import struct
import logging
from rex.exploit.shellcode import Shellcode

l = logging.getLogger("rex.exploit.shellcodes.cgc_x86_setregister")

class X86SetRegister(Shellcode):

    supported_platforms = ["cgc", "unix"]

    arch = "X86"

    name = "setregister"

    eax_format = "b8%sbb%sffe3"
    ebx_format = "bb%sb8%sffe3"
    ecx_format = "b9%sbb%sffe3"
    edx_format = "ba%sbb%sffe3"
    edi_format = "bf%sbb%sffe3"
    esi_format = "be%sbb%sffe3"
    esp_format = "bc%sbb%sffe3"
    ebp_format = "bd%sbb%sffe3"

    def to_raw(self, register, value, ip):
        '''
        :param register: register to set
        :param value: value to set register to
        :param ip: ip value to crash at
        '''

        encoded_value = struct.pack("<I", value).encode('hex')
        encoded_ip = struct.pack("<I", ip).encode('hex')
        if register == "eax":
            hex_code = self.eax_format % (encoded_value, encoded_ip)
        elif register == "ebx":
            hex_code = self.ebx_format % (encoded_value, encoded_ip)
        elif register == "ecx":
            hex_code = self.ecx_format % (encoded_value, encoded_ip)
        elif register == "edx":
            hex_code = self.edx_format % (encoded_value, encoded_ip)
        elif register == "edi":
            hex_code = self.edi_format % (encoded_value, encoded_ip)
        elif register == "esi":
            hex_code = self.esi_format % (encoded_value, encoded_ip)
        elif register == "esp":
            hex_code = self.esp_format % (encoded_value, encoded_ip)
        elif register == "ebp":
            hex_code = self.ebp_format % (encoded_value, encoded_ip)
        else:
            raise ValueError("register '%s' does not exist")

        return hex_code.decode('hex')

import struct
import logging
from rex.exploit.shellcode import Shellcode

l = logging.getLogger("rex.exploit.shellcodes.cgc_x86_setregister")

class X86SetRegister(Shellcode):

    supported_platforms = ["cgc", "unix"]

    arch = "X86"

    name = "setregister"

    eax_format = "b8%sbb%sffe3"
    ebx_format = "bb%sb8%sffe0"
    ecx_format = "b9%sbb%sffe3"
    edx_format = "ba%sbb%sffe3"
    edi_format = "bf%sbb%sffe3"
    esi_format = "be%sbb%sffe3"
    esp_format = "bc%sbb%sffe3"
    ebp_format = "bd%sbb%sffe3"

    def to_raw(self, register, value, ip):
        '''
        :param register: register to set
        :param value: value to set register to
        :param ip: ip value to crash at
        '''

        encoded_value = struct.pack("<I", value).encode('hex')
        encoded_ip = struct.pack("<I", ip).encode('hex')
        if register == "eax":
            hex_code = self.eax_format % (encoded_value, encoded_ip)
        elif register == "ebx":
            hex_code = self.ebx_format % (encoded_value, encoded_ip)
        elif register == "ecx":
            hex_code = self.ecx_format % (encoded_value, encoded_ip)
        elif register == "edx":
            hex_code = self.edx_format % (encoded_value, encoded_ip)
        elif register == "edi":
            hex_code = self.edi_format % (encoded_value, encoded_ip)
        elif register == "esi":
            hex_code = self.esi_format % (encoded_value, encoded_ip)
        elif register == "esp":
            hex_code = self.esp_format % (encoded_value, encoded_ip)
        elif register == "ebp":
            hex_code = self.ebp_format % (encoded_value, encoded_ip)
        else:
            raise ValueError("register '%s' does not exist")

        return hex_code.decode('hex')

Fix 'ebx' setting shellcode, it now use 'eax' as the jump destination register