ropshell> use e9c73db4de762910c572a97827776de6 (download)
name         : libc.so.6 (x86_64/ELF)
base address : 0x243c0
total gadgets: 19536

ropshell> suggest "load mem"
> 0x0016e674 : mov eax, [rcx]; ret
> 0x00085210 : mov eax, [rdx]; ret
> 0x000e5b24 : mov eax, [rdi]; ret
> 0x00093354 : mov rax, [rdi + 0x68]; ret
> 0x0016e772 : mov eax, [rdx + 4]; ret
> 0x00140474 : mov eax, [rdi + 0x20]; ret
> 0x000b3a65 : movzx ecx, [rsi]; sub eax, ecx; ret
> 0x0008823d : mov edx, [rax]; mov eax, edx; ret
> 0x0016ee58 : mov rax, [rbp + 8]; pop rbp; ret
> 0x0016ee59 : mov eax, [rbp + 8]; pop rbp; ret
> 0x00092f90 : mov rax, [rdi]; mov [rdx], rax; ret
> 0x000b8bd0 : mov rdx, [rsi]; mov [rdi], rdx; ret
> 0x0011c0fe : mov rsi, [rbx]; call r13
> 0x0011bd49 : mov rdi, [rbx]; call r12
> 0x000b8b71 : mov edx, [rsi]; mov [rdi], dx; ret
> 0x0011c0ff : mov esi, [rbx]; call r13
> 0x0011bd4a : mov edi, [rbx]; call r12
> 0x001847f7 : movzx ecx, [rsi + rcx]; sub eax, ecx; ret
> 0x00190b2f : movzx edx, [rsi + rcx]; sub eax, edx; ret
> 0x000d80a0 : movsxd rdx, [rbp + 0x28]; pop rbp; sub rax, rdx; ret
> 0x00040d39 : mov rdi, [rbx + 8]; call rax
> 0x0016e4ba : mov rdi, [rbp + 8]; pop rbp; jmp rax
> 0x00040d3a : mov edi, [rbx + 8]; call rax
> 0x0016e4bb : mov edi, [rbp + 8]; pop rbp; jmp rax
> 0x0016efcf : mov rax, [rbx]; pop rbx; pop r12; pop rbp; jmp rax
> 0x0018f12e : mov rax, [rcx]; mov [rdx], rax; mov rax, rdi; ret
> 0x0010249b : mov rdx, [rax]; mov [rax], rdi; mov rax, rdx; ret
> 0x0011c1d9 : mov rsi, [rax]; mov rdi, r13; call r14
> 0x0016efd0 : mov eax, [rbx]; pop rbx; pop r12; pop rbp; jmp rax
> 0x00095d12 : mov eax, [rsi]; neg eax; sbb eax, eax; and eax, 0x16; ret
> 0x000c314e : mov edx, [rdi]; xor eax, eax; test edx, edx; sete al; ret
> 0x0011c1da : mov esi, [rax]; mov rdi, r13; call r14
> 0x00142ba1 : mov edi, [rsi]; call [rbp - 0x40]
> 0x0014276e : mov edi, [r12]; call [rbp - 0x40]
> 0x00142ba0 : mov edi, [r14]; call [rbp - 0x40]
> 0x0005afde : mov rax, [rdx + 0x88]; mov [rax + 8], rcx; ret
> 0x000a1d72 : mov rax, [rsi + 0x18]; mov [rdi + 0x18], rax; ret
> 0x00081f5d : mov rcx, [rax + 0xa0]; mov [rcx + 0xe0], rdx; ret
> 0x000a1d73 : mov eax, [rsi + 0x18]; mov [rdi + 0x18], rax; ret
> 0x00081f5e : mov ecx, [rax + 0xa0]; mov [rcx + 0xe0], rdx; ret
> 0x0015e69a : mov rax, [rsi]; bswap eax; mov [rcx], eax; mov eax, 1; ret
> 0x00164cb0 : mov rax, [rbx + 0x60]; call [rax + 8]
> 0x000a4f1b : mov rdx, [rdi + 0x28]; mov [rdx + 0x20], rax; pop rbp; ret
> 0x0012696b : mov rdi, [rdx + 0x50]; mov rsi, rdx; call rax
> 0x000284ef : mov rdi, [r14 + 0x10]; add rdi, r12; call rbx
> 0x00164cb1 : mov eax, [rbx + 0x60]; call [rax + 8]
> 0x0010d97f : mov edx, [rax + rdx]; call [rbx + 0x40]
> 0x000a4f1c : mov edx, [rdi + 0x28]; mov [rdx + 0x20], rax; pop rbp; ret
> 0x000afe42 : mov edx, [rbp + 0x13]; mov [rdi + 3], edx; pop rbp; ret
