Simple example of gadget chain

We know that the following happens once a function is done: pop eip

mov ebp, esp
pop ebp (pops sfp / old ebp into current ebp)
ret ... (pops the return address and returns control to it)

Now we want to chain gadgets to achieve the following:

increment $eax by 4
pops 0xcafecafe into $ebx from stack
increment $ebx by 8

$eax = $eax + 4
$ebx = 0xcafecafe
$ecx = $ecx + 8 

This is our chain layout:

AAAA... (padding)
addr_add_eax (replaces currect $eip)
addr_pop_ebx (pops the next instruction on the stack into ebx)
0xcafecafe
addr_add_ecx