#!/bin/sh
# DF-0020 PoC run: craft the malformed ELF and exec it.
#
# The crafted binary has EI_OSABI=200 (obscure), so the kernel can ONLY
# select a brand via the PT_NOTE match path. With the brandnote truncated
# (descriptor claimed but not present), the behavior is:
#
#   UNFIXED kernel (#0): note_overflow passes (does not check n_descsz),
#     bsd_trans_osrel reads the missing descriptor OOB, brand match succeeds,
#     execve loads the binary (no PT_LOAD => SIGSEGV at entry=0). The shell
#     does NOT print "Exec format error".
#
#   FIXED kernel (n_descsz checked): note_overflow returns TRUE for the
#     truncated note, brand match fails, no other brand matches an OSABI=200
#     binary, get_brandinfo returns NULL, execve fails with ENOEXEC. The
#     shell prints "Exec format error: ..." and the run exits non-zero.
#
set -e
cd "$(dirname "$0")"
OUT=/tmp/df0020_oob_elf
./elf_note_oob "$OUT"
chmod +x "$OUT"
echo "--- attempting execve ---"
"$OUT"
rc=$?
echo "EXECVE_EXIT=$rc"