> 0x0012696c : mov edi, [rdx + 0x50]; mov rsi, rdx; call rax
> 0x000284f0 : mov edi, [rsi + 0x10]; add rdi, r12; call rbx
> 0x00164040 : mov rax, [r8]; bswap eax; mov [rcx + 0x54], eax; mov eax, 1; ret
> 0x000b8be0 : mov rcx, [rsi]; mov [rdi + 8], dh; mov [rdi], rcx; ret
> 0x0009aec4 : mov rdx, [rdi]; lea rax, [rip + 0x1781da]; mov [rax], edx; ret
> 0x00091b47 : movzx esi, [rdi]; mov rdi, r13; call [rbx + 0x18]
> 0x00091b46 : movzx esi, [r15]; mov rdi, r13; call [rbx + 0x18]
> 0x0018f14b : mov rax, [rcx + 8]; mov [rdx + 8], rax; mov rax, rdi; ret
> 0x00044921 : mov r9, [rdx + 0x30]; mov rdx, [rdx + 0x88]; xor eax, eax; ret
> 0x0018f186 : mov eax, [rcx + 8]; mov [rdx + 8], eax; mov rax, rdi; ret
> 0x00044922 : mov ecx, [rdx + 0x30]; mov rdx, [rdx + 0x88]; xor eax, eax; ret
> 0x000437a4 : mov rdi, [r12]; mov rdx, [rbp - 0x40]; call [rbp - 0x38]
> 0x000a2992 : mov r12, [rbx]; call [rip + 0x17038d]; mov rdi, r13; call r12
> 0x00166725 : mov rax, [r15 + 8]; mov rdi, r15; call [rax + 0x20]
> 0x000b8d14 : mov rcx, [rsi + 0x10]; movdqu xmm[rdi], xmm0; mov [rdi + 0x10], rcx; ret
> 0x001660fe : mov rdx, [rax + 0x38]; mov rdi, rax; call [rdx + 0x20]
> 0x001649e3 : mov rdx, [rcx + 0x90]; bswap eax; mov [rdx + 0xc], eax; mov eax, 1; ret
> 0x000b8c23 : mov rdx, [rsi + 5]; mov [rdi], rcx; mov [rdi + 5], rdx; ret
> 0x000371d4 : mov eax, [r12 + 8]; sub eax, [rbx + 8]; pop rbx; pop r12; pop rbp; ret
> 0x001649e4 : mov edx, [rcx + 0x90]; bswap eax; mov [rdx + 0xc], eax; mov eax, 1; ret
> 0x001615ff : mov rdi, [rax]; mov rax, [rdi + 0x38]; call [rax + 0x18]
> 0x00161600 : mov edi, [rax]; mov rax, [rdi + 0x38]; call [rax + 0x18]
> 0x000944c9 : mov rdx, [rbx + 0x20]; cmove rdi, r11; sub rsp, 8; push r10; call rax
> 0x000944ca : mov edx, [rbx + 0x20]; cmove rdi, r11; sub rsp, 8; push r10; call rax
> 0x000a446d : mov rbx, [r8]; mov rdi, r8; call [rip + 0x16e8af]; mov rdi, r12; call rbx
> 0x0014264a : mov rdx, [r15]; mov r8, rbx; lea rcx, [rbp - 0x40]; mov rdi, r14; call r13
> 0x000a446e : mov ebx, [rax]; mov rdi, r8; call [rip + 0x16e8af]; mov rdi, r12; call rbx
> 0x001654e3 : mov rax, [r14 + 0x60]; lea rdi, [r14 + 0x58]; call [rax + 0x20]
> 0x0003620c : mov rsi, [rdi + 0x78]; mov fs:[rcx], rsi; cmp rax, rdx; mov rdx, -1; cmove rax, rdx; ret
> 0x000a10d3 : mov r14, [rdx + 0x18]; mov rdi, [rdx + 8]; call [rdx]
> 0x0003e643 : mov r15, [rdi + 0x28]; mov eax, esi; mov rsp, r8; mov rbp, r9; nop ; jmp rdx
> 0x000a10d4 : mov esi, [rdx + 0x18]; mov rdi, [rdx + 8]; call [rdx]
> 0x0003620d : mov esi, [rdi + 0x78]; mov fs:[rcx], rsi; cmp rax, rdx; mov rdx, -1; cmove rax, rdx; ret
> 0x0012007d : mov rcx, [rdi]; mov [rdx + 0x10], rcx; mov [rdi], rax; mov [rip + 0xf31ee], 0; ret
> 0x00164cbf : mov rdi, [r14]; mov rsi, r15; mov rax, [rdi + 0x38]; call [rax + 8]
> 0x0012007e : mov ecx, [rdi]; mov [rdx + 0x10], rcx; mov [rdi], rax; mov [rip + 0xf31ee], 0; ret
