⬢ DragonFlyBSD Kernel Audit
DF-2361 / probe.py
← back to finding ↓ download raw
#!/usr/bin/env python3 -u
# probe.py -- sanity: enter the real stub over the serial socket, handshake,
# one '?' round trip, detach, confirm resume. Establishes rig viability.
import sys, os, time, subprocess
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
from rsp import SerialPeer, parse_t05

SOCK = "/home/maxx/dfbsd/dfbsd/dfbsd-qemu/df236x/ser.sock"
RUNNER = "/home/maxx/dfbsd/dfbsd/dfbsd-qemu/run236.sh"

p = SerialPeer(SOCK, "/tmp/opencode/probe2-raw.log", name="probe")
print("[*] peer connected; firing trigger (async)")
subprocess.Popen([RUNNER, "trigger"])
m = p.wait(r"\$T[0-9a-fA-F]{2}[^#]*#[0-9a-fA-F]{2}", 40)
if m is None:
    print("[!] NO T05 -- stub not talking on com0"); p.close(); sys.exit(2)
t05 = parse_t05(m.group(0)[1:-3].decode())
p.send(b"+")
print("[+] STUB ALIVE  rip=%s rbp=%s rsp=%s" % (t05.get("10"), t05.get("06"), t05.get("07")))
rsp = int(t05["07"], 16)
print("[+] stack VA region: 0x%x (kernel image at 0xffffffff81xxxxxx)" % rsp)
r = p.pkt("?");            print("[+] '?'   -> %r" % r)
g = p.pkt("g");            print("[+] 'g'   len=%d => sizeof(registers)=%d" % (len(g), len(g)//2))
d = p.pkt("D");            print("[+] 'D'   -> %r" % d)
m = p.wait(r"restarted", 25)
print("[%s] kernel resumed: %s" % ("+" if m else "-", m.group(0) if m else "NO MARKER"))
time.sleep(3); p.pump(quiet=True); p.close()
print("[+] probe complete")