yup, and gadgets are collected from ntdll.dll. It scans ntdll.dll code section in order to find them. Using as few gadgets as possible help to make this method reliable over ntdll.dll updates.