> 0x00087ba0 : mov rcx, [rdx + 0x10]; lea rax, [rcx + rax*4]; mov [rdx], rax; xor eax, eax; ret
> 0x000898a7 : mov rdx, [r14 + 0x40]; sub rdx, rsi; mov [rbp - 0xe8], rcx; mov rdi, r14; call rax
> 0x0015e007 : mov rsi, [rbx + 0x10]; lea rdx, [rbp - 0x2290]; mov rdi, r14; call [rax + 0x20]
> 0x0004491d : mov r8, [rdx + 0x28]; mov r9, [rdx + 0x30]; mov rdx, [rdx + 0x88]; xor eax, eax; ret
> 0x0015e008 : mov esi, [rbx + 0x10]; lea rdx, [rbp - 0x2290]; mov rdi, r14; call [rax + 0x20]
> 0x0015bd7e : mov rdi, [r13]; lea rsi, [rbp - 0x88]; mov rax, [rdi + 0x38]; call [rax + 0x10]
> 0x0015bd7f : mov edi, [rbp]; lea rsi, [rbp - 0x88]; mov rax, [rdi + 0x38]; call [rax + 0x10]
> 0x000d74c3 : mov ecx, [rdi + rax]; xor edx, edx; cmp ecx, [rsi + rax]; setg dl; lea eax, [rdx + rdx - 1]; ret
> 0x0015d6b8 : mov rax, [r12 + 8]; mov [rbp - 0x14], ecx; mov esi, 8; mov rdi, r12; call [rax + 0x30]
> 0x000c1ed8 : mov rdi, [rcx]; lea r9, [rbp - 0x48]; push 1; lea rcx, [rax + 1]; push 0; call [rbp - 0x68]
> 0x000c1ed9 : mov edi, [rcx]; lea r9, [rbp - 0x48]; push 1; lea rcx, [rax + 1]; push 0; call [rbp - 0x68]
> 0x000a4469 : mov r12, [r8 + 8]; mov rbx, [r8]; mov rdi, r8; call [rip + 0x16e8af]; mov rdi, r12; call rbx
> 0x000a298b : mov r13, [rbx + 8]; mov rdi, rbx; mov r12, [rbx]; call [rip + 0x17038d]; mov rdi, r13; call r12
> 0x0003e63f : mov r14, [rdi + 0x20]; mov r15, [rdi + 0x28]; mov eax, esi; mov rsp, r8; mov rbp, r9; nop ; jmp rdx
> 0x000a298c : mov ebp, [rbx + 8]; mov rdi, rbx; mov r12, [rbx]; call [rip + 0x17038d]; mov rdi, r13; call r12
> 0x00171e8e : mov rax, [r15]; sub eax, [rsi]; mov ecx, [rdi + rdx - 4]; mov edi, [rsi + rdx - 4]; sub ecx, edi; or eax, ecx; ret
> 0x001275fc : mov edx, [r13 + 0x18]; movdqu xmm0, xmm[r13 + 0x30]; mov [rbp - 0x110], edx; mov rdx, r14; movups xmm[rbp - 0x108], xmm0; call rax
> 0x000d2378 : mov r10, [rcx + 0x10]; lea r9, [rbp - 0x68]; push 1; lea rcx, [rax + 4]; push 0; mov rdi, r10; call [rbp - 0x78]
> 0x001270c3 : mov edx, [r12 + 0x60]; movdqu xmm0, xmm[r12 + 0x78]; mov [rbp - 0x110], edx; lea rdx, [rbp - 0x130]; movups xmm[rbp - 0x108], xmm0; call rax
> 0x00126feb : mov edx, [r14 + 0x18]; movdqu xmm0, xmm[r14 + 0x30]; mov [rbp - 0x110], edx; lea rdx, [rbp - 0x130]; movups xmm[rbp - 0x108], xmm0; call rax
> 0x0016ebd7 : mov rdi, [r15]; mov [rbp - 0xb0], 0; lea rsi, [rbp - 0xa0]; movaps xmm[rbp - 0xe0], xmm2; movaps xmm[rbp - 0xd0], xmm2; movaps xmm[rbp - 0xc0], xmm2; call r14
> 0x0005448e : mov rsi, [rdx + 0x70]; mov rcx, [rdx + 0x98]; mov r8, [rdx + 0x28]; mov r9, [rdx + 0x30]; mov rdx, [rdx + 0x88]; xor eax, eax; ret
> 0x000752e6 : movzx ecx, [rbx + rdx]; lea rdx, [rip + 0x1390cf]; lea rbx, [rip - 0x117b]; movsxd rdx, [rdx + rcx*4]; add rdx, rbx; xor ebx, ebx; jmp rdx
> 0x001641ae : mov edx, [r15 + 0x60]; lea r12d, [rax - 1]; mov rax, [r15 + 0x70]; mov rsi, [rbp - 0xb8]; mov [r15 + 0x48], r12d; call [rax + 0x18]