ropshell> use bf27cb0e70701b1211030c01e1063174 (download)
name         : ntdll.dll (i386/PE)
base address : 0x6a201000
total gadgets: 11361

ropshell> suggest "stack pivoting"
> 0x6a25a58f : xchg eax, esp; ret
> 0x6a238f90 : mov esp, ebx; pop ebx; ret
> 0x6a222475 : mov esp, ebp; pop ebp; ret
> 0x6a2a3b98 : lea esp, [esp + 0x80]; pop ecx; ret
> 0x6a28d606 : mov esp, esi; pop ebx; pop edi; pop esi; pop ebp; ret 0x10
> 0x6a235647 : lea esp, [esi + esi*8 - 1]; jmp [esi - 0x7b]
> 0x6a24a5f7 : lea esp, [edi + edi*8 - 1]; dec [ebp - 0x9f7b]; call [eax + 0x56]
> 0x6a26b05f : lea esp, [ecx + edi*8 - 1]; dec [ebx + 0x33c28bf7]; dec [ecx - 0x69f4b]; jmp [ecx]
> 0x6a221eb4 : leave ; ret