ropshell> use d4cf37dea2f2b18ff1e7db8d15927741 (download)
name         : vuln (x86_64/ELF)
base address : 0x401080
total gadgets: 61

ropshell> suggest
call
    > 0x004012f0 : call rax
    > 0x004012a2 : call [rdi + rbx*8]
    > 0x004011b8 : call [rbp + 0x48]
    > 0x0040117c : call [rsp + rax*8]
    > 0x0040117b : call [r12 + rax*8]
jmp
    > 0x004010dc : jmp rax
load reg
    > 0x004012bb : pop rdi; ret
    > 0x0040119a : pop rbp; ret
    > 0x004012ba : pop r15; ret
    > 0x004012b9 : pop rsi; pop r15; ret
    > 0x004012b8 : pop r14; pop r15; ret
pop pop ret
    > 0x004012ba : pop r15; ret
    > 0x004012b8 : pop r14; pop r15; ret
    > 0x004012b6 : pop r13; pop r14; pop r15; ret
    > 0x004012b4 : pop r12; pop r13; pop r14; pop r15; ret
    > 0x004012b3 : pop rbp; pop r12; pop r13; pop r14; pop r15; ret
stack pivoting
    > 0x00401242 : leave ; ret
write mem
    > 0x00401164 : add [rax + 0x39], ecx; fdiv [rbx + 0x21]; nop [rax + rax]; add rax, 1; mov [rip + 0x2ee5], rax; call [r12 + rax*8]