : lea esp, [esi + edi*8 - 1]; call [ecx + 0x33]
> 0x4b2ba6c3 : xchg ecx, esp; add [eax], al; add [edx - 0x936b], cl; jmp [esi - 0x75]
> 0x4b2f4475 : leave ; ret