ropshell> use b2107821de29fd9b1ae25f3bd5a49f23 (download)
name         : heaplevel2 (armv7/MACHO)
base address : 0x4000
total gadgets: 24

ropshell> suggest
jmpcall
    > 0x0000becf : bx sp
    > 0x0000baa8 : blx r0
pop pop ret
    > 0x0000b9a8 : pop {r7, pc}
    > 0x00004135 : pop {r2, r4, pc}
stack pivoting
    > 0x0000b9a6 : mov sp, r7; pop {r7, pc}
write mem
    > 0x0000becd : str r0, [r2, #0x14]; bx sp