ropshell> use f1066e2543d511b6540dab8925034363 (download)
name         : ntdll.dll (i386/RAW)
base address : 0x0
total gadgets: 11366

ropshell> suggest "write mem"
> 0x00067422 : add [ebx], eax; ret
> 0x0003a016 : add [ebx], esi; ret
> 0x00078e3c : add [ebx], edi; ret
> 0x00181640 : add [ecx], esi; ret
> 0x000304b2 : add [ecx], eax; pop edi; ret
> 0x00017f95 : adc [edx], ebp; lahf ; ret
> 0x000263fd : add [eax + 0x5dc03308], ecx; ret 0xc
> 0x000fc77d : add [eax + 0x3b217501], ebp; ret
> 0x00055df7 : add [ebx + 0x175fce0], eax; ret
> 0x0007ce7e : adc [ebx + 0x33f703c7], ecx; ret
> 0x0002805b : adc [ecx + eax], ebx; ret
> 0x000b5bb9 : add [edx + 0x2b], ebx; ret
> 0x0006e367 : add [esi + 0x5b], ebx; ret
> 0x000d81e9 : add [edi + 0x5e], ebx; ret
> 0x0001bbce : adc [edi + 0x16], esi; ret
> 0x00032342 : add [edi], ecx; test [ebx - 0xa000000], esp; ret
> 0x0003f918 : add [ebp + 5], esi; pop esi; pop ebp; ret 4
> 0x000fadfb : adc [eax], edx; idiv edi; mov esp, ebp; pop ebp; ret 0x10
> 0x0002f210 : add [ecx + 0x1400e3], eax; add [ebx], cl; ret
> 0x00051596 : add [edx + 0x5b0b2444], ecx; mov esp, ebp; pop ebp; ret 0x10
> 0x000705ef : adc [edi + 0x50], edx; call esi
> 0x000cb7f5 : add [ebp + 0xc086], ecx; add [ebx], bh; ret
> 0x0006b362 : add [eax], ecx; add [edx + 0x4b2ff160], bh; call edx; ret 8
> 0x0006b492 : add [ebx], ecx; add [edx + 0x4b2ff160], bh; call edx; ret 0xc
> 0x0006b7b2 : add [ebx], edx; add [edx + 0x4b2ff160], bh; call edx; ret 0x10
> 0x0006b892 : add [ecx], edx; add [edx + 0x4b2ff160], bh; call edx; ret 0x10
> 0x0006b852 : add [edx], eax; add [edx + 0x4b2ff160], bh; call edx; ret
> 0x0006ad92 : add [edx], ecx; add [edx + 0x4b2ff160], bh; call edx; ret 0xc
> 0x0006b952 : add [esi], eax; add [edx + 0x4b2ff160], bh; call edx; ret 8
> 0x0006b482 : add [esi], ecx; add [edx + 0x4b2ff160], bh; call edx; ret 0xc
> 0x0006b022 : add [edi], eax; add [edx + 0x4b2ff160], bh; call edx; ret 8
> 0x000ca9f0 : add [edi + 0x10], eax; xor eax, eax; pop edi; pop esi; ret
> 0x000c2007 : add [edi], esi; xor eax, eax; pop edi; pop esi; pop ebx; pop ebp; ret 8
> 0x000984c9 : add [eax + 0x1089e901], esi; cld ; jmp [ebx]
> 0x000f896b : adc [eax], ebp; dec ebx; mov [edx], eax; xor eax, eax; inc eax; ret
> 0x000a70db : adc [ecx + 0x5e5ffff9], edi; mov al, bl; pop ebx; mov esp, ebp; pop ebp; ret
> 0x00027c2a : add [esi + 4], eax; xor eax, eax; pop edi; pop esi; mov esp, ebp; pop ebp; ret 8
> 0x000227dd : adc [esi + eax], ecx; add [ebx + 0xc8d1445], cl; cmp cl, [ecx + 0x5fc03308]; pop esi; pop ebx; pop ebp; ret 0x10
> 0x000ca99f : adc [ebx + 9], esi; mov eax, [ebp + 8]; mov [edx], eax; add [ecx + 4], 4; xor eax, eax; pop ebp; ret 8