ropshell> use 911ddf2e16761643a47225f654d811e5 (download)
name         : ntdll.dll (i386/PE)
base address : 0x7c901000
total gadgets: 6968

ropshell> search popa$
found 10 gadgets
> 0x7c905988 : popal ; ret 0
> 0x7c9695b5 : popal ; and al, 0; pop esi; pop ebp; ret 0xc
> 0x7c913a77 : popal ; dec ebx; add [eax], eax; pop esi; ret
> 0x7c9694af : popal ; push esp; add bh, bh; dec ecx; pop eax; pop ebp; ret 4
> 0x7c94eaa2 : popal ; std ; call [edi + 0xffffff8b]
> 0x7c94e4fc : popal ; cld ; call [eax + 0x90909090]; xor eax, eax; inc eax; ret
> 0x7c94d72a : popal ; mov edi, esi; call [edx + 0x50]
> 0x7c90d46f : popal ; add [eax], al; add [edx + 0x7ffe0300], bh; call [edx]; ret 4
> 0x7c90d46f : popal ; add [eax], al; add [edx + 0x7ffe0300], bh; call [edx]
> 0x7c942498 : popal ; add eax, [eax]; add [ebp + 0xffff5485], cl; dec [ecx + 0xffff6085]; dec [ebp + 0xffff4885]; dec [ecx + 0xffff6485]; call [esi + 0xffffff8d]