⬢ DragonFlyBSD Kernel Audit
DF-2491 / cycle.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
#!/bin/sh
# cycle.sh <go-scenario> [keep]  -- full reset+rebuild+boot+fire cycle
# for one scenario.  Run from the host repo root.
# Usage: sh findings/poc/DF-2491/cycle.sh 7 [keep]
#   keep = do not vm.sh reset first (module already installed+loaded;
#          use for consecutive fatal scenarios across reboots)
set -e
GO=$1
cd "$(dirname "$0")/../../.."   # repo root

if [ "$2" != "keep" ]; then
	echo "=== reset with-src ==="
	dfbsd-qemu/vm.sh down >/dev/null 2>&1 || true
	pkill -9 qemu-system-x86 2>/dev/null || true
	sleep 2
	rm -f dfbsd-qemu/vm.pid
	dfbsd-qemu/vm.sh reset with-src >/dev/null
	dfbsd-qemu/vm.sh status
else
	echo "=== reboot only (rig installed) ==="
	dfbsd-qemu/vm.sh run_root 'shutdown -r now' >/dev/null 2>&1 || true
	sleep 25
	dfbsd-qemu/vm.sh down >/dev/null 2>&1 || true
	sleep 2
	dfbsd-qemu/vm.sh up >/dev/null
fi
dfbsd-qemu/vm.sh run_root 'kldstat -n dfrig2491'

if [ "$2" != "keep" ]; then
	echo "=== deploy rig ==="
	dfbsd-qemu/vm.sh run_root 'mkdir -p /root/dfrig2491'
	for f in dfrig2491.c Makefile build.sh run.sh; do
		B=$(base64 -w0 findings/poc/DF-2491/$f)
		dfbsd-qemu/vm.sh run_root "echo '$B' | openssl base64 -d -A > /root/dfrig2491/$f"
	done
	dfbsd-qemu/vm.sh run_root 'chmod +x /root/dfrig2491/*.sh; sh /root/dfrig2491/build.sh' 2>&1 | tail -4

	echo "=== reboot into rig ==="
	dfbsd-qemu/vm.sh run_root 'shutdown -r now' >/dev/null 2>&1 || true
	sleep 25
	dfbsd-qemu/vm.sh down >/dev/null 2>&1 || true
	sleep 2
	dfbsd-qemu/vm.sh up >/dev/null
	dfbsd-qemu/vm.sh run_root 'kldstat -n dfrig2491'
fi

echo "=== fire go=$GO ==="
dfbsd-qemu/vm.sh run_root "sh /root/dfrig2491/run.sh $GO" 2>&1 || true
sleep 6
echo "=== serial tail ==="
dfbsd-qemu/vm.sh log 60
dfbsd-qemu/vm.sh status