ropshell> use ea5f0e838d70cc0064d188c80f42444f (download)
name         : hwsec.elf (arm/ELF)
base address : 0x10000100
total gadgets: 1019

ropshell> suggest
jmpcall
    > 0x10000265 : bx r0
    > 0x100001f5 : bx r2
    > 0x100078f3 : bx r3
    > 0x1000877f : bx r4
    > 0x10014141 : bx ip
load mem
    > 0x100001f3 : ldrh r0, [r1]; bx r2
    > 0x1001292b : ldr r0, [r3]; bx lr
    > 0x10010b2d : ldr r4, [r5, r4]; blx r4
    > 0x100140db : ldr r1, [pc, #4]; bx lr
    > 0x1000877d : ldr r4, [pc, #0x50]; bx r4
pop pop ret
    > 0x10007b55 : pop {pc}
    > 0x10002b8d : pop {r0, pc}
    > 0x10008885 : pop {r4, r5, pc}
    > 0x100082bd : pop {r0, r1, r2, pc}
    > 0x10001a47 : pop {r4, r5, r6, r7, pc}
stack pivoting
    > 0x10000447 : mov sp, r7; pop {r7, pc}
write mem
    > 0x10013615 : str r1, [r3]; bx lr
    > 0x10013823 : str r3, [r0, #0x10]; pop {r4, r5, r6, pc}
    > 0x10007a79 : str r6, [r2, #0x70]; pop {r4, r5, r6, r7, pc}
    > 0x10010e5f : str r0, [r4, #0x50]; pop {r4, r5, r6, pc}
    > 0x10010ded : str r3, [r4, #0x50]; pop {r4, r5, r6, pc}