ropshell> use a2d5fdc85095265f4f8a4d3879f8e009 (download)
name         : ch25 (i386/ELF)
base address : 0x8048510
total gadgets: 36

ropshell> suggest
call
    > 0x080485df : call eax
    > 0x080486b2 : call [ebp - 0x77]
load reg
    > 0x080485b3 : pop ebp; ret
    > 0x080485b2 : pop ebx; pop ebp; ret
    > 0x08048a57 : pop edi; pop ebp; ret
    > 0x08048a56 : pop esi; pop edi; pop ebp; ret
    > 0x08048a5a : mov ebx, [esp]; ret
pop pop ret
    > 0x080485b3 : pop ebp; ret
    > 0x080485b2 : pop ebx; pop ebp; ret
    > 0x08048a56 : pop esi; pop edi; pop ebp; ret
    > 0x08048a55 : pop ebx; pop esi; pop edi; pop ebp; ret
stack pivoting
    > 0x08048558 : leave ; ret
write mem
    > 0x080485ae : add [ebx + 0x5d5b04c4], eax; ret