ropshell> use bf27cb0e70701b1211030c01e1063174 (download)
name         : ntdll.dll (i386/PE)
base address : 0x6a201000
total gadgets: 11361

ropshell> suggest "jmp"
> 0x6a20a178 : push esp; ret
> 0x6a21dd8d : jmp eax
> 0x6a2124e4 : jmp ebx
> 0x6a291415 : jmp ecx
> 0x6a29363f : jmp esi
> 0x6a21aadc : jmp edi
> 0x6a209990 : jmp ebp
> 0x6a30600b : jmp esp
> 0x6a225ce6 : jmp [eax]
> 0x6a22a4c7 : jmp [ebx]
> 0x6a2318b0 : jmp [ecx]
> 0x6a219eb1 : jmp [edx]
> 0x6a2c7af4 : jmp [esi]
> 0x6a28a00f : jmp [edi]
> 0x6a241fd6 : jmp [esp + ecx]