⬢ DragonFlyBSD Kernel Audit
DF-2489 / cycle.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
#!/bin/sh
# cycle.sh <go-scenario> [keep]  -- full reset+rebuild+boot+fire cycle
# for one FATAL scenario (2/3/4/5). Run from the host repo root.
# Usage: sh findings/poc/DF-2489/cycle.sh 3
set -e
GO=$1
cd "$(dirname "$0")/../../.."   # repo root

echo "=== reset with-src ==="
dfbsd-qemu/vm.sh down >/dev/null 2>&1 || true
pkill -9 qemu-system-x86 2>/dev/null || true
sleep 2
rm -f dfbsd-qemu/vm.pid
dfbsd-qemu/vm.sh reset with-src >/dev/null
dfbsd-qemu/vm.sh status

echo "=== deploy rig ==="
dfbsd-qemu/vm.sh run_root 'mkdir -p /root/dfrig2489'
for f in dfrig2489.c Makefile build.sh run.sh; do
	B=$(base64 -w0 findings/poc/DF-2489/$f)
	dfbsd-qemu/vm.sh run_root "echo '$B' | openssl base64 -d -A > /root/dfrig2489/$f"
done
dfbsd-qemu/vm.sh run_root 'chmod +x /root/dfrig2489/*.sh; sh /root/dfrig2489/build.sh' 2>&1 | tail -2

echo "=== reboot into rig ==="
dfbsd-qemu/vm.sh run_root 'shutdown -r now' >/dev/null 2>&1 || true
sleep 25
dfbsd-qemu/vm.sh down >/dev/null 2>&1 || true
sleep 2
dfbsd-qemu/vm.sh up >/dev/null
dfbsd-qemu/vm.sh run_root 'kldstat -n dfrig2489'

echo "=== fire go=$GO ==="
dfbsd-qemu/vm.sh run_root "sh /root/dfrig2489/run.sh $GO" >/dev/null 2>&1 || true
sleep 6
echo "=== serial tail ==="
dfbsd-qemu/vm.sh log 60
dfbsd-qemu/vm.sh status